This post is going to show how to install Guardium system and how to install patches or updates on Central Manager and Collector. It will use Web GUI and Command line to complete this task.
Setup Initial and Baisc Configuration:
- Load the Guardium ISO.
- When the system boots, you will be presented with the following screen.
- Choose “Standard Installation (non CM)” for the collectors
- Choose “Aggregator or Central Manager (CM)” for the Central Manager
- After the installation completes, login from the console as cli (password=guardium)
- Reset and make note of the cli password
- Perform the following configuration commands:
store network interface mask <subnet_mask>
store network routes defaultroute <default_router_ip>
store system hostname <host_name>
store system domain <domain_name>
- Confirm that you configured each setting correctly.
- Enter “restart system” to reboot the VM
- Confirm that you can access the machine via ssh
show network interface all show network routes defaultroute show network resolver all show system hostname show system domain show system clock timezone show system clock datetime show system ntp all show unit type
VM Cloning instructions:
- On the existing collector VM, run “store network interface reset”. This instructs the collector to reset the NIC/MAC information upon reboot.
- Shutdown the collector by running “stop system”.
- Clone the collector
- Bring up the new VM. If it asks if you moved or copied the VM, please answer with “copy”, as this will enable the virtualization software to configure new parameters like MAC address for the clone.
- Log into the appliance as user CLI
- Run “show network macs”. The MAC address should match the MAC address assigned by VMWare. If this returns an empty string, the MAC address has not been properly setup for the clone.
- Set the IP address, defaultroute, hostname, etc. and resolver as necessary (see Appendix B)
- You may need to re-run the commands on the original VM because of the “store network interface reset” command.
- Restart the system by running “restart system”
- Log into the appliance again as user CLI
- Store the global ID by running store product gid <gid_value>
- The Global ID can be any number, so long as it is unique. During the cloning process this unique number is necessary. Please obtain the Global IDs from your other appliances and arrive at a number that is unique for this clone.
- Verify the global ID by running show product gid
- Restart the system if requested
Check IBM Guardium Appliance and Agent Version
Download a server / agent Patch from IBM Fix Central
Install a Patch for Guardium from Command Line
This method usually is for Central Manager (Aggregator)
Once the patch is downloaded, the patch should be uploaded to the Guardium environment. Based on the environment, the patch should either be uploaded to either the Central Manager or the individual collector
It is strongly suggested to have a complete system backup prior to installing a patch
- Login to the applicance as ‘cli’
- Type the command ‘fileserver <<ip_address>> <<duration>> ‘. This will enable a web server
- Once the fileserver command is executed, from the web browser, connect to the appliance https://<<appliance_name_or_ip>>:8445
cm01.51sec.org> fileserver 10.10.10.2 1200 Starting the file server... The file server is ready at https://cm01.51sec.org:8445 The timeout has been set to 1200 seconds and it may timeout during the uploading. The upload will only be accessible from the IP you are logged in from: 10.10.136.2 Press ENTER to stop the file server.
Stopping process Register patch files in the directory: SqlGuard-11.0p100_GPU_Nov_2019_V11.1.tgz.enc.sig Register succeeded ok cm01.51sec.org>
1. Browse the local filesystem to find the downloaded patch file (already unzipped)
2. Click the upload button to upload the patch file (*.sig ) to the appliance
- Once the patch is uploaded, close the ‘fileserver’ by simply hitting ‘enter’
- In the cli window, use the patch installation commands to install the patch
- Show system patch available : shows the available patches that can be installed (You might see some error message because of some old wrong package uploaded)
- Store system patch install sys now
- This will start the wizard to install the available patches.
itprosec-tor-igcm01.51sec.org> store system patch install sys List the files in the patches directory: 1. SqlGuard-10.0p11000_Upgrade_to_Version_11.0_Jun_2019.tgz.enc.sig 2. SqlGuard-10.0p620_Bundle_Apr_25_2019.tgz.enc.sig 3. SqlGuard-10.0p9997.tgz.enc.sig 4. SqlGuard-11.0p12_Bundle_Nov_05_2019.tgz.enc.sig 5. SqlGuard-11.0p4003_Snif_Oct_24_2019.tgz.enc.sig Please choose patches to install (1-5, or multiple numbers separated by ",", or q to quit): 5 Install item 5 Patch has been submitted, and will be installed according to the request time, please check installed patches report or CLI (show system patch installed). Please don't forget to remove your media if necessary. ok
itprosec-tor-igcm01.51sec.org> show system patch installed P# Who Description Request Time Status 11000 CLI Upgrade to Version 11.0 (Jun 07 2019-08-30 11:14:11 Phase 5: Migration completed 4003 CLI Snif Update (Oct 24 2019) 2019-12-04 17:18:45 STEP: Executing Post Install Actions 12 CLI SqlGuard-11.0p12_Bundle_Nov_05_ 2019-12-04 17:21:01 Preparing to install patch. ok
Note: Your installation might be failed because of missing dependency, just as show below:
cm01.51sec.org> store system patch install sys List the files in the patches directory: 1. SqlGuard-10.0p11000_Upgrade_to_Version_11.0_Jun_2019.tgz.enc.sig 2. SqlGuard-10.0p620_Bundle_Apr_25_2019.tgz.enc.sig 3. SqlGuard-10.0p9997.tgz.enc.sig 4. SqlGuard-11.0p100_GPU_Nov_2019_V11.1.tgz.enc.sig 5. SqlGuard-11.0p12_Bundle_Nov_05_2019.tgz.enc.sig 6. SqlGuard-11.0p4003_Snif_Oct_24_2019.tgz.enc.sig Please choose patches to install (1-6, or multiple numbers separated by ",", or q to quit): 4 Install item 4 Dependent patches not installed successfully or not available: 9997 Please don't forget to remove your media if necessary. ok
In above example, latest health_check patch was not installed first. You will need to go to fix center to download this latest health_check patch.
Installing latest health check patch is same as installing other patch:
a. Upload extracted .sig healtch_check patch through fileserver command
b. store system patch install sys : choose the one you just uploaded
c. show system patch installed : checking installation process
Install Patch from Web Gui for Collector(s)
Distribute a patch
To distribute a patch from a central manager to managed units, one of the following must have taken place:
Monitor and verify patch installation
Install DPS Update
You may need to update the Guardium DPS file after upgrade or restore procedures. Download the latest DPS file, then use the tool to upload and import the new DPS file.
Click green check mark to import uploaded DPS file.