This post is going to show how to install Guardium system and how to install patches or updates on  Central Manager and Collector. It will use Web GUI and Command line to complete this task.

Basic Installation 

1. Load the Guardium ISO.
2. When the system boots, you will be presented with the following screen.
1. Choose “Standard Installation (non CM)” for the collectors
2. Choose “Aggregator or Central Manager (CM)” for the Central Manager

3. After the installation completes, login from the console as cli (password=guardium)
1. Reset and make note of the cli password

4. Perform the following configuration commands:

5. Confirm that you configured each setting correctly.

6. Enter “restart system” to reboot the VM

7. Confirm that you can access the machine via ssh

show network interface all 
show network routes defaultroute
show network resolver all
show system hostname
show system domain
show system clock timezone
show system clock datetime
show system ntp all
show unit type

VM Cloning instructions:

1. On the existing collector VM, run “store network interface reset”.  This instructs the collector to reset the NIC/MAC information upon reboot.
2. Shutdown the collector by running “stop system”.
3. Clone the collector
4. Bring up the new VM. If it asks if you moved or copied the VM, please answer with “copy”, as this will enable the virtualization software to configure new parameters like MAC address for the clone.
5. Log into the appliance as user CLI
6. Run “show network macs”. The MAC address should match the MAC address assigned by VMWare.  If this returns an empty string, the MAC address has not been properly setup for the clone.
7. Set the IP address, defaultroute, hostname, etc. and resolver as necessary (see Appendix B)
1. You may need to re-run the commands on the original VM because of the “store network interface reset” command.
8. Restart the system by running “restart system”
9. Log into the appliance again as user CLI
10. Store the global ID by running store product gid <gid_value> 
1. The Global ID can be any number, so long as it is unique. During the cloning process this unique number is necessary. Please obtain the Global IDs from your other appliances and arrive at a number that is unique for this clone.
11. Verify the global ID by running show product gid
12. Restart the system if requested

Check IBM Guardium Appliance and Agent Version

Download a server / agent Patch from IBM Fix Central

Patches explanation:

Install a Patch for Guardium from Command Line
This method usually is for Central Manager (Aggregator)

Once the patch is downloaded, the patch should be uploaded to the Guardium environment. Based on the environment, the patch should either be uploaded to either the Central Manager or the individual collector

It is strongly suggested to have a complete system backup prior to installing a patch

• Login to the applicance as ‘cli’
• Type the command ‘fileserver <<ip_address>> <<duration>> ‘. This will enable a web server
• Once the fileserver command is executed, from the web browser, connect to the appliance https://<<appliance_name_or_ip>>:8445

cm01.51sec.org> fileserver 10.10.10.2 1200

Starting the file server...
The file server is ready at https://cm01.51sec.org:8445
The timeout has been set to 1200 seconds and it may timeout during the uploading.

The upload will only be accessible from the IP you are logged in from: 10.10.136.2

Press ENTER to stop the file server.

Stopping process

Register patch files in the directory:
SqlGuard-11.0p100_GPU_Nov_2019_V11.1.tgz.enc.sig
Register succeeded
ok
cm01.51sec.org>

1. Browse the local filesystem to find the downloaded patch file (already unzipped)
2. Click the upload button to upload the patch file (*.sig ) to the appliance

• Once the patch is uploaded, close the ‘fileserver’ by simply hitting ‘enter’
• In the cli window, use the patch installation commands to install the patch
• Show system patch available : shows the available patches that can be installed (You might see some error message because of some old wrong package uploaded)
• Store system patch install sys now
• This will start the wizard to install the available patches.

itprosec-tor-igcm01.51sec.org> store system patch install sys

List the files in the patches directory:

1. SqlGuard-10.0p11000_Upgrade_to_Version_11.0_Jun_2019.tgz.enc.sig
2. SqlGuard-10.0p620_Bundle_Apr_25_2019.tgz.enc.sig
3. SqlGuard-10.0p9997.tgz.enc.sig
4. SqlGuard-11.0p12_Bundle_Nov_05_2019.tgz.enc.sig
5. SqlGuard-11.0p4003_Snif_Oct_24_2019.tgz.enc.sig

Please choose patches to install (1-5, or multiple numbers separated by ",", or q to quit): 5
Install item 5

Patch has been submitted, and will be installed according to the request time,
please check installed patches report or CLI (show system patch installed).

Please don't forget to remove your media if necessary.
ok

itprosec-tor-igcm01.51sec.org> show system patch installed
P#      Who       Description                     Request Time         Status
11000   CLI       Upgrade to Version 11.0 (Jun 07 2019-08-30 11:14:11  Phase 5: Migration completed
4003    CLI       Snif Update (Oct 24 2019)       2019-12-04 17:18:45  STEP: Executing Post Install Actions
12      CLI       SqlGuard-11.0p12_Bundle_Nov_05_ 2019-12-04 17:21:01  Preparing to install patch.
ok

Note: Your installation might be failed because of missing dependency, just as show below:

cm01.51sec.org> store system patch install sys

List the files in the patches directory:

1. SqlGuard-10.0p11000_Upgrade_to_Version_11.0_Jun_2019.tgz.enc.sig
2. SqlGuard-10.0p620_Bundle_Apr_25_2019.tgz.enc.sig
3. SqlGuard-10.0p9997.tgz.enc.sig
4. SqlGuard-11.0p100_GPU_Nov_2019_V11.1.tgz.enc.sig
5. SqlGuard-11.0p12_Bundle_Nov_05_2019.tgz.enc.sig
6. SqlGuard-11.0p4003_Snif_Oct_24_2019.tgz.enc.sig

Please choose patches to install (1-6, or multiple numbers separated by ",", or                                                                                                              q to quit): 4
Install item 4


Dependent patches not installed successfully or not available: 9997



Please don't forget to remove your media if necessary.
ok

In above example, latest health_check patch was not installed first. You will need to go to fix center to download this latest health_check patch.
Installing latest health check patch is same as installing other patch:
a. Upload extracted .sig healtch_check patch through fileserver command
b. store system patch install sys : choose the one you just uploaded
c. show system patch installed : checking installation process

Install Patch from Web Gui for Collector(s)
Distribute a patch

To distribute a patch from a central manager to managed units, one of the following must have taken place:

Install DPS Update

You may need to update the Guardium DPS file after upgrade or restore procedures. Download the latest DPS file, then use the Harden > Vulnerability Assessment > Customer Uploads tool to upload and import the new DPS file.


Click green check mark to import uploaded DPS file.

Related Video:

References

• IBM Security Guardium 11.0.0
• IBM Security Learning Academy – Guardium
• guardiumnotes