FOR INTERNAL USE ONLY STANDARD OPERATING PROCEDURE WINDOWS OFFLINE PATCHING (VPC 7.4.3)

Transcription

1 FOR INTERNAL USE ONLY STANDARD OPERATING PROCEDURE WINDOWS OFFLINE PATCHING (VPC 7.4.3) Author: John Landells Date: 12 June 2008

2 Table of Contents Introduction 3 Overview... 3 Before You Begin... 3 Standard Operating Procedure for Windows Offline Patching 4 Introduction... 4 Steps... 4 Modification of Perl Script... 4 Modifications to Patch Analysis Configuration... 5 Configuration Files... 5 Hotfix Configuration... 6 Conclusion... 6 Appendices 7 Appendix 1 Perl Script... 7 Appendix B Updated Perl Config File PAGE 1 OF 21

3 Document Information Version: v0.1 Created by: John Landells Last Modified on: Modified by: PAGE 2 OF 21

4 Introduction The purpose of this SOP is to describe how the Windows downloader introduced in VPC (Vendor Patch Content) can be enhanced to facilitate offline patching. Overview Offline patching is well established for UNIX platforms, but to handle this within a Windows platform previously meant resorting to an NSH-proxy server. Whilst this technique clearly worked and was relatively easy to implement, it always had limitations in particular, it is only a single threaded process (i.e. limited bandwidth) and it represents a potential bottleneck when downloading files during a fixed maintenance window. In order to overcome these limitations and to setup offline patching for Windows, we need to extend the functionality provided in the new Windows Downloader which is shipped as part of VPC Before You Begin This document assumes that the reader is already familiar with the Windows Downloader, and that it has been installed on a PC that has Internet access. The application server should already be configured with a job to call the generate_hotfix_items.nsh script with the appropriate parameters. This document will highlight the changes that need to be made from this starting position in order to implement a true offline patching solution. PAGE 3 OF 21

5 Standard Operating Procedure for Windows Offline Patching Introduction The following steps assume you have a basic BladeLogic environment set up and configured, and you have some general knowledge of using Configuration Manager. The example covered in this document is specific to a Windows environment. The diagram below illustrates conceptually how an environment might look in which this solution is appropriate: Windows Offline Patching Logical Diagram Steps M O D I F I C A T I O N O F P E R L S C R I P T The majority of the work required for the offline patching involves updating the Perl script, and the associated configuration file. In general, the changes are not particularly complex and simply involve downloading the additional Shavlik manifest files (since the basic system only uses HFNetChk6b.cab and PD5.cab) and to copy them to a known location, if required. They need to be copied as the script uses a temporary directory which is removed on completion of the script. To keep things simple, the additional requirements were added to the existing configuration file as follows; hfnetchk6url= hfnetchk5url= hfnetchknonumurl= pd4url= DoCopyCabs=true Note that we re not specifying a specific location for the downloaded files rather we re using the same download folder that s already been specified to hold the patches. The main part of the Perl script is reproduced in appendix A, with the relevant lines highlighted for easy reference. PAGE 4 OF 21

6 R U N N I N G T H E P E R L S C R I P T Ideally, a batch file will be prepared to run the Perl script via the Windows scheduler. Since the script will not attempt to download any files which are already present, it can be left with the default options to download all scripts, as the initial large bandwidth hit will be a one-time occurrence. Additional batch files could also be incorporated which check for critical updates on a more regular basis. Please note that during testing, it was found that this script cannot be started reliably from within the BladeLogic system! Once the patches are downloaded, a scheduled BladeLogic job can be used to handle patch analysis, as usual. M O D I F I C A T I O N S T O P A T C H A N A L Y S I S C O N F I G U R A T I O N In order to utilise the standard patch analysis functionality, the BladeLogic system, needs to be configured to use the downloaded Shavlik files and the offline patch repository. C O N F I G U R A T I O N F I L E S The configuration files are targeted from within the Configuration Manager, via the Tools->Patch Analysis Configuration menu. This brings up the dialog shown below: Configuration Files Highlighted entries point to the Internet facing PC for the Shavlik manifest files. As shown, the URI s need to be modified to point to the previously downloaded manifest files using fully qualified NSH paths. PAGE 5 OF 21

7 H O T F I X C O N F I G U R A T I O N Additionally, BladeLogic needs to be configured to use the offline patch repository as shown below: Hotfix Configuration Using the new Windows VPC functionality released with 7.4.3, we should find that the patches have already been downloaded to the application server within the payload_repository folder (representing the Depot) Conclusion This method for working with offline patching of Windows files should prove to be a reliable, robust solution in the field. As suggested in the introduction, it is preferred over the alternatives for the reasons already stated, and should be the recommended way forward for all such deployments. PAGE 6 OF 21

8 Appendices Appendix 1 Perl Script This appendix shows the modified Perl script - bladelogic_vendor_patch_content_downloader_windows.pl in it s entirety, with the modified lines highlighted. Copyright (c) 2008 Bladelogic Inc. -- All Rights Reserved -- Shavlik Patch Downloader Utility. Author: Rajesh Jangam (rjangam@bladelogic.com) Update v1.3a to handle offline updates Modifications: John Landells (John_Landells@bmc.com) Modules that we wish to Import. use XML::Parser; use download; use parseparams; use IO::File; use Getopt::Std; use File::Path; use File::Copy; use logging; use products_tree; use patch_data; my $conffilename = "downloader.conf"; my %configuration; my $impact_filter=undef; undef(@productlist); undef(@bulletinlist); undef(@qnumberlist); use vars qw/ %opt /; Set Default configuration my $wgetpath; my $downloaderpath; my $timeout = 10; my $hfnetchckurl = " my $pd5url = " PAGE 7 OF 21

9 my $blpatchcheck2path = "./BLPatchCheck2.exe"; my $downloadlocation = "."; my $shavlikconverterdll = "stconvertxml.dll"; my $shavlikpackagerdll = "stpackager.dll"; my $blconvertxmlpath = "./blconvertxml.exe"; my $languagecode = "0409"; my $outputpatchdatafile = "./patch_data.txt"; my $version = "1.3a"; my $DoCopyCabs = 0; Additional Variables for Offline Patching v1.3a my $hfnetchk6url = " my $hfnetchk5url = " my $hfnetchknonumurl = " my $pd4url = " my $DoCopyCabs; my $filehfnetchk6b = "hfnetchk6b.cab"; my $filehfnetchk6 = "hfnetchk6.cab"; my $filehfnetchk5 = "hfnetchk5.cab"; my $filehfnetchk = "hfnetchk.cab"; my $filepd5 = "pd5.cab"; my $filepd4 = "pd4.cab"; Load Configuration Parameters parseparams::parse_args("downloader.conf", \%configuration); if ((exists $configuration'isdebugenabled') and ($configuration'isdebugenabled' eq "true")) logging::setdebugenabled; logging::dbg_msg("debug logging is enabled"); if ((exists $configuration'wgetpath') and ($configuration'wgetpath' =~ /\S/)) $wgetpath = $configuration'wgetpath'; logging::dbg_msg("wgetpath is set as per configuration: $wgetpath"); if ((exists $configuration'downloaderpath') and ($configuration'downloaderpath' =~ /\S/)) $downloaderpath = $configuration'downloaderpath'; logging::dbg_msg("downloaderpath is set as per configuration: $downloaderpath"); if ((exists $configuration'wgettimeout') and ($configuration'wgettimeout' =~ /\S/)) $timeout = $configuration'wgettimeout'; logging::dbg_msg("wgettimeout is set as per configuration: $timeout"); PAGE 8 OF 21

10 if ((exists $configuration'hfnetchkurl') and ($configuration'hfnetchkurl' =~ /\S/)) $hfnetchckurl = $configuration'hfnetchkurl'; logging::dbg_msg("hfnetchkurl is set as per configuration: $hfnetchckurl"); if ((exists $configuration'pd5url') and ($configuration'pd5url' =~ /\S/)) $pd5url = $configuration'pd5url'; logging::dbg_msg("pd5url is set as per configuration: $pd5url"); if ((exists $configuration'blpatchcheck2path') and ($configuration'blpatchcheck2path' =~ /\S/)) $blpatchcheck2path = $configuration'blpatchcheck2path'; logging::dbg_msg("blpatchcheck2path is set as per configuration: $blpatchcheck2path"); if ((exists $configuration'downloadlocation') and ($configuration'downloadlocation' =~ /\S/)) $downloadlocation = $configuration'downloadlocation'; logging::dbg_msg("downloadlocation is set as per configuration: $downloadlocation"); if ((exists $configuration'shavlikconverterdll') and ($configuration'shavlikconverterdll' =~ /\S/)) $shavlikconverterdll = $configuration'shavlikconverterdll'; logging::dbg_msg("shavlikconvertdll is set as per configuration: $shavlikconverterdll"); if ((exists $configuration'shavlikpackagerdll') and ($configuration'shavlikpackagerdll' =~ /\S/)) $shavlikpackagerdll = $configuration'shavlikpackagerdll'; logging::dbg_msg("shavlikpackagerdll is set as per configuration: $shavlikpackagerdll"); if ((exists $configuration'blconvertxmlpath') and ($configuration'blconvertxmlpath' =~ /\S/)) $blconvertxmlpath = $configuration'blconvertxmlpath'; logging::dbg_msg("blconvertxmlpath is set as per configuration: $blconvertxmlpath"); if ((exists $configuration'languagecode') and ($configuration'languagecode' =~ /\S/)) $languagecode = $configuration'languagecode'; logging::dbg_msg("languagecode is set as per configuration: $languagecode"); PAGE 9 OF 21

11 if ((exists $configuration'hfnetchk6url') and ($configuration'hfnetchk6url' =~ /\S/)) $hfnetchk6url = $configuration'hfnetchk6url'; logging::dbg_msg("hfnetchk6url is set as per configuration: $hfnetchk6url"); if ((exists $configuration'hfnetchk5url') and ($configuration'hfnetchk5url' =~ /\S/)) $hfnetchk5url = $configuration'hfnetchk5url'; logging::dbg_msg("hfnetchk5url is set as per configuration: $hfnetchk5url"); if ((exists $configuration'hfnetchknonumurl') and ($configuration'hfnetchknonumurl' =~ /\S/)) $hfnetchknonumurl = $configuration'hfnetchknonumurl'; logging::dbg_msg("hfnetchknonumurl is set as per configuration: $hfnetchknonumurl"); if ((exists $configuration'pd4url') and ($configuration'pd4url' =~ /\S/)) $pd4url = $configuration'pd4url'; logging::dbg_msg("pd4url is set as per configuration: $pd4url"); if ((exists $configuration'docopycabs') and ($configuration'docopycabs' eq true)) $DoCopyCabs = 1; logging::dbg_msg("copy of CAB files required"); Global variables my $tmpfoldername = "tmp".$$; my $tmphfnetchkpath; my $tmppd5path; my $tmphfnetchk6path; my $tmphfnetchk5path; my $tmphfnetchknonumpath; my $tmppd4path; my $tmpshavlikdatafilepath = $tmpfoldername."/shavlik_data_file.xml"; my $tmpconfigfilepath = $tmpfoldername."/shavlik_config.xml"; my $tmppackageresultspath = $tmpfoldername."/shavlik_package_results.xml"; my $tmpconversionlogpath = $tmpfoldername."/conversion.log"; my $tmpproducttreefile = $tmpfoldername."/product_tree.txt"; my $tmpintermediateoutputfile = $tmpfoldername."/interm_output.txt"; my %impact_hash; if ($hfnetchckurl =~ m/.*\/(.*)$/) $tmphfnetchkpath = $tmpfoldername."/$1"; PAGE 10 OF 21

12 $tmphfnetchkpath = $tmpfoldername."/hfnetchk.xml"; if ($pd5url =~ m/.*\/(.*)$/) $tmppd5path = $tmpfoldername."/$1"; $tmppd5path = $tmpfoldername."/pd.xml"; if ($hfnetchk6url =~ m/.*\/(.*)$/) $tmphfnetchk6path = $tmpfoldername."/$1"; $tmphfnetchk6path = $tmpfoldername."/hfnetchk6.xml"; if ($hfnetchk5url =~ m/.*\/(.*)$/) $tmphfnetchk5path = $tmpfoldername."/$1"; $tmphfnetchk5path = $tmpfoldername."/hfnetchk5.xml"; if ($hfnetchknonumurl =~ m/.*\/(.*)$/) $tmphfnetchknonumpath = $tmpfoldername."/$1"; $tmphfnetchknonumpath = $tmpfoldername."/hfnetchknonum.xml"; if ($pd4url =~ m/.*\/(.*)$/) $tmppd4path = $tmpfoldername."/$1"; $tmppd4path = $tmpfoldername."/pd4.xml"; $impact_hash"unknown"="0"; $impact_hash"critical"="1"; $impact_hash"important"="2"; $impact_hash"moderate"="3"; $impact_hash"low"="4"; my %products; details Hash containing product id and associated my $proxyusername; my $proxypassword; PAGE 11 OF 21

13 my $proxyhostport; Main Code - Starts Here logging::dbg_msg("entering main body..."); Scan command line parameters &init; logging::dbg_msg("initialised"); $proxyusername = $optu; $proxypassword = $optx; $proxyhostport = $opta; Check if any filtering criteria is provided logging::dbg_msg("product file: $optp"); logging::dbg_msg("bulletin file: $optb"); logging::dbg_msg("qnumber file: $optq"); if (($optp =~ /\S/) and (parseparams::parselist("$optp", \@productlist))) logging::err_msg("unable to open product list file: $optp. This filter will be ignored."); undef(@productlist); if (($optb =~ /\S/) and (parseparams::parselist("$optb", \@bulletinlist))) logging::err_msg("unable to open Bulletin list file: $optb. This filter will be ignored."); undef(@bulletinlist); logging::dbg_msg("bulleting file OK: $optb"); if (($optq =~ /\S/) and (parseparams::parselist("$optq", \@qnumberlist))) logging::err_msg("unable to open QNumber list file: $optq. This filter will be ignored."); undef(@qnumberlist); if ($opti =~ /\S/) if (($opti eq "Critical") or ($opti eq "Important") or ($opti eq "Moderate") or ($opti eq "Low")) $impact_filter = $opti; PAGE 12 OF 21

14 logging::dbg_msg("setting Impact Identifier filter to $impact_filter"); logging::err_msg("$opti is not a valid Impact Identifier, ignoring this filter."); if (logging::isdebugenabled) printdebuglists(); Create a temporary directory for current session. logging::info_msg("creating directory $tmpfoldername for current session"); if (mkdir ($tmpfoldername, 0777)) logging::dbg_msg("creating directory $tmpfoldername succeeded"); logging::exit_msg("can't create directory \"$tmpfoldername\"", 1); Register Shavlik's Dlls regsitershavlikdlls($shavlikconverterdll, $shavlikpackagerdll); Download hfnetchk6b file from Shavlik logging::info_msg("downloading file $hfnetchckurl... to $tmphfnetchkpath"); $status = mydownloadfile($hfnetchckurl, $tmphfnetchkpath); logging::dbg_msg("download hfnetchck status : $status"); if ($status!= 0) logging::exit_msg("error downloading $hfnetchckurl file", $status); $status = 1; logging::dbg_msg("download of $hfnetchckurl complete. "); $status = 0; Download pd5 file from Shavlik logging::info_msg("downloading file $pd5url... to $tmppd5path"); PAGE 13 OF 21

15 $status = mydownloadfile($pd5url, $tmppd5path); logging::dbg_msg("download pd5 status : $status"); if ($status!= 0) logging::exit_msg("error downloading $pd5url file", $status); $status = 1; logging::dbg_msg("download of $pd5url complete. "); $status = 0; Only get the rest of the Shavlik files if we really need them! (v1.3a) if ($DoCopyCabs) logging::info_msg("downloading additional Shavlik files:"); Download hfnetchk6 file from Shavlik logging::info_msg(" Downloading file $hfnetchk6url... to $tmphfnetchk6path"); $status = mydownloadfile($hfnetchk6url, $tmphfnetchk6path); logging::dbg_msg(" Download hfnetchk6url status : $status"); if ($status!= 0) logging::exit_msg("error downloading $hfnetchk6url file", $status); $status = 1; "); logging::dbg_msg(" $status = 0; Download of $hfnetchk6url complete. Download hfnetchk5 file from Shavlik logging::info_msg(" Downloading file $hfnetchk5url... to $tmphfnetchk5path"); $status = mydownloadfile($hfnetchk5url, $tmphfnetchk5path); logging::dbg_msg(" Download hfnetchk5url status : $status"); if ($status!= 0) logging::exit_msg("error downloading $hfnetchk5url file", $status); $status = 1; "); logging::dbg_msg(" $status = 0; Download of $hfnetchk5url complete. Download hfnetchk file from Shavlik logging::info_msg(" Downloading file $hfnetchknonumurl... to $tmphfnetchknonumpath"); PAGE 14 OF 21

16 $status = mydownloadfile($hfnetchknonumurl, $tmphfnetchknonumpath); logging::dbg_msg(" Download hfnetchknonumurl status : $status"); if ($status!= 0) logging::exit_msg("error downloading $hfnetchknonumurl file", $status); $status = 1; logging::dbg_msg(" complete. "); $status = 0; Download of $hfnetchknonumurl Download pd4 file from Shavlik logging::info_msg(" Downloading file $pd4url... to $tmppd4path"); $status = mydownloadfile($pd4url, $tmppd4path); logging::dbg_msg(" Download pd4url status : $status"); if ($status!= 0) logging::exit_msg("error downloading $pd4url file", $status); $status = 1; logging::dbg_msg(" Download of $pd4url complete. "); $status = 0; logging::info_msg("-- Finished downloading additional Shavlik files --"); logging::info_msg("additional Shavlik files not required"); run decryption utility (blconvertxml) on the downloaded obfuscated files tmphfnetchkpath logging::info_msg("decrypting file $tmphfnetchkpath..."); `\"$blconvertxmlpath\" -l \"$tmpconversionlogpath\" \"$tmphfnetchkpath\" \"$tmpshavlikdatafilepath\"`; if ($?) logging::exit_msg("unable to decrypt file $tmphfnetchkpath", $?); logging::dbg_msg("decryption of $tmphfnetchkpath succeeded"); PAGE 15 OF 21

17 logging::info_msg("extracting Products information and their Service Pack information from decrypted file..."); Here we create a data structure containing product nodes supported by Shavlik with their associated Service Packs. products_tree::create_products_tree(\%products, $tmpshavlikdatafilepath, $tmpproducttreefile); logging::dbg_msg("done extracting products information from the decrypted file..."); logging::info_msg("creating a shavlik_config.xml file containing patch information needed for running Shavlik Packager..."); Open a new file config file for writing. my $output = new IO::File(">$tmpConfigFilePath"); my $patch_id = 1; print $output "<?xml version=\"1.0\" encoding=\"utf-8\"?>"; print $output "<SchemaPatchDetailsConfig xmlns=\" print $output "<PatchDetailsConfig>"; print $output "<ResultXMLPathname>$tmpPackageResultsPath</ResultXMLPathname>"; print $output "<Patches>"; Parse the decrypted shavlik file once again and then add details about patches. &create_patch_details_config; print $output "</Patches>"; print $output "</PatchDetailsConfig>"; print $output "</SchemaPatchDetailsConfig>"; $output->close(); logging::dbg_msg("done creating shavlik_config.xml"); logging::info_msg("running Shavlik Packager to get Download location and payload information of patches"); Patch Details config file is ready Now we should run BlPatchCheck2 for getting download URLs TODO:: Make BlPatchCheck2 path configurable `\"$blpatchcheck2path\" 1 \"$tmppd5path\" \"$tmpconfigfilepath\"`; PAGE 16 OF 21

18 if ($?) logging::exit_msg("error while running Shavlik Packager...", $?); logging::dbg_msg("packaging succeeded... Proceeding to extract Patch data..."); patch_data::generate_patch_data_from_result($tmppackageresultspath, $tmpintermediateoutputfile); Create downloading directory if it does not exist already if (-d $downloadlocation) logging::dbg_msg("download directory: \"$downloadlocation\" exists already.") logging::info_msg("download directory: \"$downloadlocation\" does not exist. Creating one..."); if (mkdir ($downloadlocation, 0777)) logging::dbg_msg("creating directory \"$downloadlocation\" succeeded"); logging::exit_msg("can't create directory \"$downloadlocation\"", 1); Download patches one by one looking from the Output Patch Data file. logging::info_msg("started downloading patches..."); download_patches_from_patch_data($tmpintermediateoutputfile, $outputpatchdatafile); logging::info_msg("completed downloading patches..."); v1.3a If DoCopyCabs is true, we need to copy the CAB files to the download directory. Note that we don't care if this fails...! if ($DoCopyCabs) logging::info_msg("copying CAB files..."); copy($tmphfnetchkpath, $downloadlocation."/".$filehfnetchk6b); PAGE 17 OF 21

19 copy($tmphfnetchk6path, $downloadlocation."/".$filehfnetchk6); copy($tmphfnetchk5path, $downloadlocation."/".$filehfnetchk5); copy($tmphfnetchknonumpath, $downloadlocation."/".$filehfnetchk); copy($tmppd5path, $downloadlocation."/".$filepd5); copy($tmppd4path, $downloadlocation."/".$filepd4); logging::info_msg("...cab files copied!"); If Debug is not enabled, cleanup intermediate directory and files. keep it for post-mortem. if (logging::isdebugenabled) logging::info_msg("debug is enabled. So keeping back temporary directory: $tmpfoldername"); logging::info_msg("removing directory $tmpfoldername"); my $files_deleted = rmtree("$tmpfoldername", 1); logging::dbg_msg("number of files deleted in $tmpfoldername: $files_deleted"); End of main code Rest of file skipped as no further changes are required PAGE 18 OF 21

20 Appendix B Updated Perl Config File This appendix contains the config file downloader.conf that is used by the Perl script. Again, the relevant lines are highlighted. IsDebugEnabled=false Please comment wgetpath if you wish to use BladeLogic's downloader utility capable of passing through an NTLM v2 Proxy. Note: BladeLogic's downloader utility needs JAVA installed wgetpath=c:\ke\windows_downloader\wget.exe wgettimeout=10 Language Code 0409 means English. Please change it to appropriate if you want some other language. to get additional list of languages, refer to lanuagecodes.txt languagecode=0409 hfnetchkurl= pd5url= blpatchcheck2path=c:\ke\windows_downloader\blpatchcheck2.exe downloadlocation=c:\download blconvertxmlpath=c:\ke\windows_downloader\blconvertxml.exe shavlikconverterdll=c:\ke\windows_downloader\stconvertxml.dll shavlikpackagerdll=c:\ke\windows_downloader\stpackager.dll downloaderpath=c:\ke\windows_downloader\blhttprequest.jar Additional Setup items for offline patching hfnetchk6url= hfnetchk5url= hfnetchknonumurl= pd4url= DoCopyCabs=true PAGE 19 OF 21

21 BMC Software helps IT organizations drive greater business value through better management of technology. Our industry-leading Business Service Management solutions ensure that everything IT does is prioritized according to business impact, so IT can proactively address business requirements to lower costs, drive revenue, and mitigate risk. BMC solutions share BMC Atrium technologies to enable IT to manage across the complexity of diverse systems and processes from mainframe to distributed, databases to applications, service to security. Founded in 1980, BMC Software has offices worldwide and fiscal 2005 revenues of more than $1.46 billion. BMC Software. Activate your business with the power of IT. For more information, visit