Dell Protected Workspace Management

Transcription

1 Dell Protected Workspace Management Upgrade Guide Dell Protected Workspace Management v4.1 Created and Maintained by Invincea, Inc. Proprietary For Customer Use Only

2 Dell Protected Workspace Management Server Single Instance Upgrade Guide v4.1 1 Contents Purpose and Intended Audience... 2 Minimum System Requirements... 2 Upgrading from DPWMs v3.x to DPWMs v Upgrading to DPWMs v4.0 on the Current DPWMs v3.x Server...3 ims.conf Changes Upgrading to DPWMs v4.0 using a New VM Upgrading from DPWMs v4.0.x to DPWMs v Contacting Dell Support... 20

3 Purpose and Intended Audience Dell Protected Workspace Management Server Single Instance Upgrade Guide v4.1 2 This document is intended to provide instructions for upgrading the DPWMs from v3.x to v4.1. This is a 2-step upgrade as required. From DPWMS 3.1.x, the server needs to be upgraded first to DPWMS v4.0, before upgrading to v4.1. Minimum System Requirements The minimum system requirements for v4.1 are consistent with v3.1.x and should be set as follows: 4 Processors 8GB of RAM 250GB of disk space (50GB for OS, 100GB for MySQL, 100GB for the File Store)

4 Upgrading from DPWMs v3.x to DPWMs v4.0 Dell Protected Workspace Management Server Single Instance Upgrade Guide v4.1 3 Upgrading from v3.x to v4.0 can be completed in one of two ways. First, the upgrade can be run directly on the current machine using the tgz file. Second, the upgrade can be performed by creating a new VM by deploying the OVA file and migrating the database to the new server. This is the recommended upgrade method if your DPWMS version is 2.2 or 3.0. More information on the process can be found in the Upgrading to DPWMs v4.0 using a New VM section in this document. Note: Please contact Dell support to request a Cynomix api key prior to the upgrade. Upgrading to DPWMs v4.0 on the Current DPWMs v3.x Server If currently running on version 3.1.x please use the following method to upgrade the server. If running a version prior to see Upgrading to DPWMs v4.0 using a New VM. To install DPWMs v4.0 on the DPWMs 3.x Virtual Machine, follow these steps. 1. Create a backup of the current DPWMs using the snapshot feature of the VM or by some other method. 2. Download the DPWMs v4.0 tgz file from the DPW support site: 3. Move the downloaded tgz onto the current DPWMs v3.x server using a file transfer tool like WinSCP. 4. Log in to the DPWMs 3.x Virtual Machine using the root account. 5. Create the new installation path for DPWMs v4.0 by running the following command: mkdir /opt/im4 6. Move the DPWMs v4.0 tgz file that was move to the server into this newly created file path by running the following command: cp /tmp/dpwms x86_64.tgz /opt/im4 Note, the /tmp/ directory is an example and the path you had moved the file to initially may be different. 7. Change directories to the /opt/im4 folder by running the following command: cd /opt/im4 8. Extract the tgz file into the /opt/im4 install path using the following command: tar xzf dpwms x86_64.tgz

5 Dell Protected Workspace Management Server Single Instance Upgrade Guide v Copy the current ims.conf file to the new /opt/im4 install path by using the following command: cp /opt/im3/ims.conf /opt/im4/ims.conf 10. Edit the current ims.conf file with the new ims.defaults file. Both files can be found in /opt/im4. The new ims.defaults file has many new additions and changes that need to be added to the current ims.conf file. Open another session to view the new ims.defaults file when editing the current ims.conf file. To edit the current file use the following command: vi /opt/im4/ims.conf To view the default ims.defaults file use the following command: cat /opt/im4/ims.defaults Differences between v3.1.1 and v4.0.0 are noted in the ims.conf Changes. 11. Update the file_store_root location. Default location below (for fresh installs) file_store_root = /opt/sensor_file_store Make the /opt/sensor_file_store directory by running the following command: mkdir /opt/sensor_file_store Move the existing contents of the old sensor_file_store location to the new one: mv /opt/im3/sensor_file_store/ /opt/sensor_file_store/

6 Dell Protected Workspace Management Server Single Instance Upgrade Guide v4.1 5 If the /opt/im3/sensor_file_store is a mounted drive, edit the /etc/fstab file to change the mount location from /opt/im3/sensor_file_store to /opt/sensor_file_store. vi /etc/fstab Find the line with /opt/im3/sensor_file_store and edit it so the path is /opt/sensor_file_store. Save and quit from the file. Then reboot the server using the reboot command. 12. Update the Cynomix api URL and add the api key: Go to the [trp_cynomix] section, and edit the api_url to equal On the next line add the api_key and set it to the key supplied by Dell Support. If you need a key, please contact Dell Support. 13. Save and quit the ims.conf file by hitting Esc then :wq. 14. Stop the im3 service by running the following: service im3 stop 15. Stop the im3 service from auto-starting by running the following: chkconfig im3 off 16. Check that there are no other DPWMs services running by entering the command below: ps -ef grep main

7 Dell Protected Workspace Management Server Single Instance Upgrade Guide v4.1 6 Look for./main and note the pid number which is the first number in the row. ps -ef grep ims Look for./ims_... processes and note the pid number. If any of these IMs processes are running, they must be killed with the following command. kill -9 ##### 17. Create the startup script by copying the im.init file from /opt/im4/etc into /opt/im4/init.d/im4 using the following: cp /opt/im4/etc/im.init /etc/init.d/im4 18. Change the file permissions on the new file with the following: chmod a+x /etc/init.d/im4 19. Edit the new im4 file by using the following command and change the IMS_INSTANCE=im3 to im4: vi /etc/init.d/im4

8 Dell Protected Workspace Management Server Single Instance Upgrade Guide v Set the new im4 service to auto start chkconfig im4 on 21. Edit the /etc/my.cnf file for settings related to the mysql database with the following command: vi /etc/my.cnf There are three settings to confirm. a. Make sure max_allowed_packet is equal to 500M max_allowed_packet=500m b. The innodb_log_buffer_size should be set to 128M: innodb_log_buffer_size=128m c. The innodb_buffer_pool_size should be set to 50% of the systems RAM (example, a system with 8GB of RAM would be set as follows): innodb_buffer_pool_size=4g d. Set innodb_flush_log_at_trx_commit equal to 2: innodb_flush_log_at_trx_commit=2 22. Restart the mysqld service if the my.cnf file was changed: service mysqld restart 23. Perform a database backup with the following command: This is optional if a VM snapshot has been performed. mysqldump -uroot -pinvincea database_name --max_allowed_packet=500m > /var/lib/mysql/backup/backup.sql

9 Dell Protected Workspace Management Server Single Instance Upgrade Guide v4.1 8 Note that the username, password, and database_name may be different. Please refer to the MySQL info set in your ims.conf file to obtain this information. Also, note the path to write the sql dump file must have sufficient space. The sample above is in the /var/lib/mysql path. Do not continue until the backup is complete. The backup is complete when the cursor moves to a new command line. 24. Start the im4 service to begin the upgrade by running the following command: service im4 start 25. Monitor the ims.log file to be alerted when the upgrade is complete by using the following command: tail f /opt/im4/ims.log This command will display all new log events to the screen. As the upgrade is running, the log will look like the following: When the Starting IMS and the IMS Listening lines are displayed the upgrade is complete (see arrow above). Once complete enter ctrl+c to exit out of the log. Once the upgrade is complete, login to the DPWMs UI to ensure the system is up and running.

10 Dell Protected Workspace Management Server Single Instance Upgrade Guide v If there are any backup scripts set up on the system referring to an old file path, update that to the new path. Also, check if any cron jobs are setup up referring to the old service or file paths. This may be the case if there was a cronjob that emptied out the sensor_file_store folder. To edit cron type the following: crontab -e Please add the below line if it is not currently added. This line will remove old data from the sensor_file_store folder. 0 4 * * * /bin/find /opt/sensor_file_store -maxdepth 1 -mtime +7 -type f xargs rm

11 Dell Protected Workspace Management Server Single Instance Upgrade Guide v ims.conf Changes Changes The following sections were changed in the ims.conf file. 1. The file_store_root path was changed in the [server] section file_store_root = sensor_file_store 2. [summary_proc] was removed. 3. The api_url has changed in the [trp_cynomix] section and the api_key was added. [trp_cynomix] # When true Cynomix will be used as a source of file threat reports. # NOTE: api_key is required -- but not provided -- for use of Cynomix services enabled = true api_url = api_key = Additions The following sections were added in the ims.conf file. 1. The following sections were added to the [api_archive] section. # The number of days of data to retain in table api_call_storage. If omitted, # the default value is 30. Valid values range from 1 to 90. detail_retention_days = 30 # The number of days of data to retain in table api_stat_summary. If omitted, # the default value is 365. Valid values range from 7 to 365. summary_retention_days = The [job_queue] section was added. [job_queue] # When set to true, this option causes counts of pending, in-process and # failed jobs to periodically be written to ims.log. enable_queue_stats = false # In seconds, how frequently to log job queue stats. Note that on a busy system, # the queries involved can be costly. Be reluctant to shorten this interval. stats_log_interval = The [low_pri_tasks] section was added.

12 Dell Protected Workspace Management Server Single Instance Upgrade Guide v [low_pri_tasks] # Enables processing of low priority tasks. enabled = true 4. Process_count was added to the [threat_report_proc] section. [threat_report_proc] # Enables processing of the threat_report queue enabled = true # Specifies the number of threat_report_proc instances that will be launched. process_count = 1 5. The [threat_report_storage_proc] section was added. [threat_report_storage_proc] # Enables processing of the threat_report_storage queue enabled = true # Specifies the number of threat_report_storage_proc instances that will be launched. process_count = 1 6. The [incidents_proc] section was added. [incidents_proc] # Enables processing of the incidents queue. enabled = true # Specifies the number of incidents_proc instances that will be launched. process_count = 1

13 Upgrading to DPWMs v4.0 using a New VM Dell Protected Workspace Management Server Single Instance Upgrade Guide v If currently running on version prior to please use the following method to upgrade the server. If running a DPWMS version prior to v2.2.1, please upgrade to v2.2.1 before continuing. Another option for the upgrade is to stand up a new VM using the OVA file and migrate the database from the old server. To upgrade to DPWMs v4.0 use the following steps: 1. Download the DPWMs v4.0 OVA file from the DPW support site: 2. Stand up a new VM using the OVA file following the instructions in the Dell Protected Workspace Management Server - Single Instance Installation Guide - v Stop the im3 service on the DPWMs v3.x VM. 4. Perform a database backup on the DPWMs v3.x server with the following command: mysqldump -uroot -pinvincea database_name --max_allowed_packet=500m gzip c > /var/lib/mysql/backup/backup.sql.gz Note that the username, password, and database_name may be different. Please refer to the MySQL info set in your DPWMS.conf file to obtain this information. Also, note the path to write the sql dump file must have sufficient space. The sample above is in the /var/lib/mysql path. Do not continue until the backup is complete. The backup is complete when the cursor moves to a new command line. 5. Move the sql file from the server to the local machine using a tool like WinSCP.

14 Dell Protected Workspace Management Server Single Instance Upgrade Guide v Move the sql file from the local machine to the new DPWMs v4.0 VM. 7. Stop the im4 service by running: service im4 stop 8. Edit the /opt/im4/ims.conf file. Ensure the settings from the old ims.conf are set appropriately. Also, new settings should remain as default. Go to the [trp_cynomix] section, and edit the api_url to equal On the next line add the api_key and set it to the key supplied by Dell Support. If you need a key, please contact Dell Support. 9. Log in to the MySQL database on the v4.0 VM: mysql uroot pinvincea 10. Delete the existing invincea MySQL DB by running: drop database invincea; 11. Recreate the DPW DB by running: create database invincea; 12. Exit from MySQL. 13. Import the database from the old server by running: zcat /tmp/backup.sql.gz > mysql uroot pinvincea invincea; Note, the path of the.sql.gz file may be different depending on where the file is located. Do not continue until the import is complete. The import is complete when the cursor moves to a new command line. 14. Start the im4 service by running: service im4 start

15 Dell Protected Workspace Management Server Single Instance Upgrade Guide v Monitor the ims.log file to be alerted when the upgrade is complete by using the following command: tail f /opt/im4/ims.log This command will display all new log events to the screen. As the upgrade is running, the log will look like the following: When the Starting IMS and the IMS Listening lines are displayed the upgrade is complete (see arrow above). Once complete click ctrl+c to cancel out of the log. Once the upgrade is complete, login to the DPWMs UI to ensure the system is up and running. 16. Move the IP, hostname and any SSL certificates of the old system to the new system so that the clients begin to check in again.

16 Upgrading from DPWMs v4.0.x to DPWMs v4.1 Dell Protected Workspace Management Server Single Instance Upgrade Guide v If currently running on version 4.0.x please use the following method to upgrade the server. If running a version prior to please complete the upgrade to DPWMS v4.0.0 first, following the steps starting page 3 of this document. To install DPWMS v4.1 on the DPWMS 4.0.x Virtual Machine, follow these steps. 1. Create a backup of the current DPWMS using the snapshot feature of the VM or by some other method. 2. Download the DPWMs v4.1 tgz file from the DPW support site: 3. Move the downloaded tgz onto the current DPWMs v4.0.x server using a file transfer tool like WinSCP. 4. Log in to the DPWMS v4.0.x Virtual Machine using the root account. 5. Move the DPWMS v4.1 tgz file that was moved to the server into this newly created file path by running the following command: cp /tmp/dpwms x86_64.tgz /opt/im4 Note, the /tmp/ directory is an example and the path you had moved the file to initially may be different. 6. Change directories to the /opt/im4 folder by running the following command: cd /opt/im4 7. Extract the tgz file into the /opt/im4 install path using the following command: tar xzf dpwms x86_64.tgz 8. Stop the im4 service by running the following: service im4 stop 9. Check that there are no other DPWMS services running by entering the command below: ps -ef grep main

17 Dell Protected Workspace Management Server Single Instance Upgrade Guide v Look for./main and note the pid number which is the first number in the row. ps -ef grep ims Look for./ims_... processes and note the pid number. If any of these ims processes are running, they must be killed with the following command. kill -9 ##### 10. Update the startup script by copying the im.init file from /opt/im4/etc into /opt/im4/init.d/im4 using the following: cp /opt/im4/etc/im.init /etc/init.d/im4 11. Change the file permissions on the new file with the following: chmod a+x /etc/init.d/im4 12. Edit the new im4 file by using the following command and change the IMS_INSTANCE=im3 to im4: vi /etc/init.d/im4 13. Set the new im4 service to auto start chkconfig im4 on 14. Edit the /etc/my.cnf file for settings related to the mysql database with the following command: vi /etc/my.cnf

18 Dell Protected Workspace Management Server Single Instance Upgrade Guide v There are 4 settings to confirm, and 2 settings to add. a. In the [mysqld] section: i. Make sure max_allowed_packet is equal to 500M max_allowed_packet=500m ii. The innodb_log_buffer_size should be set to 256M: innodb_log_buffer_size=256m iii. The innodb_buffer_pool_size should be set to 50% of the systems RAM (example, a system with 8GB of RAM would be set as follows): innodb_buffer_pool_size=4g iv. Set innodb_flush_log_at_trx_commit equal to 2: innodb_flush_log_at_trx_commit=2 v. Add innodb_log_file_size and it should be set to 1G: innodb_log_file_size=1g b. Add a [mysqldump] section, and add max_allowed_packet that will be set to 500M. [mysqldump] max_allowed_packet=500m

19 Dell Protected Workspace Management Server Single Instance Upgrade Guide v The change to the innodb_log_file_size will require the database log files (ib_logfile) to be recreated before the changes to my.cnf can be applied. a. Browse to /var/lib/mysql cd /var/lib/mysql b. Rename ib_logfile0 to ib_logfile0.bak mv /var/lib/mysql/ib_logfile0 /var/lib/mysql/ib_logfile0.bak c. Rename ib_logfile1 to ib_logfile1.bak mv /var/lib/mysql/ib_logfile1 /var/lib/mysql/ib_logfile1.bak 15. Restart the mysqld service to apply the changes to the my.cnf file: service mysqld restart 16. Perform a database backup with the following command: This is optional if a VM snapshot has been performed. mysqldump -uroot -pinvincea database_name > /var/lib/mysql/backup/backup.sql Note that the username, password, and database_name may be different. Please refer to the MySQL info set in your ims.conf file to obtain this information.

20 Dell Protected Workspace Management Server Single Instance Upgrade Guide v Also, note the path to write the sql dump file must have sufficient space. The sample above is in the /var/lib/mysql path. Do not continue until the backup is complete. The backup is complete when the cursor moves to a new command line. 17. Ensure you are in the /opt/im4 directory. Begin the upgrade by running the following command:./dbsetup.sh 18. The above command will output directly to the screen. The database upgrade will be complete once DB initialized successfully is displayed and the cursor goes back to the command line. 19. Start the im4 service by running the following command: service im4 start 20. Log in to the DPWMS UI to ensure the upgrade is complete.

21 Contacting Dell Support Dell Protected Workspace Management Server Single Instance Upgrade Guide v For assistance with the Dell Protected Workspace Management System, please contact Dell Support at: DPWMs updates, DPW apps.xml, static.dat, and whitelist.xml updates and Installation Kit downloads can all be found at the Dell Protected Workspace Support Portal: