Latest Posts

IBM Guardium System Installation and Upgrade (Patching)

This post is going to show how to install IBM Guardium system and how to install patches, updates, fixes, or DPS on  Central Manager and Collector. It will use Web GUI and Command line to complete this task.The IBM Guardium V10.1/V11 Software Appliance Technical Requirements can be found here: http://ibm.co/2gd5ZRq.  Additional installation detail can be found here: http://ibm.co/2h0exMw.

  1. Load the Guardium ISO.
  2. When the system boots, you will be presented with the following screen.
    1. Choose "Standard Installation (non CM)" for the collectors
    2. Choose "Aggregator or Central Manager (CM)" for the Central Manager
    3. The installation process will take about 15 minutes.

  1. After the installation completes, login from the console as cli (password=guardium)
    1. Reset and make note of the cli password

  1. Perform the following configuration commands:
store network interface ip <ip_address>
store network interface mask <subnet_mask>
store network routes defaultroute <default_router_ip>
store system hostname <host_name>
store system domain <domain_name>

  1. Confirm that you configured each setting correctly.
show network interface all
show network routes def
show system hostname
show system domain

  1. Enter "restart system" to reboot the VM
  1. Confirm that you can access the machine via ssh

Note: Virtual Appliance Installation Guide: 


show network interface all 
show network routes defaultroute
show network resolver all
show system hostname
show system domain
show system clock timezone
show system clock datetime
show system ntp all
show unit type

VM Clone Installation


The notes above were derived from these instructions (http://www-01.ibm.com/support/docview.wss?uid=swg21985657).  Feel free to review the link but please follow the instructions listed in the order below.
  1. On the existing collector VM, run "store network interface reset".  This instructs the collector to reset the NIC/MAC information upon reboot.
  2. Shutdown the collector by running "stop system".
  3. Clone the collector
  4. Bring up the new VM. If it asks if you moved or copied the VM, please answer with "copy", as this will enable the virtualization software to configure new parameters like MAC address for the clone.
  5. Log into the appliance as user CLI
  6. Run "show network macs". The MAC address should match the MAC address assigned by VMWare.  If this returns an empty string, the MAC address has not been properly setup for the clone.
  7. Set the IP address, defaultroute, hostname, etc. and resolver as necessary (see Appendix B)
    1. You may need to re-run the commands on the original VM because of the "store network interface reset" command.
  8. Restart the system by running "restart system"
  9. Log into the appliance again as user CLI
  10. Store the global ID by running store product gid <gid_value> 
    1. The Global ID can be any number, so long as it is unique. During the cloning process this unique number is necessary. Please obtain the Global IDs from your other appliances and arrive at a number that is unique for this clone.
  11. Verify the global ID by running show product gid
  12. Restart the system if requested


If changing backup location, change the following
- System backup
- archive (collectors)
- Results archive

IBM Guardium Patching/Upgrading


Check IBM Guardium Appliance and Agent Version





Download a server / agent Patch from IBM Fix Central
Patches explanation:

Install a Patch for Aggregator from CLI
This method usually is for Central Manager (Aggregator). Once you logged into Web GUI, the notification icon will show a red number to notify you there is a patch available. You can download it from IBM Fix Center by clicking download.

Once the patch is downloaded, the patch will need to upload to the Guardium manager / aggreator. Based on the environment, the patch should either be uploaded to either the Central Manager or the individual collector. It always start from top (Manager / Aggregator) to bottom (Collector).

Note: It is strongly suggested to have a complete system backup prior to installing a patch.

Upgrading steps:
  • Login to the applicance as 'cli'
  • Type the command 'fileserver <<ip_address>> <<duration>> '. This will enable a web server
    • Once the fileserver command is executed, from the web browser, connect to the appliance https://<<appliance_name_or_ip>>:8445

cm01.51sec.org> fileserver 10.10.10.2 1200

Starting the file server...
The file server is ready at https://cm01.51sec.org:8445
The timeout has been set to 1200 seconds and it may timeout during the uploading.

The upload will only be accessible from the IP you are logged in from: 10.10.136.2

Press ENTER to stop the file server.

Stopping process

Register patch files in the directory:
SqlGuard-11.0p100_GPU_Nov_2019_V11.1.tgz.enc.sig
Register succeeded
ok
cm01.51sec.org>



  • Browse the local filesystem to find the downloaded patch file (already unzipped)
  • Click the upload button to upload the patch file (*.sig ) to the appliance



  • Once the patch is uploaded, close the 'fileserver' by simply hitting 'enter'
  • In the cli window, use the patch installation commands to install the patch
    • Show system patch available : shows the available patches that can be installed (You might see some error message because of some old wrong package uploaded)
    • Store system patch install sys now
  • This will start the wizard to install the available patches.


itprosec-tor-igcm01.51sec.org> store system patch install sys

List the files in the patches directory:

1. SqlGuard-10.0p11000_Upgrade_to_Version_11.0_Jun_2019.tgz.enc.sig
2. SqlGuard-10.0p620_Bundle_Apr_25_2019.tgz.enc.sig
3. SqlGuard-10.0p9997.tgz.enc.sig
4. SqlGuard-11.0p12_Bundle_Nov_05_2019.tgz.enc.sig
5. SqlGuard-11.0p4003_Snif_Oct_24_2019.tgz.enc.sig

Please choose patches to install (1-5, or multiple numbers separated by ",", or q to quit): 5
Install item 5

Patch has been submitted, and will be installed according to the request time,
please check installed patches report or CLI (show system patch installed).

Please don't forget to remove your media if necessary.
ok

itprosec-tor-igcm01.51sec.org> show system patch installed
P#      Who       Description                     Request Time         Status
11000   CLI       Upgrade to Version 11.0 (Jun 07 2019-08-30 11:14:11  Phase 5: Migration completed
4003    CLI       Snif Update (Oct 24 2019)       2019-12-04 17:18:45  STEP: Executing Post Install Actions
12      CLI       SqlGuard-11.0p12_Bundle_Nov_05_ 2019-12-04 17:21:01  Preparing to install patch.
ok

Note: Your installation might be failed because of missing dependency, just as show below:

cm01.51sec.org> store system patch install sys

List the files in the patches directory:

1. SqlGuard-10.0p11000_Upgrade_to_Version_11.0_Jun_2019.tgz.enc.sig
2. SqlGuard-10.0p620_Bundle_Apr_25_2019.tgz.enc.sig
3. SqlGuard-10.0p9997.tgz.enc.sig
4. SqlGuard-11.0p100_GPU_Nov_2019_V11.1.tgz.enc.sig
5. SqlGuard-11.0p12_Bundle_Nov_05_2019.tgz.enc.sig
6. SqlGuard-11.0p4003_Snif_Oct_24_2019.tgz.enc.sig

Please choose patches to install (1-6, or multiple numbers separated by ",", or                                                                                                              q to quit): 4
Install item 4

Dependent patches not installed successfully or not available: 9997

Please don't forget to remove your media if necessary.
ok


In above example, latest health_check patch was not installed first. You will need to go to fix center to download this latest health_check patch.
Installing latest health check patch is same as installing other patch:
a. Upload extracted .sig healtch_check patch through fileserver command
b. store system patch install sys : choose the one you just uploaded
c. show system patch installed : checking installation process

Note: For a sniff patch, it usually takes 10 minutes to get it done. But for a bundle package, it will take 30 - 60 minutes to get it done. Sometimes, the installed packages will not remove from the list after the installation. When make selection, you have to clearly know which one you have installed, and which one will need to be installed now.

Install Patch from Web GUI for Collector(s)
Distribute a patch / Install Patch

To distribute a patch from a central manager to managed units, one of the following must have taken place:



  • The patch is installed on the central manager
  • The patch has been made available on the central manager by running the following CLI command: store system patch available
Distribute the patch to managed units using the Central Management page on the central manager.
  1. Navigate to Manage > Central Management > Central Management.
  2. From the Central Management page, select managed units to receive the patch and click the Patch Distribution button.
  3. From the Patch Distribution page, select the patches to distribute.
    • Click Install Patch Now to install the patch immediately.
    • Click Schedule Patch to schedule patch installation for the future.

Monitor and verify patch installation

You can monitor and verify the installation of patches in the following ways:
  • Issue the following CLI command: show system patch install.
  • Use the Central Management page on the CM: Manage > Central Management > Central Management > Patch Installation Status.




Install DPS Update

You may need to update the Guardium DPS file after upgrade or restore procedures. Download the latest DPS file, then use the Harden > Vulnerability Assessment > Customer Uploads tool to upload and import the new DPS file.

Click green check mark to import uploaded DPS file.



Related Video:


References






1 comment:

  1. Thank You For Sharing Nice Informative Article, We Offers Best suited software for appointments and billing.You Can Find out Practice Management software at instacare. If you need a comprehensive software to manage your appointments, billing and inventory then here's our solution for you.

    ReplyDelete