Transcript
AlienVault
Unified Security Management™ 4.4-5.x Offline Update and Software Restoration Procedures
USM 4.4-5.x Offline Update and Software Restoration Procedures Copyright © 2015 AlienVault, Inc. All rights reserved. The AlienVault Logo, AlienVault™, AlienVault Unified Security Management™, AlienVault USM™, AlienVault Open Threat Exchange™, AlienVault OTX™, Open Threat Exchange™, AlienVault OTX Reputation Monitor™, AlienVault OTX Reputation Monitor Alert™, AlienVault OSSIM™, and OSSIM™ are trademarks or service marks of AlienVault, Inc. All other registered trademarks, trademarks or service marks are the property of their respective owners.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 2 of 19
Contents
Contents Introduction ..................................................................................................................................... 4 Requirements .................................................................................................................................. 4 Burning ISO Images ........................................................................................................................ 4 Burning to a USM Flash Drive ..................................................................................................... 4 Linux ...................................................................................................................................... 4 Mac OS X ............................................................................................................................... 5 Windows ................................................................................................................................ 6 Burning to a CD .......................................................................................................................... 7 Updating USM Offline ...................................................................................................................... 7 Restoring Software on a USM ....................................................................................................... 10 Changing the BIOS Setup ......................................................................................................... 10 Restoring an appliance from a USB Flash Drive ....................................................................... 14
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 3 of 19
Burning to a USM Flash Drive
Introduction This procedure describes the required process to update an AlienVault appliance when there is not an Internet connection available. It also describes how to restore the software of an AlienVault appliance.
Requirements These are the requirements to update the AlienVault appliances:
USM version 4.4 or greater.
ISO image provided by AlienVault, see Downloading the AlienVault USM ISO for Offline Update
USB flash drive or external USB CD/DVD R/RW drive.
Burning ISO Images Burning to a USM Flash Drive
Important: This process deletes all files stored in the USB.
Linux To burn an ISO Image using a USB Flash Drive from Linux 1.
Insert your USB flash drive into the USB port. It is recommended to copy the ISO image in a temporary directory, for example “/tmp”.
2.
Execute the following command to copy the ISO image: sudo dd if= of= bs=4M
, replace this by the ISO image file path. Note that it is necessary to write the whole path where the file is located. refers to the USB device name. For example, having a file called “image.iso” and with the USB device name “/dev/sdb”, the command to write will be:
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 4 of 19
Burning to a USM Flash Drive
sudo dd if=/home/user/temp/image.iso of=/dev/sdb bs=4M
Mac OS X To burn an ISO Image using a USB Flash Drive from Mac OS X 1.
Insert your USB flash drive into the USB port. Copy the image in a temporary directory or in your own user directory.
2.
Run the following comand to identify the USB device name: diskutil list
Figure 1. Burning ISO image using MAC OS X: example of a ‘diskutil’ command According to Figure 1, the name of the USB device is ‘/dev/disk1’. 3.
Unmount your USB device before burning the image: diskutil unmountDisk
refers to your USB device name. For example: diskutil unmountDisk /dev/disk1
4.
Copy the image: sudo dd if= of= bs=1m
, replace it by the ISO image file path. Note that it is necessary to write the whole path where the file is located. refers to your USB device name. For example, having a file called “image.iso” and being “/dev/disk1” the USB device name, the command to write will be the following: sudo dd if=/home/user/temp/image.iso of=/dev/disk1 bs=1m
5.
Eject the device: diskutil eject
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 5 of 19
Burning to a USM Flash Drive
refers to your USB device name.
Windows To burn an ISO Image using a USB Flash Drive from Windows 1.
Connect your USB flash drive.
2.
List the devices connected to the Windows platform using dd.exe1, similar to the dd command on Linux, so you can identify where your USB flash drive has been mounted: C:\Users\myuser\Desktop>dd.exe --list rawwrite dd for windows version 0.6beta3. Written by John Newbigin This program is covered by terms of the GPL Version 2. Win32 Available Volume Information \\.\Volume{93c9c543-7952-11e3-8953-806e6f6e6963} \ link to \\?\Device\HarddiskVolume1 fixed media Mounted on \\.\c: \\.\Volume{a7bddb16-7b9e-11e4-b358-6003089d6c19}\ link to \\?\Device\HarddiskVolume2 removeable media Mounted on \\.\e: \\.\Volume{93c9c547-7952-11e3-8953-806e6f6e6963}\ link to \\?\Device\Floppy0
1
dd.exe is a Windows version of the "dd" command used in Linux/Mac. The tool site is http://www.chrysocome.net/dd.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 6 of 19
Burning to a CD
removeable media Mounted on \\.\a:
3.
Once you identify where your USB flash drive has been mounted, execute the following command to burn the ISO image file onto the device: C:\Users\myuser\Desktop>dd of=\\.\e: --progress
bs=4M
if=AlienVault_USM_UPDATE-FOR-64bits_XXXXX.iso
rawwrite dd for windows version 0.6beta3. Written by John Newbigin This program is covered by terms of the GPL Version 2. 794M 198+1 records in 198+1 records out
4.
Eject securely the device from the computer.
Note:
In case you are asked for formatting the unit during the process, please, do no accept the operation. The device should not be formatted.
Burning to a CD Burn the ISO image file by using any CD burning software. The method you use will depend on which CD writing software package you have available on your Operating System. Once the ISO file is burned as an image, the resulting CD is bootable, but it is a clone of the original file, so it contains the same folders, files, and properties as the original ISO.
Updating USM Offline To update a USM offline 1.
Insert a USB drive or connect a CD/DVD drive.
2.
Open a console terminal and write the following command: ssh root@IP_address
IP_address refers to the default IP of your appliance.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 7 of 19
Burning to a CD
3.
The AlienVault Setup main menu appears:
Figure 2. AlienVault Setup Main Menu 4.
Move to “System Preferences”.
5.
Press Enter to accept the selection ().
Figure 3. System Preferences Menu 6.
Move to “Update AlienVault System”.
7.
Press Enter to accept the selection ().
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 8 of 19
Burning to a CD
Figure 4. Update AlienVault System Menu 8.
Move to “Update (Offline)”.
9.
Press Enter to accept the selection ().
Figure 5. Update (Offline) option 10. If you did not do it in the first step, connect your USB to the appliance you want to upgrade. 11. Click OK. When the process ends the following message appears.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 9 of 19
Changing the BIOS Setup
Figure 6. AlienVault Setup: system updated successfully 12. Press Enter to accept the selection (). The System Updates menu appears. 13. Press Tab to move from to . 14. Remove your USB device.
Restoring Software on a USM Changing the BIOS Setup Sometimes you may want to restore the software on a USM to its factory status. In order to do this, you must
Burn the corresponding ISO image on a USB flash drive, see Burning ISO Images.
Change the BIOS Setup so that it boots from the USB.
Note:
If the BIOS is already configured to boot up from a USB, go to Restoring an appliance from a USB Flash Drive.
To change the BIOS Setup 1.
Reboot your appliance, press “Del” in the initial screen and go to BIOS Setup.
2.
Move to Boot Settings.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 10 of 19
Changing the BIOS Setup
Figure 7. BIOS Setup Utility: Boot Settings 3.
Select ‘Boot Device Priority’ through cursor arrow keys.
4.
Press Enter:
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 11 of 19
Changing the BIOS Setup
Figure 8. BIOS Setup Utility: Boot Device Priority 5.
Move to ‘1st Boot Device’ by using the arrow keys.
6.
Select your USB device by using + and – keys.
7.
Press ESC key.
8.
Move to the ‘Exit’ and select ‘Save Changes and Exit’.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 12 of 19
Changing the BIOS Setup
Figure 9. BIOS Setup Utility: Exit Options 9.
Press Enter.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 13 of 19
Restoring USM from a USB Flash Drive
Figure 10. BIOS Setup Utility: Save Configuration Changes 10. Press Enter to accept the selection (). 11. Reboot your appliance.
Restoring USM from a USB Flash Drive Before starting the restore process, you need a USB flash drive containing the ISO image for the USM version you’d like to restore. See Burning ISO Images.
Note:
Make sure your USB flash drive is connected to the USB port before rebooting the appliance.
To restore USM from a USB Flash Drive 1.
Reboot the system. The following screen displays:
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 14 of 19
Restoring USM from a USB Flash Drive
Figure 11. USB restore initial screen 2.
Select “Restore AlienVault ” to restore your appliance. Select “Local operating system in hard drive (if available)” to cancel the data restoration process.
Important: The restore process deletes all the data stored in your USM.
After selecting the data restoration option, the system will ask for a confirmation:
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 15 of 19
Restoring USM from a USB Flash Drive
Figure 12. Data Restoration: confirmation of the process 3.
Press “y” and Enter to confirm to continue with the restore process. A progress screen displays.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 16 of 19
Restoring USM from a USB Flash Drive
Figure 13. Data Restoration: progress screen When the process finishes, the system reboots automatically.
Note:
Remove your USB before the system reboots. If you forget to remove it, the system will continue to boot from your USB.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 17 of 19
Restoring USM from a USB Flash Drive
Figure 14. Data Restoration: process finished A reboot may take several minutes. After that, the initial user login prompt appears in the console:
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 18 of 19
Restoring USM from a USB Flash Drive
Figure 15. Data Restoration: initial login screen This screen displays the root username and a randomly generated password for you to enter. 4.
In the login: field, enter root.
5.
In the password field, enter the displayed randomly generated password, then press Enter.
6.
When prompted whether you would like to change your password, click Yes.
7.
Reboot again for finishing the data restoration. After this second reboot, the appliance will be ready.
Note:
For further information about how to deploy the appliance, see the AlienVault document “Initial Setup Guide”.
November 2, 2015
USM 4.4-5.x Offline Update and Software Restoration Procedures
Page 19 of 19
