Failed to update virus definitions using offline updater on iCSP 5.4.x after OS restore

Products

• Industrial Control System Protection

Issue/Introduction

OS image restore was performed on iCSP 5.4.x scanner and after Stargate virus definitions cannot be updated using USB Offline Updater tool. 

Environment

Release : 5.4.x

Component : Offline Updater

Cause

• Stargate Engine version compatibility
• Modification to num.sh script required 

Resolution

There are two extra steps required after performing iCSP 5.4.x scanner OS restore to be able to use USB Offline Updater

!!! This procedure is for iCSP 5.4.x scanners only !!!

Step 1 Update Stargate Client 

1. Login to F2 terminal (Alt+Ctrl+F2) on the station using ‘root’ as user and with station password

2. Copy the stargate.bz2 file (attached) to the USB drive

3. Plugin the USB stick to the scanner station.

4. Run the command lsblk

5. Mount the USB drive it should be detected as sdb or sdb1 

      mount /dev/sdb /mnt

     You can execute df -h to verify

     6. Copy stargate.bz2 to /root

     cd /mnt 

     cp stargate.bz2 /root

     7. Create backup of existing stargate directory 

     cd /root

     mkdir stargate_backup

     mv /opt/symantec/stargate /root/stargate_backup

     8. Extract the new stargate bootsrap

     cd root

     tar xvjf stargate.bz2

     9. Move stargate folder from /root/ /opt/symantec

     cd /root

     mv stargate /opt/symantec

    10. Verify ownership and permissions for stargate folder are not changed

    11. Reboot the station

    12. Once the station is rebooted, confirm stargate client version is 8.3.0.130

 

Step 2 Apply fix for num.sh script

    1. Backup existing num.sh script located under /opt/norman/nnp/bin/ and copy in safe location

     cp num.sh /root

    2. Edit num.sh script located under /opt/norman/nnp/bin/ and navigate to section  # Handle Stargate local definition file updates

    3. Add the three lines below:

        loginfo "Updating Stargate defs..."
        rm -rf /opt/symantec/stargate/digest/symcdata
        rm -rf /opt/symantec/stargate/digest/virusdefs

Updated section should have the following content:

############################################################################

# Handle Stargate local definition file updates
function stargate_local_update {
        local unpack_path="$1"
        local fallback_path="${unpack_path}/opt/symantec/stargate/digest/fallback"
        loginfo "Updating Stargate defs..."
        rm -rf /opt/symantec/stargate/digest/symcdata
        rm -rf /opt/symantec/stargate/digest/virusdefs
        rm -f /opt/symantec/stargate/digest/fallback/*
        cp -p ${fallback_path}/* /opt/symantec/stargate/digest/fallback/
}

############################################################################
    4. Save the num.sh and reboot the scanner

    5. Download the latest 5.4.x Offline Updater and verify if deployment of virus definitions via USB works as expected.