EDR: How to Perform an Offline Server Upgrade

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To upgrade an air-gapped offline EDR Server

Environment

• EDR (Formerly CB Response) Server: 5.x - 7.x

• Linux: All Supported Versions

Resolution

1. For new caching servers, install the rpm and cb-enterprise
   1. Upload the provided "carbon-black-release" RPM file to your staging ("caching") server. 
      • Example file name: carbon-black-release-1.0.2-1-My_Company.x86_64.rpm
   2. Install that file onto the caching server:

rpm -ivh <carbon-black-release-file>

3. Edit /etc/yum.conf, and set:

[main]
cachedir=/var/cache/yum/$basearch/$releasever
keepcache=1

4. Install cb-enterprise on the server
   • RHEL/CentOS 6 and 7

     • sudo yum install cb-enterprise

   • RHEL/CentOS 8

     • sudo yum module disable postgresql redis python39
       
       sudo yum install cb-enterprise​​​

2. For pre-existing cache servers run:

   • yum upgrade cb-enterprise

3. Tar up the Yum cache directory:

• tar --selinux -cvzf yumcache.tar.gz -C /var/cache/yum/x86_64/<server_os_maj_ver>/ .

4. Take the resulting file (yumcache.tar.gz) and move it to the desired offline server.
5. Log into the offline EDR server CLI
6. If necessary, create the following folder hierarchy:

• mkdir /var/cache/yum/x86_64/<server_os_maj_ver>/

7. Untar the file to the local offline server:

• tar -xvzf yumcache.tar.gz -C /var/cache/yum/x86_64/<server_os_maj_ver>/

8. Stop cb-enterprise services
9. Upgrade EDR as normal, but flag it (with -C) to only use the local cache, which will pull the RPM files from the local yum cache directory that was just created.

• yum upgrade -C cb-enterprise

Additional Information

• This staging/caching server must be the same OS (CentOS, RHEL) as the actual target EDR server.
• The path to the cache will change based on the major version of the operating system. So RHEL 6 will be /var/cache/yum/x86_64/6/