EDR: How to Perform an Offline Air-Gapped Server Installation

[#1]

Environment

• EDR Server: 7.x+
• Linux: All Supported Versions

Objective

To install EDR server onto Air-Gapped Linux servers that do not have access to the public internet. 

Resolution

The caching server is a Linux server that connects to the Internet to collect the rpm packages necessary to perform an EDR install.  It does not need to meet the Operating Environment Requirements (OER).
The air-gapped server is the production Linux server that does not connect to the Internet.  It must meet OER sizing guides.
Note: The caching server needs to matches the OS and kernel version of the air-gapped server.
Note: These steps are for a new installation only.  Using these instructions for updating EDR can result in loss of all data, configurations and certificates.

Configure the Caching Server:

1. Install the appropriate OS on the caching server.
2. Install the Carbon Black EDR License RPM.  

Example file name: carbon-black-release-1.0.2-1-My_Company.x86_64.rpm

2. Install that file onto the caching server:

# rpm -ivh <carbon-black-release-file>

3. Edit /etc/yum.conf, and set:

[main]
cachedir=/var/cache/yum/$basearch/$releasever
keepcache=1

4. Run:  

# yum install cb-enterprise

5. Tar up the Yum cache directory: (the files are saved in a directory specified in /etc/yum.conf cachedir key value)

# tar --selinux -cvzf yumcache.tar.gz -C /var/cache/yum/x86_64/6/ .

6. Take the resulting file (yumcache.tar.gz) and move it to the desired offline server.
7. Log into the offline EDR server CLI
8. If necessary, create the following folder hierarchy:

# mkdir /var/cache/yum/x86_64/6/

9. Untar the file to the local offline server:

# tar -xvzf yumcache.tar.gz -C /var/cache/yum/x86_64/6/

10. Install EDR as normal, but flag it (with -C) to only use the local cache, which will pull the RPM files from the local yum cache directory that was just created.

# yum install -C cb-enterprise

11. Complete the installation by running the following.

# sudo /usr/share/cb/cbinit

Additional Notes

This staging/caching server must be the same OS (CentOS, RHEL) as the actual target EDR server.

Related Content

• EDR: How to Update EDR in an Air-Gapped Environment
• Installing Carbon Black EDR on an Air-Gapped Server