AgileSec

https://docs.keyfactor.com/agilesec
Admin
AgileSec supports cryptographic agility with a robust cryptography discovery and tracking platform...
Tokens:135,169
Snippets:1,729
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### Extract and Prepare Installer Files

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Commands to extract the installation archive and set the installation directory.

```bash
unzip <installer_package>.zip
export installer_dir = <installer-directory-location>
cd $installer_dir
```

--------------------------------

### Start services after rollback

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Start services on each node sequentially, starting with backend-1.

```bash
cd <v3.4-installation-dir>
./scripts/manage.sh start
./scripts/manage.sh status
```

--------------------------------

### Run Installation Script

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Execute the installation script on each node following the required sequential order.

```bash
cd $installer_dir
./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive
```

--------------------------------

### Start and verify services

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Start services and check their status on each node in the required sequence.

```bash
cd $AGILESEC_INSTALL_DIR
./scripts/manage.sh start
./scripts/manage.sh status
```

--------------------------------

### Install rsync

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Install rsync using dnf if it is not present.

```bash
sudo dnf install -y rsync
```

--------------------------------

### Set Installation Script Permissions

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Command to make the installation script executable.

```bash
cd $installer_dir
chmod +x install_analytics.sh
```

--------------------------------

### AgileSec Installation Command Syntax

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Standard syntax for the installation script with optional sub-commands.

```bash
./install_analytics.sh install [OPTIONS]
```

--------------------------------

### Start services using manage.sh

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Commands to start all services or specific subsets with optional debug output.

```bash
./manage.sh start
```

```bash
./manage.sh start -d opensearch
```

```bash
./manage.sh start opensearch opensearch-dashboards
```

--------------------------------

### Execute common service status commands

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Examples of using manage.sh to check status, start, stop, restart, and reload services.

```bash
# Check all services status
./scripts/manage.sh status

# Check specific service status
./scripts/manage.sh status opensearch
./scripts/manage.sh status mongodb kafka

# Start all services
./scripts/manage.sh start

# Start specific service with debug output
./scripts/manage.sh start -d opensearch

# Stop specific services
./scripts/manage.sh stop haproxy td-agent

# Restart a service
./scripts/manage.sh restart scheduler

# Reload HAProxy configuration
./scripts/manage.sh reload haproxy
```

--------------------------------

### Install Frontend Node Software

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-2-adding-a-new-frontend-to-an-existing-cluster.md

Commands to unarchive certificates and execute the tuning and installation scripts on the new frontend node.

```Bash
cd $installer_dir/certificates/
tar zxvf kf-agilesec.internal-certs.tgz
cd ../

sudo ./scripts/tune.sh -u <user>
./install_analytics.sh install -u <user> -p <installation-dir>
```

--------------------------------

### Perform Non-Interactive Multi-Node Installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-multi-node-installation-guide.md

Execute these commands sequentially on each node to configure, tune, and install the application.

```bash
# === On backend-1 ===
    cd $installer_dir

    # Generate env configs for all nodes
    ./generate_envs/generate_envs.sh -t multi-node --non-interactive

    # Install certificates using Certificates Management Guide
    # Example: installer-generated certificates
    cd certificates/
    ./generate_certs.sh --non-interactive
    cd ..
    # If BYOC, follow BYOC guides to replace installer-generated certificates

    # System tuning and install
    sudo ./scripts/tune.sh -u <user>
    ./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive

    # === On backend-2 ===
    cd $installer_dir/certificates/
    cp env.backend-2 ../.env
    cd ..
    sudo ./scripts/tune.sh -u <user>
    ./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive

    # === On frontend-1 ===
    cd $installer_dir/certificates/
    cp env.frontend-1 ../.env
    cd ..
    sudo ./scripts/tune.sh -u <user>
    ./install_analytics.sh install -u <user> -p <installation-dir> --non-interactive
```

--------------------------------

### Extract Installation Archive

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Extract the installer package and navigate to the installation directory.

```bash
unzip -d $installer_dir <installer_package>.zip
cd $installer_dir
```

--------------------------------

### Install S3 Repository Plugin

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-disaster-recovery-and-backup-process-guide.md

Install the repository-s3 plugin and restart OpenSearch on all nodes.

```bash
cd $installation_path/services/opensearch/bin
./opensearch-plugin install repository-s3
# Restart OpenSearch service on all nodes
cd $installation_path
./scripts/manage.sh restart opensearch
```

--------------------------------

### Verify and Install Rsync

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Ensure rsync is available on all nodes; install it if missing.

```bash
rsync --version
```

```bash
sudo dnf install -y rsync
```

--------------------------------

### Stop Services and Backup Installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Stop all services and create a backup of the installation directory for rollback purposes.

```bash
cd <v3.4-installation-dir>
./scripts/manage.sh stop
```

```bash
du -hs <v3.4-installation-dir>
cp -r <v3.4-installation-dir> <v3.4-installation-dir>.bak
```

--------------------------------

### Install and verify rsync on RHEL

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Commands to install the rsync utility required for the upgrade process and verify its installation.

```bash
# Install rsync on RHEL
sudo dnf check-update
sudo dnf install -y rsync
# Verify installation
rsync --version
```

--------------------------------

### Run AgileSec Installation Interactively

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Perform an interactive installation that prompts for an admin password.

```bash
./install_analytics.sh install -u <user> -p $agilesec_install_dir
```

--------------------------------

### Start Services on Nodes

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Starts services on backend and frontend nodes while excluding specific components. Must be performed in the order: backend-1, backend-2, then frontend-1.

```bash
cd <v3.4-installation-dir>
./scripts/manage.sh start --exclude ingestion,analytics-manager,scheduler,api,webui
./scripts/manage.sh status
```

--------------------------------

### Install Scan Node Services

Source: https://docs.keyfactor.com/agilesec/latest/add-a-new-scan-node.md

Extract certificates, configure the environment, and execute the tuning and installation scripts with the scan role flag.

```bash
cd $installer_dir/certificates/
tar zxvf kf-agilesec.internal-certs.tgz

cp env.backend-1 ../.env

cd ../
sudo ./scripts/tune.sh -u ec2-user -r scan
./install_analytics.sh install -u ec2-user -p $agilesec_install_dir -r scan
```

--------------------------------

### Check Environment Files

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Verify the presence of the .env settings file in the installer directory.

```bash
ls -a
```

--------------------------------

### Generate environment configuration

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Unzip the installer and generate the new environment configuration file.

```bash
unzip -d <v3.5.0-installer-dir> <v3.5.0-installer-dir>.zip
cd <v3.5.0-installer-dir>
./generate_envs/generate_envs.sh -t single-node --old-config <v3.4-installer-dir>/generate_envs/single_node_config.conf
```

```java
...
[SUCCESS] Merged 69 values from old config, 8 skipped (whitelist), 17 new defaults kept
...
```

--------------------------------

### GCP KMS Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/gcp-kms-connector-user-guide.md

YAML configuration examples for scanning all regions versus specific regions in a GCP project.

```yaml
scan_config:
  plugins:
    - gcpkms_import
    - trigger_discover
    - export
  config:
    gcpkms_import:
      name: gcpkms
      plugin_config:
        auth_json: "${file:/path/to/auth.json}"
        project: "${file:/path/to/auth.json:project_id}"
```

```yaml
scan_config:
  plugins:
    - gcpkms_import
    - trigger_discover
    - export
  config:
    gcpkms_import:
      name: gcpkms
      plugin_config:
        auth_json: "${file:/path/to/auth.json}"
        project: "${file:/path/to/auth.json:project_id}"
        regions: ["global"]
```

--------------------------------

### Start HAProxy with Sudo

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Required when HAProxy is configured to use a privileged port.

```bash
sudo ./scripts/manage.sh start haproxy
```

--------------------------------

### Upgrade precheck output example

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Sample output showing successful pre-requisite checks.

```text
Syncing certificates from installed system to installer...
Certificates synced from <v3.4-installation-dir>/certificates
Running pre-requisite checks...
Mode: upgrade

Running upgrade pre-checks...

==================================
Pre-requisite Checks Summary
==================================
Checks Passed:   13
Warnings:        1
Checks Failed:   0
```

--------------------------------

### Execute support bundle script

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Commands to set permissions, define the installation path, and execute the collection script.

```bash
# Important: 
#   - Replace </path/to/installation> with actual path

chmod 700 collect-logs.sh
export installation_path=</path/to/installation>
./collect-logs.sh
```

--------------------------------

### Verify rsync installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Check if rsync is installed on the system.

```bash
rsync --version
```

--------------------------------

### Start individual service

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Start a specific service by name if it is not running.

```Bash
./scripts/manage.sh start <service-name>
```

--------------------------------

### Configure SM Keystore Aliases in .env

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-certificates-management-guide.md

Example of the default installer-generated alias configuration within the .env file.

```text
sm_service_cmk_alias='561280514aa561b399df58dfadeab7e7'
sm_service_keypair_alias='192851d9a7ead8e074dec80255727998'
```

--------------------------------

### Provision Application Gateway

Source: https://docs.keyfactor.com/agilesec/latest/add-an-upstream-load-balancer.md

Create the Application Gateway instance with the specified configuration. Provisioning may take 10-20 minutes.

```bash
az network application-gateway create \
  --resource-group $RESOURCE_GROUP \
  --name $APPGW_NAME \
  --location $LOCATION \
  --vnet-name $VNET_NAME \
  --subnet $SUBNET_APPGW \
  --sku Standard_v2 \
  --capacity 1 \
  --public-ip-address ${APPGW_NAME}-pip \
  --http-settings-port 443 \
  --http-settings-protocol Https \
  --frontend-port 443 \
  --servers $VM_PRIVATE_IP \
  --cert-file appgw.pfx \
  --cert-password "AppGwPass123" \
  --priority 100
```

--------------------------------

### Install Unzip Utility

Source: https://docs.keyfactor.com/agilesec/latest/multi-node-linux-install-prerequisites.md

Command to install the unzip utility on RHEL systems.

```bash
sudo dnf install unzip
```

--------------------------------

### Configure Node Hostnames and Profiles

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-multi-node-installation-guide.md

Examples of configuration settings for node hostnames and profiles in the cluster configuration.

```text
backend1_node_hostname="backend-1"
backend2_node_hostname="backend-2"
frontend1_node_hostname="frontend-1"
frontend2_node_hostname="frontend-2"
coordinator1_node_hostname="coordinator-1"
```

```text
backend1_node_profile="PRIMARY_FULL_BACKEND"
backend2_node_profile="FULL_BACKEND"
frontend1_node_profile="PRIMARY_FRONTEND"
frontend2_node_profile="ADDITIONAL_FRONTEND"
```

--------------------------------

### Remote Scan Configuration Examples

Source: https://docs.keyfactor.com/agilesec/latest/qualys-sensor-user-guide.md

YAML configuration examples for remote scan execution.

```yaml
scan_config:
  plugins:
    - qualys
    - export
  config:
    qualys:
      name: qualys
      plugin_config:
        url: "<https://qualysguard.qg3.apps.qualys.com/>"
        username: "${env:QUALYS_USER}"
        password: "${env:QUALYS_PASS}"
```

```yaml
scan_config:
  plugins:
    - qualys
    - export
  config:
    qualys:
      name: qualys
      plugin_config:
        url: "<https://qualysguard.qg3.apps.qualys.com/>"
        username: "${env:QUALYS_USER}"
        password: "${env:QUALYS_PASS}"
        report_title: "crypto-scan"
```

--------------------------------

### Run install_analytics.sh Commands

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-2-adding-a-new-frontend-to-an-existing-cluster.md

Various methods for executing the installation script, including standard, interactive, and non-interactive modes.

```Bash
./install_analytics.sh install [OPTIONS]
```

```Bash
./install_analytics.sh install -u <user> -p $agilesec_install_dir
```

```Bash
cd $installer_dir
./install_analytics.sh install -u <user> -p $agilesec_install_dir --non-interactive
```

--------------------------------

### Verify Installation Health

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-multi-node.md

Check the status of services on each node to ensure the current installation is healthy.

```bash
# Run on each node:
./scripts/manage.sh status
```

--------------------------------

### Run AgileSec Installation Non-interactively

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Perform a non-interactive installation using a .pass file for authentication.

```bash
cd $installer_dir
./install_analytics.sh install -u <user> -p $agilesec_install_dir --non-interactive
```

--------------------------------

### Troubleshoot Kafka Performance

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-troubleshooting-guide.md

Scripts to verify installation paths, configure SSL, and monitor consumer lag.

```bash
# Important: 
#   - Replace </path/to/installation> with actual path
#   - Replace "kf-agilesec.internal" with your actual domain name
#   - Replace "<kafka-broker-hostname>" with your actual node domain name
export installation_path=</path/to/installation>
export analytics_internal_domain="kf-agilesec.internal" # default: kf-agilesec.internal. Change it to match your actual domain
export kafka_bootstrap_host=<kafka-broker-hostname> # Example: backend-1.kf-agilesec.internal

export JAVA_HOME="$installation_path/bin/java"
test -d "$installation_path/tmp" || {
  echo "$installation_path/tmp does not exist. Verify the installation path."
  exit 1
}

umask 077
work_dir="$(mktemp -d "$installation_path/tmp/kafka-health.XXXXXX")"
trap 'rm -rf "$work_dir"' EXIT

ssl_properties="$work_dir/ssl.properties"

cat > "$ssl_properties" <<EOF
security.protocol=SSL
ssl.truststore.type=PEM
ssl.truststore.location=$installation_path/certificates/ca/agilesec-rootca-cert.pem
ssl.keystore.type=PEM
ssl.keystore.location=$installation_path/certificates/$analytics_internal_domain/shared-client-combo-cert-key.pem
ssl.endpoint.identification.algorithm=https
EOF

# Check consumer lag
"$installation_path/services/kafka/bin/kafka-consumer-groups.sh" \
  --bootstrap-server "$kafka_bootstrap_host:9092" \
  --command-config "$ssl_properties" \
  --describe --all-groups

# Check log segment sizes
du -sh $installation_path/data/kafka/*
```

--------------------------------

### Initialize External CA Client

Source: https://docs.keyfactor.com/agilesec/latest/thales-ctm-sensor-user-guide.md

Execute the initialization script to create the client and download the root CA when using an External CA.

```bash
./init.sh --url https://thales.ctm.local --token <Registration Token> --cert <client cert file> --name <cert common name>
```

--------------------------------

### Start services excluding specific components

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Start all services except for the specified list of components.

```Bash
cd <v3.4-installation-dir>
./scripts/manage.sh start --exclude ingestion,analytics-manager,scheduler,api,webui
```

--------------------------------

### Deploy Environment Files

Source: https://docs.keyfactor.com/agilesec/latest/ha-scenario-3-multi-region-stretch-cluster-with-coordinator-node.md

Commands to extract certificates and copy the node-specific environment file to the installer directory.

```bash
cd $installer_dir/certificates/
tar zxvf kf-agilesec.internal-certs.tgz
cp <env-file> ../.env
cd ..
```

```bash
cp env.backend-2 ../.env
```

```bash
cp env.backend-3 ../.env
```

```bash
cp env.backend-4 ../.env
```

```bash
cp env.coordinator-1 ../.env
```

```bash
cp env.frontend-2 ../.env
```

```bash
cp env.frontend-3 ../.env
```

--------------------------------

### Enable systemd service management

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Use the startup script to enable systemd integration after the initial installation.

```bash
sudo $agilesec_install_dir/scripts/startup.sh systemd enable
```

--------------------------------

### Verify systemd unit installation

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Check that all AgileSec-related units are correctly installed and enabled in the systemd configuration.

```bash
systemctl list-unit-files | grep kf_agilesec
```

--------------------------------

### Start all services and enable health check

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-upgrade-guide-v3-4-to-v3-5-0-single-node.md

Start all services and re-enable the health check cron job.

```Bash
cd <v3.4-installation-dir>
./scripts/manage.sh start --enable-healthcheck
```

--------------------------------

### Export Directory Variables

Source: https://docs.keyfactor.com/agilesec/latest/add-a-new-scan-node.md

Define the installation and installer directory paths as environment variables for use in subsequent commands.

```bash
export installer_dir=</path/to/installer>
export agilesec_install_dir=</path/to/installation>
```

--------------------------------

### List available services using manage.sh

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-managing-services.md

Command to list all services available for management.

```bash
./manage.sh list
```

--------------------------------

### End-to-End Non-Interactive Single-Node Install

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-single-node-installation-guide.md

Automated sequence of commands to configure, tune, and install the AgileSec platform in a single-node environment.

```bash
cd $installer_dir

# Generate env config
./generate_envs/generate_envs.sh -t single-node --non-interactive

# Generate certificates
cd certificates/
./generate_certs.sh --non-interactive
cd ..

# Prepare .pass file
cp .pass.example .pass
# Edit .pass and set admin_password
chmod 600 .pass

# Run system tuning
sudo ./scripts/tune.sh -u <user>

# Install
./install_analytics.sh install -u <user> -p $agilesec_install_dir --non-interactive
```

--------------------------------

### Create Keystore Password File

Source: https://docs.keyfactor.com/agilesec/latest/byoc-update-secrets-manager-keystore.md

Generate a secure password file for the keystore and set appropriate permissions.

```bash
openssl rand -hex 24 > sm-service-keystore.pass
chmod 0400 sm-service-keystore.pass
SM_PASS="$(cat sm-service-keystore.pass)"
```

--------------------------------

### Scan API Response Payload Example

Source: https://docs.keyfactor.com/agilesec/latest/scan-api.md

Example of the JSON response payload returned upon a successful scan submission.

```json
{
  "executionId": "xyz12345",
  "status": "successful",
  "message": "Scan has been successfully submitted."
}
```

--------------------------------

### Set Environment Variables for Upgrade

Source: https://docs.keyfactor.com/agilesec/latest/on-prem-agilesec-linux-upgrade-guide-3-6.md

Define the installation and installer directory paths as environment variables to simplify subsequent command execution.

```bash
export AGILESEC_INSTALL_DIR=<agilesec_install_dir>
export PREV_INSTALLER_DIR=<prev_installer_dir>
```
Tokens:
Raw