14.2 Upgrading a Traditional Installation

To upgrade the Change Guardian Server in a traditional installation:

1. Back up your information using the cgbackup_util.sh script.

   For information about using the backup utility, see Section 13.0, Backing Up and Restoring Data.

2. Download the latest installer from the Downloads website.

   You must be a registered user to download patches. If you have not registered, click Register to create a user account in the patch download site.

3. Copy the installer file to a directory that has 0755 permissions.

   NOTE:Trying to upgrade from any directory within /root fails because certain upgrade commands run as non-root user. Such commands cannot run if the installer is in the /root directory.

4. Log in as root to the Change Guardian server you want to upgrade.

5. Extract install files from the tar file:

   tar -zxvf <install_filename>

6. Change to the directory where the install file was extracted.

7. Start the upgrade:

   ./install-changeguardian.sh

8. (Conditional) If you want to upgrade from a custom path, specify the following command:

   ./install-changeguardian.sh --location=<custom_CG_directory_path>

   NOTE:You can only upgrade from a custom path used for the original installation and the path must have 0755 permissions.

9. (Conditional) If NTP could not synchronize your computer time with the network time, make the required changes.

10. (Conditional) If your system does not meet the recommended disk space, make the required changes to the computer.

    NOTE:The recommended disk space is for Change Guardian upgrade files. Allocate the recommended space in /, /var/opt, and /opt.

11. To proceed with a language of your choice, select the number next to the language.

12. If there are changes to the end user license agreement, read and accept the changes.

13. Specify yes to approve the upgrade.

    The upgrade might take a few seconds to complete.

14. Validate and confirm the versions to be updated during the upgrade.

15. Verify that you can connect to the Change Guardian web interface by accessing the following URL:

    https://IP_Address_Change_Guardian_server:8443

16. (Conditional) If your server was in FIPS mode prior to upgrade, import Elasticsearch certificate to FIPS keystore. For more information, see Importing Certificates to FIPS Keystore Database.

To upgrade the operating system:

1. Log in as root to the machine running Change Guardian.

2. Stop the Change Guardian services:

   /opt/netiq/cg/scripts/cg_services.sh stop

3. (Conditional) If Change Guardian was in FIPS mode before the operating system upgrade, upgrade the NSS database:

   certutil -K -d sql:/etc/opt/novell/sentinel/3rdparty/nss -X

   Follow the on-screen instructions to upgrade the NSS database.

   Give full permissions to novell user for the following files in the /etc/opt/novell/sentinel/3rdparty/nss directory:

   cert9.db
   key4.db 
   pkcs11.txt 

4. Upgrade the operating system.

5. (Conditional) If you use Mozilla Network Security Services (NSS) 3.29 or later, install the two dependent RPM files:

   • libfreebl3-hmac

   • libsoftokn3-hmac

6. (Conditional) For RHEL 7.x, check whether there are any errors in the RPM database:

   rpm -qa --dbpath <installation_directory>/rpm | grep novell

   Example: # rpm -qa --dbpath /custom/rpm | grep novell

   • If there are any errors, fix the errors:

     rpm --rebuilddb --dbpath <installation_directory>/rpm

     For example: # rpm --rebuilddb --dbpath /custom/rpm

   • Recheck that there are no errors:

     rpm -qa --dbpath <installation_directory>/rpm | grep novell