Upgrade Hedgehog

[commanderFx]

We have a situation where we want to deploy multiple hedgehogs geographically dispersed on a closed network (no internet allowed). Is there a way to pull Hedgehog upgrades from a centralized Malcolm instance? Or is it possible that a Hedgehog sensor version is out of sync with a Malcolm version? Then the update frequency of Hedgehog can be very low.

[mmguero]

Malcolm doesn't have a server mechanism from which Hedgehog can pull updates, although that is a cool idea.

An upgrade can be done offline, it would look roughly like this:

• On an internet-connected machine:
  • grab the latest release's malcolm-##.##.#-docker_install.zip file
  • in a Malcolm working copy for the latest version, pull the latest docker images (docker compose --profile malcolm pull)
  • Run ./scripts/malcolm_appliance_packager.sh and answer 'Y' when asked to package docker files
• Copy the the release ZIP and the docker images archive to a thumb drive
• On the offline machine:
  • Back up your docker-compose.yml and config/*.env files
  • Copy the docker images archive from the thumb drive and load it with docker load -i malcolm_######_images.tar.xz
  • Extract the copy of the release ZIP file from the thumb drive over the top of their corresponding files in your existing Malcolm directory
  • re-run ./scripts/configure to make any changes to configuration settings for new features, etc. (the release notes of the latest release should also always contain what these settings might be)

We have #352 to track future improvements to the upgrade process.

[commanderFx]

Thanks for the description of those two upgrades routes.

Does Hedgehog have to run on the same version as Malcolm or can it lag behind a couple of versions?

In case if you have hedgehog 'in the field' and limited connectivity.

[mmguero]

It can lag behind, generally, and work fine. If there are new features you might not see data associated with those features, of course.

I would recommend this, though:

in ./config/zeek.env, set ZEEK_JSON=true on the hedgehog. This is more explicit and makes it easier for Malcolm to parse the fields even if they're not exactly what Malcolm is expecting (due to changes in version, etc.).

[mmguero]

For older versions of Hedghog, find ZEEK_JSON in /opt/sensor/sensor_ctl/control_vars.conf.

[commanderFx]

The upgrade process of Hedgehog is somewhat simplified now, but is it still possible to have a feature request to put a copy on a central Malcolm instance and pull it from there?

[mmguero]

Sure, good idea.