Upgrading Kaspersky Security Center Linux

You can install version 16.1 of Administration Server on a device that has an earlier version of Administration Server installed (starting from version 13). When upgrading to version 16.1, all data and settings from the previous version of Administration Server are preserved.

Prerequisites

• Create a backup copy of the Administration Server data before starting the upgrade.
• When upgrading Administration Server from version 16 or earlier to version 16.1 or later, two-factor authentication is enabled. For more information, refer to About two-step verification for an account.

  To ensure that users can sign in to Web Console with their existing accounts by using configured two-factor authentication secret keys, and that OpenAPI automation scripts continue to work after the upgrade, you must perform the following steps:

  • Enable two-factor authentication for all users
  • Administrators must configure two-factor authentication for their own accounts
  • Exclude the required accounts from two-factor authentication

    If needed, add integration accounts used to run scripts through OpenAPI to the exclusion list.

• Ensure that you use the versions of the operating system and DBMS that are supported by version 16.1 of Administration Server. If necessary, you can move Administration Server to another device with later versions of the operating system and DBMS.
• When upgrading Administration Server from version 15.4 or earlier to version 16 or later, on the DBMS server, create a database for IAM. The database name must be different from the database that you installed to work with Kaspersky Security Center Linux.
  • For PostgreSQL, run the following command:

    sudo -i -u postgres psql -U postgres -c "CREATE DATABASE <iam_db_name>;"

  • For MariaDB, run the following command:

    sudo mysql -u root -p -e "CREATE DATABASE <iam_db_name>;"

• When upgrading Administration Server from version 15.4 or earlier to version 16 or later, prepare the answer file with new parameters for IAM. For the list of the required parameters, refer to the article: Installing Kaspersky Security Center Linux in silent mode. Add the KLAUTOANSWERS environment variable and set its value to the path to the answer file.
• Make available the port used by the kliam process for the OpenID Connect protocol authentication. By default, 4444. Refer to the trusted parameter description in the following article: Kaspersky Security Center Web Console installation parameters.

Stages

1. Upgrading of Administration Server

   You can upgrade a version of Administration Server by using one of the following methods:

   • By using the Kaspersky Security Center Linux installation file
   • By creating the Administration Server data backup, installing a new Administration Server version, and restoring the Administration Server data from the backup

   During the upgrade, concurrent use of the DBMS by Administration Server and another application is strictly forbidden.

   If your network includes several Administration Servers, you have to upgrade every Server manually. Kaspersky Security Center Linux does not support centralized upgrade.

2. Running the postinstall.pl script (optional step)

   If the answer file does not include IAM parameters or the answer file is not found, a message is shown in the terminal during upgrade that asks you to run the postinstall.pl script.

   At this stage of the scenario, do the following:

   1. In the Administration Server operating system, create an unpriviliged user account 'ksciam' that must be a member of the 'kladmins' group:

      adduser ksciam

      gpasswd -a ksciam kladmins

      usermod -g kladmins ksciam

   2. Under an account with root privileges, run the /opt/kaspersky/ksc64/lib/bin/setup/postinstall.pl script to configure the Administration Server after upgrade. When prompted, enter the following settings:
      1. Enter the IAM Server FQDN. You must use the Administration Server DNS name that was specified when installing Kaspersky Security Center Linux.
      2. Enter the account name to start the IAM service. The account must be a member of the entered security group. By default, the ksciam account is used.
      3. Select the DBMS that you installed to work with the IAM service:
         • If you installed MySQL or MariaDB, enter 1.
         • If you installed PostgreSQL or Postgres Pro, enter 2.
      4. Enter the IAM DBMS address to be used by the IAM service.
      5. Enter the IAM DBMS port number. This port is used to communicate with the IAM service. By default, the following ports are used:
         • Port 3306 for MySQL or MariaDB
         • Port 5432 for PostgreSQL or Postgres Pro
      6. Enter the IAM database name to be used by the IAM service. The name of the database used by IAM service should be different from database used by the Administration Server.
3. Upgrading Kaspersky Security Center Web Console to a new version
4. Ensuring that the two-factor authentication allowlist contains only the user accounts that must have access to Administration Server.

   Review the two-factor authentication allowlist and remove any other accounts from it.

Note that if you upgrade the Administration Server to the version 16.1, you will not be able to create new installation packages of Network Agent version 15 or earlier. However, previously created installation packages will be available.

When you upgrade Kaspersky Security Center Linux from a previous version, all the installed plug-ins of supported Kaspersky applications are kept. Administration Server plug-in and Network Agent plug-in are upgraded automatically.

In this section Upgrading Kaspersky Security Center Linux from version 16 or later Upgrading Kaspersky Security Center Linux from version 15.4 or earlier Upgrading Kaspersky Security Center Web Console Upgrading Kaspersky Security Center Web Console on Astra Linux in the closed software environment mode

Page top