Kaspersky Anti Targeted Attack Platform

Upgrading Central Node installed as a cluster from version 6.1 to version 7.0.3

Before installing the application upgrade package, it is recommended to first create a backup of the current state of each Central Node server to be updated and download it to the hard drive from the application administrator menu. If installing an application upgrade package fails, or if you need to reinstall Kaspersky Anti Targeted Attack Platform, you can use the backup copy of the application.
We also also recommend learning about the limitations of the version to which you are upgrading.

The hardware requirements for 7.0, 7.0.1, and 7.0.3 Central Node servers are different from the hardware requirements of version 6.1. We strongly recommend making sure that your server configuration satisfies the requirements listed in the Calculations for the Central Node component section.

The upgrade is delivered as an upgrade package. The package is included in the application distribution kit.

If you are using the

distributed solution and multitenancy

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

mode

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

All steps described below must be performed on servers in Technical Support Mode, after elevating user privileges using the sudo -i command.

To upgrade Central Node installed as a cluster:

1. Log in to any of the storage servers in the Central Node cluster and check if the Ceph storage is working. To do so, execute the following command:

   ceph -s | grep health:

   The Ceph storage is healthy if the following value is returned:

   health: HEALTH_OK

   If the value is different from health: HEALTH_OK, please contact Technical Support.

2. Log in to each of the storage servers and restart the kata-osd-starter service:

   systemctl restart kata-osd-starter

3. Make sure the Kafka service is working:
   1. Find out which servers in the cluster have the 'manager' role in Docker swarm. To do this, run the following command on any of the cluster servers:

      docker node ls

      A list of cluster servers is displayed. Look at the MANAGER STATUS column in the list: if a server has Leader or Reachable in that column, it means it has the 'manager' role.

   2. Run the following command:

      docker service ps kata_product_main_1_schema_registry

      Look at the value in the NODE column to determine which server has the Schema Registry.

   3. Log in to the server with the Schema Registry and run the following command:

      docker exec -it $(docker ps | grep schema_registry | awk '{ print $1 }') curl http://127.0.0.1:8081/subjects

      If you get a JSON with a list of subjects, it means the Kafka service is working.

4. If you do not use mirrored traffic processing from SPAN ports (including the application using the KEDR license key), follow these steps:
   1. Enter the management console of any processing server of the server over SSH or using a terminal.
   2. Run the following command:

      kata-enable-span

   If processing of mirrored traffic from SPAN ports is disabled, the upgrade fails.

5. Place the application upgrade package on the Central Node cluster server with the manager role in the Docker swarm, in the /data directory. To view the role, use the $ docker node ls command.
6. Enter the management console of the relevant server over SSH or through a terminal.
7. Make sure that the /dev/sda2 file system on each server of the cluster has more than 100 GB of free space.
8. Unpack the update archive:

   tar xvf /data/kata-upgrade-7.0.3.520-x86_64_en-ru.tar.gz -C /data/

9. Install the upgrade package by running the following commands:

   cd /data/upgrade/

   ./run_kata_upgrade.py

   The user name entry window is displayed.

10. In the Username field, enter the name of the user with administrator rights, select the OK button and press Enter.

    Default value: admin.

11. In the Password field, enter the password of the user with administrator rights, select the OK button, and press Enter.

    This opens the window for entering the path to the update archive.

12. In the Data directory field, enter the path to the update archive, select the OK button, and press Enter.

    Default value: /data/upgrade.

13. In the displayed window, select the localization language for the NDR functionality.

    Parts of the application related to NDR functionality will be displayed in the selected language.

    After some time, the console will display a message prompting you to power off the server.

14. Connect to the server that you want to power off over SSH or through a terminal.
15. Run the poweroff command.
16. Mount the Ubuntu-based iso image of Kaspersky Anti Targeted Attack Platform 7.0.3 (kata-cn-7.0.3.520-inst.x86_64_en-ru.iso). If you are using Kaspersky Anti Targeted Attack Platform based on the Astra Linux operating system, follow these instructions to create an iso image.
17. Boot from the device that has the mounted iso image.
18. In the GRUB menu, select Upgrade KATA 7.0.
19. Follow the remaining steps of the wizard to complete the upgrade on the server.
20. After the upgrade is complete, go to the console of the server you connected to at step 6 and press Enter.

    A script is started that completes the upgrade process. After the update is complete, the console displays a message telling you to shut down the next server in the cluster.

21. Repeat steps 14 to 20 for each server in the cluster.

    The last server to be updated is the server to which you connected at step 6. For that server, step 20 is omitted.

The Central Node component is upgraded.

After updating the component, you must log in again to the Central Node server management console over SSH or through the terminal.