Update a Standalone Database Firewall

Use this procedure to update a standalone Database Firewall that is not paired in a high availability environment.

Follow this process:

Stop all Database Firewall monitoring points.
Run the pre-upgrade RPM.
Transfer the ISO file to the appliance.
Start the update script.
Restart the appliance.

Note: When the appliance restarts, the update process continues. This takes several minutes to complete on Database Firewalls. Don’t restart the system while this is in progress.

Stop All Database Firewall Monitoring Points

Stop all monitoring points before updating the Database Firewall.

Log in to Oracle Database Security Central Console as an administrator.
Select Database Firewalls.
Select Database Firewall Monitoring in the left navigation menu.
Select all monitoring points.
Select Stop.

Run the Pre-upgrade RPM

Run the pre-upgrade RPM to check for the required space in the file system and prepare the system for updating.

The pre-upgrade RPM performs the following tasks to prepare the system for updating:

Rearranges free space on the appliance so that there’s enough room to copy the patch files to the appliance and start the installation. After the update, the space for the patch files is returned to the file system.
Verifies that other prerequisites and platform conditions are met before the update.
Prepares the system for updating by creating the /var/dbfw/upgrade directory with enough space to hold the main ISO file for the update.

To run the pre-upgrade RPM, follow these steps:

Log in to the appliance through SSH and switch to the root user.
Run the tmux command as the root user.

The tmux command prevents network disconnections from interrupting the update. If the session terminates, resume by switching to the root user and then running the tmux -r command.
Change to the root directory.
```
cd /root
```
Run the following command to copy the pre-upgrade RPM file from the downloaded location to the appliance:
```
scp remote_host:/path/to/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip /root
```
Verify the download by using a shasum of the dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip file.
```
sha256sum /root/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip
```

Unzip the bundle.

unzip /root/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip

Run the following command to install the dbsec-central-dbfw-pre-upgrade-360.0.0.0.0-0_NNNNNN.NNNN.x86_64.rpm file:

rpm -i /root/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip-0_NNNNNN.NNNN.x86_64.rpm

The following message appears:

SUCCESS: The upgrade media can now be copied to '/var/dbfw/upgrade'.
The upgrade can then be started by running: /usr/bin/dbsec-central-dbfw-upgrade

If you receive any errors instead of a SUCCESS message, resolve them before proceeding.

Related Topics

Transfer the ISO File to the Appliance

Transfer the dbsec-central-dbfw-upgrade-2.26.0.0.0.iso file to the appliance that you’re updating.

Log in to the appliance through SSH and switch to the root user.
Copy the dbsec-central-dbfw-upgrade-2.26.0.0.0.iso file by using the following command:
```
scp remote_host:/path/to/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso /var/dbfw/upgrade
```

Start the Update Script

The update script mounts the ISO, changes to the correct working directory, runs the update process, and unmounts the ISO after the upgrade process is complete.

Note: The system may take some time to complete the commands. Don’t interrupt the update or the system may be left in an inconsistent state. For this reason, it is important to use a reliable and uninterruptible shell, such as a direct console login (or ILOM equivalent), or use the tmux command to prevent network disconnections from interrupting the update.

Log in to the appliance through SSH and switch to the root user.
Run the tmux command as the root user.

The tmux command prevents network disconnections from interrupting the update. If the session terminates, resume by switching to the root user and then running the tmux -r command.
Run the following command to perform the appropriate checks before updating:
```
/usr/bin/dbsec-central-dbfw-upgrade
```

Follow the system prompt, warning, and instruction to proceed with the update accordingly.

You should see output like the following:

Please wait while validating SHA256 checksum for /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso
Checksum validation successful for /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso
Mounting /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso on /images
mount: /dev/loop0 is write-protected, mounting read-only
Successfully mounted /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso on /images

The following messages have important information about the upgrade process.

Power loss during upgrade may cause data loss. Do not power off during upgrade. Please review Note ID 2235931.1 for a current list of known issues.

The upgrade process is irreversible, please confirm 'y' to continue or 'n' to abort. [y/N]?

Enter y to proceed.

You should see output like the following:

The Oracle base has been set to /var/lib/oracle
Error: ORA-01034: ORACLE not available
ORA-27101: shared memory realm does not exist
Linux-x86_64 Error: 2: No such file or directory
Additional information: 4475
Additional information: 1990413931
The Oracle base has been set to /var/lib/oracle
Error: ORA-01034: ORACLE not available
ORA-27101: shared memory realm does not exist
Linux-x86_64 Error: 2: No such file or directory
Additional information: 4475
Additional information: 1990413931
Verifying upgrade preconditions
1/11: Mounting filesystems (1)
2/11: Cleaning yum configuration
3/11: Cleaning old packages and files
4/11: Upgrading kernel
5/11: Upgrading system
6/11: Cleaning platform packages repo
7/11: Adding required platform packages
8/11: Cleaning DBSecCentral packages repo
9/11: Installing DBSecCentral packages
10/11: Setting boot title
11/11: Setting final system status
Reboot now to continue the upgrade process.
Unmounted /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso on /images

Note: The preceding output varies depending on the base installation level, appliance type, and configuration.

Restart the Appliance

After updating, restart the appliance and continue the update process.

Log in to the appliance through SSH and switch to the root user.
Restart the appliance. For example:
```
reboot
```
Note: When the appliance restarts, the update process continues. This takes several minutes to complete on Database Firewalls. Don’t restart the system while this is in progress.
If you’ve updated a Database Firewall, it may have regenerated the appliance certificate. In this scenario, you need to reregister the Database Firewall. To check this:
1. Log in to the Oracle Database Security Central console as an administrator.
2. Select Database Firewalls.
  
  In the left navigation menu, Database Firewalls is selected by default and the page displays a list of configured Database Firewall instances.
3. Select the Database Firewall instance that indicates a certificate error after the update.
4. Select Reset Firewall.
See Also: Registering a Database Firewall in the Audit Vault Server