DDC Agents

This document provides procedures for installing and upgrading Agents in the Operating Systems required by your Data Stores. Agents should always be upgraded to be aligned with the latest server version. To upgrade an Agent, simply re-install it. Before reinstalling, you have to uninstall the older version of the Agent.

1. Download the DDC Agents ZIP file corresponding to the CipherTrust Manager version from the Thales Customer Support Portal.

2. Check the Agent Compatibility Matrix to find a matching Agent to the desired Data Stores.

3. Extract the Agent Installer Package from DDC Agents ZIP and save it on the host machine where you want to install the Agent.

4. Follow the appropriate procedure for your Operating System.

   • RHEL Agents.

   • Debian Agent.

   • Windows Agents.

Agent Compatibility Matrix

The following table lists supported Agent installers for different types of data stores for different platforms and databases to help you select an appropriate installer depending on your data store requirements.

DDC supports two types of Agent configurations:

• Local: Agent is installed and configured directly on the machine that contains sensitive data.

• Proxy: Agent is installed and configured on a proxy machine that is used to scan sensitive data on other machines.

RHEL Agents

RHEL 4 is no longer supported, so if you are running this Operating System please consider upgrading.

Installing Agents on RHEL

To install the Linux 3 database runtime Node Agent on RHEL:

1. Install the epel-release package:

   sudo yum install epel-release
   

2. Install the required packages:

   sudo yum install libxml2 libgsasl openssl \
   libcurl libuuid protobuf krb5-libs libaio
   

3. Navigate to the location where the Agent installation package (.rpm) is stored.

4. Install the Agent by using the following command:

   sudo rpm -ivh er2-2.x.x-linux3-rh-x64_database-runtime.rpm
   

   For example:

   rpm -ivh er2-2.0.31-linux3-rh-x64_database-runtime.rpm
   

5. Connect the Agent to the active CipherTrust Manager node:

   er2-config -i <hostname|ip_address>
   

   where, <hostname|ip_address> represents the IP address or hostname of the CipherTrust Manager node.

6. Test the connection settings (on the data store that is using this host).

   er2-config -t
   

   If the connection has been correctly configured, you should see the following message:

   Testing connection setting...
   Test SUCCESS. Saving settings
   Configuration updated, please restart agent service
   The configuration has been saved. Please restart the agent for the changes to take effect.
   

7. Restart the Agent:

   • Option 1

     sudo /etc/init.d/er2-agent restart
     

   • Option 2

     sudo /etc/init.d/er2-agent stop
     sudo /etc/init.d/er2-agent start
     

Uninstalling Agents from RHEL

To uninstall a DDC Agent:

1. Stop the DDC Agent.

   sudo /etc/init.d/er2-agent stop
   

2. Remove the existing packages:

   sudo rpm -e er2
   

Debian Agent

Installing Agents on Debian

1. Navigate to the location where the Agent installation (.deb) package is stored.

2. Install the required packages:

   sudo apt-get install libaio1 libaio-dev krb5-user \
   libgsasl7 libcurl4 libprotobuf10
   

3. Install the Agent by using the following command:

   sudo dpkg -i er2_2.x.xx-xxxx_.deb
   

   For example:

   sudo dpkg -i er2_2.0.31-linux26-x64.deb
   

   The package name that you use with the command may be different and depends on your system's architecture and Agent type.

4. Connect the Agent to the active CipherTrust Manager node:

   sudo er2-config -i <hostname|ip_address>
   

   where <hostname|ip_address> represents the IP address or hostname of the CipherTrust Manager node.

5. Test the connection settings (on the data store that is using this host).

   sudo er2-config -t
   

   If the connection has been correctly configured, you should see the following message:

   Testing connection setting...
   Test SUCCESS. Saving settings
   Configuration updated, please restart agent service
   The configuration has been saved. Please restart the agent for the changes to take effect.
   

6. Restart the Agent:

   • Option 1

     sudo /etc/init.d/er2-agent restart
     

   • Option 2

     sudo /etc/init.d/er2-agent stop
     sudo /etc/init.d/er2-agent start
     

Uninstalling Agents from Debian

To uninstall a DDC Agent:

1. Stop the DDC Agent.

   sudo /etc/init.d/er2-agent -stop
   

2. Remove the existing packages:

   sudo dpkg --remove er2
   

Windows Agents

Installing Agents on Windows

1. Log in to the host machine where you want to install the Agent as administrator.

2. Run the Agent installer.

3. In the Welcome screen of the setup wizard, click Next to continue.

4. The End-User Licence Agreement (EULA) screen is displayed.

   1. Read the license agreement and select I accept the terms in the Licence Agreement.

   2. Click Next to continue.

5. In the Choose Setup Type screen, select the Install option for the standard installation and click Next to continue.

6. The Ready to Install screen is displayed.

   1. Click Install to install the product in the default location.

   2. If the User Access Control dialog box appears, click Yes to confirm.

   The installation begins and the progress is shown under the Status progress bar.

7. During the installation, in a separate Node Configuration window, you are asked for the connection details of the active CipherTrust Manager node.

   1. Master server IP address or host name: specify the IP address or host name of the CipherTrust Manager node.

   2. Master server public key and Target Group: skip this configuration part as it is optional and currently not used.

   3. Click Test Connection to test the connection between the Agent and CipherTrust Manager.

      • If the connection is properly configured, a confirmation will appear stating "Connectivity test is successful". Click OK to close the prompt.

      • If the connectivity test fails, click OK to close the prompt, make sure that CipherTrust Manager is reachable from the Agent host, and retry the test.

   4. Click Finish to complete the configuration.

8. After a successful Agent installation, click the Finish button to exit the wizard and complete the installation.

   Note

   The installer creates a service called Enterprise Recon 2 Agent that runs under the Local System user account.

9. For scanning MS SQL DB make sure to install the latest ODBC drivers package from the Microsoft site.

Uninstalling Agents from Windows

To uninstall a DDC Agent, you must be logged on as Administrator to the host where the Agent is running.

1. Navigate to the Control Panel > Programs and Features.

2. Locate the Enterprise Recon 2 Agent in the list of installed programs.

3. Right click the Agent and select Uninstall.

4. In the dialog box that is displayed, select to automatically close the Enterprise Recon 2 Agent application, and click OK to continue.

5. Walk through the wizard.