Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

back

DDC Deployment

DDC Agents

search

Please Note:

DDC Agents

This document provides procedures for installing and upgrading Agents in the Operating Systems required by your Data Stores. Agents should always be upgraded to be aligned with the latest server version. To upgrade an Agent, simply re-install it. Before reinstalling, you have to uninstall the older version of the Agent.

As of this release, most Agents without the database runtime component will not be supported. If you have any affected Agents installed without the database runtime component, you have to upgrade them to the database runtime version.

  1. Download the DDC Agents ZIP file corresponding to the CipherTrust Manager version from the Thales Customer Support Portal.

  2. Check the Agent Compatibility Matrix to find a matching Agent to the desired Data Stores.

  3. Extract the Agent Installer Package from DDC Agents ZIP and save it on the host machine where you want to install the Agent.

  4. Follow the appropriate procedure for your Operating System.

Before you begin the installation, make sure that CipherTrust Manager is reachable from the host where you are installing the Agent.

Agent Compatibility Matrix

The following table lists supported Agent installers for different types of data stores for different platforms and databases to help you select an appropriate installer depending on your data store requirements.

Data Store CategoryData Store TypeAgent ConfigurationDebianRHELWindows
Local StorageRHEL, CentOSLocalxvx
Local StorageDebian based distrosLocalvxx
Local StorageWindowsLocalxxv
Database StorageIBM DB2 11.1 and higherProxyxxv
Database StorageMicrosoft SQL 2005 and higherProxyxxv1
Database StorageOracle 9 and higherProxyvv2v
Database StoragePostgreSQL 9.5 and higherProxyv3v3v3
Database StorageSAP HANA 2.0Proxyxxv4
Database StorageMySQLProxyv5v5v5
Database StorageMongoDBProxyvvv
Network StorageUnix File Share (NFS)Proxyvvx
Network StorageWindows Share (SMB, CIFS)Proxyxxv
Cloud StorageAWS S3 (Amazon Web Services)Proxyvvv
Cloud StorageOffice 365: Sharepoint OnlineProxyvvv
Cloud StorageOffice 365: Exchange OnlineProxyxxv6
Cloud StorageAzure BlobsProxyvvv
Cloud StorageAzure TablesProxyvvv
Big DataHadoop 2.7.3 and higherProxyv78v9x
Big DataTeradataProxyxxv10

DDC supports two types of Agent configurations:

  • Local: Agent is installed and configured directly on the machine that contains sensitive data. Agent completes the scan accessing the files directly from the file system.

  • Proxy: Agent is installed and configured on a proxy machine that is used to scan sensitive data on other machines. Agent completes the scan accessing the information stored in the data store using the configured port and protocol. Please note that a proxy Agent can be installed on the same host as an in-house data store.

⚫ The instructions to install and configure Agents in both types of configurations are the same.
⚫ To connect to databases you require an Agent with DB runtime. If you have any Agents without DB runtime, please upgrade them to the ones that are included in this release.

RHEL Agents

The table below lists all RedHat Linux Agent installer packages included in this release.

Operating SystemAgent Installer PackageUpgrades Old Package
RHEL 7 64-biter2-2.3.0-linux3-rh-x64_database-runtime.rpmer2-2.0.31-linux26-rh-x64.rpm11
er2-2.1.0-linux26-rh-x64.rpm11
RHEL 6 64-bit
RHEL 5 64-bit
er2-2.3.0-linux26-rh-x64.rpmer2-2.0.31-linux26-rh-x64.rpm
er2-2.1.0-linux26-rh-x64.rpm
RHEL 6 32-bit
RHEL 5 32-bit
er2-2.3.0-linux26-x32.rpmer2-2.0.31-linux26-x32.rpm
er2-2.1.0-linux26-x32.rpm
er2-2.0.31-linux24-x32.rpm
er2-2.1.0-linux24-x32.rpm

RHEL 4 is no longer supported, so if you are running this Operating System please consider upgrading.

Operating SystemDeprecated Packages
RHEL 4
32-bit
er2-2.0.31-linux24-x32.rpm
er2-2.1.0-linux24-x32.rpm

Installing Agents on RHEL

To install the Linux 3 database runtime Node Agent on RHEL:

  1. Install the epel-release package:

    1
    sudo yum install epel-release
    
  2. Install the required packages:

    1
    2
    sudo yum install libxml2 libgsasl openssl \
    libcurl libuuid protobuf krb5-libs libaio
    
  3. Navigate to the location where the Agent installation package (.rpm) is stored.

  4. Install the Agent by using the following command:

    1
    sudo rpm -ivh er2-2.x.x-linux3-rh-x64_database-runtime.rpm
    

    For example:

    1
    rpm -ivh er2-2.0.31-linux3-rh-x64_database-runtime.rpm
    
  5. Connect the Agent to the active CipherTrust Manager node:

    1
    er2-config -i <hostname|ip_address>
    

    where, <hostname|ip_address> represents the IP address or hostname of the CipherTrust Manager node.

  6. Test the connection settings (on the data store that is using this host).

    1
    er2-config -t
    

    If the connection has been correctly configured, you should see the following message:

    Testing connection setting...
    Test SUCCESS. Saving settings
    Configuration updated, please restart agent service
    The configuration has been saved. Please restart the agent for the changes to take effect.
    

    To be able to scan Oracle DB Data Stores, make sure that the agent can resolve its own hostname. If it cannot, add it to its hosts file. For example, if its hostname is 'agent123', add this line:
    127.0.0.1 localhost agent123

  7. Restart the Agent:

    • Option 1

      1
      sudo /etc/init.d/er2-agent restart
      
    • Option 2

      1
      2
      sudo /etc/init.d/er2-agent stop
      sudo /etc/init.d/er2-agent start
      

The installation script creates an erecon user in the erecon group. Please ensure that this user (or group) is able to read all the files to scan. For security reasons, the account has its password locked to ensure that the user is solely used by the Data Discovery and Classification scanning agent.

Uninstalling Agents from RHEL

To uninstall a DDC Agent:

  1. Stop the DDC Agent.

    1
    sudo /etc/init.d/er2-agent stop
    
  2. Remove the existing packages:

    1
    sudo rpm -e er2
    

Debian Agents

The table below lists all Debian Linux Agent installer packages included in this release.

Operating SystemAgent Installer PackageUpgrades Old Package
Debian 10 64-bit
Ubuntu 18 64-bit
er2-2.3.0-linux3-x64_database-runtime.deber2-2.0.31-linux3-x64.deb11
er2-2.1.0-linux3-x64.deb11
er2-2.0.31-linux3-x64_database-runtime.deb
er2-2.1.0-linux3-x64_database-runtime.deb

Installing Agents on Debian

  1. Navigate to the location where the Agent installation (.deb) package is stored.

  2. Install the required packages:

    1
    2
    sudo apt-get install libaio1 libaio-dev krb5-user \
    libgsasl7 libcurl4 libprotobuf10
    
  3. Install the Agent by using the following command:

    1
    sudo dpkg -i er2_2.x.xx-xxxx_.deb
    

    For example:

    1
    sudo dpkg -i er2_2.0.31-linux26-x64.deb
    

    The package name that you use with the command may be different and depends on your system's architecture and Agent type.

  4. Connect the Agent to the active CipherTrust Manager node:

    1
    sudo er2-config -i <hostname|ip_address>
    

    where <hostname|ip_address> represents the IP address or hostname of the CipherTrust Manager node.

  5. Test the connection settings (on the data store that is using this host).

    1
    sudo er2-config -t
    

    If the connection has been correctly configured, you should see the following message:

    Testing connection setting...
    Test SUCCESS. Saving settings
    Configuration updated, please restart agent service
    The configuration has been saved. Please restart the agent for the changes to take effect.
    
  6. Restart the Agent:

    • Option 1

      1
      sudo /etc/init.d/er2-agent restart
      
    • Option 2

      1
      2
      sudo /etc/init.d/er2-agent stop
      sudo /etc/init.d/er2-agent start
      

The installation script creates an erecon user in the erecon group. Please ensure that this user (or group) is able to read all the files to scan. For security reasons, the account has its password locked to ensure that the user is solely used by the Data Discovery and Classification scanning agent.

Uninstalling Agents from Debian

To uninstall a DDC Agent:

  1. Stop the DDC Agent.

    1
    sudo /etc/init.d/er2-agent -stop
    
  2. Remove the existing packages:

    1
    sudo dpkg --remove er2
    

Windows Agents

The table below lists all Windows Agent installer packages included in this release.

Operating SystemAgent Installer PackageUpgrades Old Package
Windows 7/8/8.1 32-biter2_2.3.0-windows-x32_database-runtime.msier2_2.0.31-windows-x32.msi11
er2_2.1.0-windows-x32.msi11
er2_2.0.31-windows-x32_database-runtime.msi
er2_2.1.0-windows-x32_database-runtime.msi
Windows 7/8/8.1 64-bit
Windows 10 64-bit
Windows Server 2012/2012 R2 64-bit
Windows Server 2016 64-bit
Windows Server 2019 64-bit
er2_2.3.0-windows-x64_database-runtime.msier2_2.0.31-windows-x64.msi11
er2_2.1.0-windows-x64.msi11
er2_2.0.31-windows-x64_database-runtime.msi
er2_2.1.0-windows-x64_database-runtime.msi

Installing Agents on Windows

  1. Log in to the host machine where you want to install the Agent as administrator.

  2. Run the Agent installer.

  3. In the Welcome screen of the setup wizard, click Next to continue.

  4. The End-User Licence Agreement (EULA) screen is displayed.

    1. Read the license agreement and select I accept the terms in the Licence Agreement.

    2. Click Next to continue.

  5. In the Choose Setup Type screen, select the Install option for the standard installation and click Next to continue.

  6. The Ready to Install screen is displayed.

    1. Click Install to install the product in the default location.

    2. If the User Access Control dialog box appears, click Yes to confirm.

    The installation begins and the progress is shown under the Status progress bar.

  7. During the installation, in a separate Node Configuration window, you are asked for the connection details of the active CipherTrust Manager node.

    1. Master server IP address or host name: specify the IP address or host name of the CipherTrust Manager node.

    2. Master server public key and Target Group: skip this configuration part as it is optional and currently not used.

    3. Click Test Connection to test the connection between the Agent and CipherTrust Manager.

      • If the connection is properly configured, a confirmation will appear stating "Connectivity test is successful". Click OK to close the prompt.

      • If the connectivity test fails, click OK to close the prompt, make sure that CipherTrust Manager is reachable from the Agent host, and retry the test.

    4. Click Finish to complete the configuration.

  8. After a successful Agent installation, click the Finish button to exit the wizard and complete the installation.

    The installer creates a service called Enterprise Recon 2 Agent that runs under the Local System user account.

  9. For scanning MS SQL DB make sure to install the latest ODBC drivers package from the Microsoft site.

Uninstalling Agents from Windows

To uninstall a DDC Agent, you must be logged on as Administrator to the host where the Agent is running.

  1. Navigate to the Control Panel > Programs and Features.

  2. Locate the Enterprise Recon 2 Agent in the list of installed programs.

  3. Right click the Agent and select Uninstall.

  4. In the dialog box that is displayed, select to automatically close the Enterprise Recon 2 Agent application, and click OK to continue.

  5. Walk through the wizard.

Alternatively, to uninstall a DDC Agent from CLI, run the following commands as Administrator:
net stop "Enterprise Recon 2 Agent (<ARCH>)"
wmic product where name="Enterprise Recon 2 Agent (<ARCH>)" uninstall


  1. Make sure to install the latest ODBC drivers package from the Microsoft site. Windows agents uses the ODBC drivers installed on the agent host. ODBC Drivers version 17 required to support TLS 1.2 connections. 

  2. Make sure that the agent can resolve its own hostname. If not, add it to its hosts file. 

  3. Agents include a built-in PostgreSQL driver. This driver does not support password authentication with 'scram-sha-256' method. 

  4. Agent includes built-in drivers. If the Agent host has SAP HANA ODBC drivers installed, the Agent will use those drivers instead of its built-in drivers. 

  5. Agents include a built-in MySQL driver. This driver does not support password authentication with 'caching_sha2_password' method. 

  6. Agent host architecture (32-bit or 64-bit) must match the Exchange Server. 

  7. Running in Ubuntu 18. 

  8. Requires installing some additional packages, included in the Installing Agents on Debian section. 

  9. Requires installing some additional packages, included in the Installing Agents on RHEL section. 

  10. Agents do not include drivers to connect to Teradata so they require Teradata Tools and Utilities. Install the Teradata Tools and Utilities 16.10.xx on the Agent host. Check Teradata instructions on how to complete the installation. You may need to restart the Agent host after installing Teradata Tools and Utilities. 

  11. Upgrading this agent changes it to one that supports DB runtime.