{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"b1f07355cf2565c7081e067f796316d3"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"2d9b199f-efc8-44e9-8211-365341ee68b6"}},{"type":"paragraph","content":[{"text":"Depending on the desired deployment scenarios, there are a handful of different alternatives that can be approached for a particular customer installation. The Devo Endpoint Agent installation process is flexible so as to allow a number of deployment models by using a specific ","type":"text"},{"text":"inventory","type":"text","marks":[{"type":"code"}]},{"text":" file. In this document, the most common scenarios are depicted, as well as the list of additions to the inventory that are required to fulfill those. Thus, each subsection can be considered as an installation step that offers different alternatives for completion, and ","type":"text"},{"text":"not a step-by-step installation procedure","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"If there is any special need not included in this guideline, please contact Devo for more detailed information.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"The inventory","type":"text"}]},{"type":"paragraph","content":[{"text":"The deployment of the Endpoint Agent is done via Ansible playbooks. The playbooks instrument all needed steps to deploy the platform according to your needs, defining what and where you want to deploy every component. To do so, the Ansible playbooks will use a ","type":"text"},{"text":"YAML inventory file","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.ansible.com/ansible/latest/user_guide/intro_inventory.html"}}]},{"text":" to understand what tasks are needed to accomplish this. The YAML inventory file is the base of the deployment and it is very important to have clear what type of deployment you want to achieve and to create a valid inventory file before starting the deployment process.","type":"text"}]},{"type":"paragraph","content":[{"text":"When preparing a new deployment of the Endpoint Agent, it is important to have in mind some questions:","type":"text"}]},{"type":"rule"},{"type":"expand","attrs":{"title":"What type of deployment do I want?"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you are looking for PoC or non-productive environment deployment, the standalone All-in-One deployment is provided, where the ansible playbooks will create two dockers with the ancillary services for EA Manager to run properly.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you are looking for a small production environment and you do not need HA, you can use the standalone deployment, but use your own ancillary services (MySQL and REDIS) to give the system more robustness and security.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you are looking for a bigger production deployment enabling HA, you should consider a distributed deployment using several managers and your own DB clusters to ensure robustness, security and availability. Agents should communicate with the EA Manager via a Load Balancer to enable the use of more than one EA Manager.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"How are the agents going to connect to the Manager?"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The endpoints connect to the manager via ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" change","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The endpoints connect to the manager with a known FQDN","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The endpoints connect to the manager using a public IP but no FQDN","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"What data do I want to collect?"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"What data do i want to collect? Take a look at the out-of-the-box packs available ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":".","type":"text"}]}]}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Endpoint Agent provides several YAML templates to base your inventory file in, depending on the case that you are trying to deploy. An Ansible YAML inventory file is composed of three main sections:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"all → vars : This section defines all the variables that are going to be used in the tasks during the playbook run.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"all → hosts: This section defines the information related to the hosts where the solution is going to be deployed. It can include one or more hosts, and it is composed of blocks named after the hostname of the destination host.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"all → children: This section defines the topology that is going to be deployed. You can define hosts groups with a specific name and include there the hosts defined in the ","type":"text"},{"text":"all->hosts","type":"text","marks":[{"type":"code"}]},{"text":" section . The playbook will then deploy specific roles to those groups when its run. The pre-defined hosts groups are the following:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Mandatory) ","type":"text"},{"text":"devoeamanagerserverone","type":"text","marks":[{"type":"strong"}]},{"text":": First EA Manager server","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) ","type":"text"},{"text":"devoeamanagerreplicas","type":"text","marks":[{"type":"strong"}]},{"text":": Secondary (or more) manager servers. This role needs to include a variable ","type":"text"},{"text":"deam_am_i_replica: true","type":"text","marks":[{"type":"code"}]},{"text":" in this section.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) ","type":"text"},{"text":"deamintsrvs","type":"text","marks":[{"type":"strong"}]},{"text":": EA Manager required ancillary services that should be enabled only in one host. If this role is included, creates a docker for MySQL and Redis . If you will be using your own databases, this host group should not be included in the inventory.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Mandatory)","type":"text"},{"text":" deaagentpackager: ","type":"text","marks":[{"type":"strong"}]},{"text":"EA repository that can be enabled in one or more hosts. In each host included in this group, playbook packages osquery installers with certificates and secrets and generates the auto-installation scripts for the agents that will be deployed in the endpoints. It also installs and configures a NGINX service to easily download said packages.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Mandatory)","type":"text"},{"text":" selfsignedcertificates / providedcertificates: ","type":"text","marks":[{"type":"strong"}]},{"text":"Only one of these hosts groups can be enabled at the same time and are only required in ","type":"text"},{"text":"devoeamanagerserverone","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"selfsignedcertificates: Instructs the EA deployer to generate self-signed certificates that will be used to secure the communication between the endpoints and the manager. By default, the self-signed certificates created by the EA deployer will only trust the FQDN defined in ","type":"text"},{"text":"deam_fqdn","type":"text","marks":[{"type":"code"}]},{"text":". In the case you need your certificate to trust different names, you can use the variable ","type":"text"},{"text":"SAN_extensions","type":"text","marks":[{"type":"code"}]},{"text":" and define a list of Subject Alternative Names (IPs and DNSs) to be included in the ","type":"text"},{"text":"certificate","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.ansible.com/ansible/2.9/modules/openssl_csr_module.html#parameter-subject_alt_name"}}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"providedcertificates: Instruct the EA deployer to use existing certificates instead of creating new ones. You should use this group if you want to use your own certificates for EA Manager.","type":"text"}]}]}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Standalone deployment template","type":"text"}]},{"type":"paragraph","content":[{"text":"The below snippet is a valid inventory file for a standalone deployment.","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n deam_fqdnname: << FQDN >>\n dea_ap_builder_update_etc_host: << yes/no >>\n dea_ap_overwrite_deam_fqdnname: << PUBLIC_HOST_IP >> \n set_deam_fqdnname_as_hostname: false\n deam_admin_email: << ADMIN_EMAIL >>\n deam_admin_username: << ADMIN_USER >>\n deam_admin_passwd: << ADMIN_PASS >>\n deam_client_org_name: << ORGANIZATION_NAME >>\n dea_ap_repo_user: << REPO_USER >>\n dea_ap_repo_passwd: << REPO_PASS >>\n deam_redis_address: << REDIS_ADDRESS:PORT >>\n deam_redis_password: << REDIS_PASSWORD >> \n deam_mysql_address: << MYSQL_ADDRESS:PORT >>\n deam_mysql_database: << MYSQL_DATABASE_NAME >>\n deam_mysql_username: << MYSQL_USER >>\n deam_mysql_password: << MYSQL_PASSWORD >>\n deam_mysql_root_password: << MYSQL_PASSOWRD_ROOT_USER >> \n _ _deam_relay_entrypoint: << ENTRYPOINT_URL >>\n pre_checks_tls_certs_query_bearer: << API v2 Bearer Token >>\n pre_checks_tls_certs_query_api_url: << Query API entrypoint>>\n deam_packs_enabled:\n - configuration.yaml\n - events.yaml\n - fetchfiles.yaml\n - performance.yaml\n - status.yaml\n hosts:\n << HOST_NAME >>:\n ansible_host: << HOST_IP >>\n ansible_user: << HOST_USER >>\n ansible_ssh_pass: << HOST_PASS >>\n # Only required if you connect with password\n ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n ansible_python_interpreter: << PYTHON_INTERPRETER >>\n children:\n devoeamanagerserverone:\n hosts:\n << HOST_NAME >>:\n deamintsrvs:\n hosts:\n << HOST_NAME >>:\n deaagentpackager:\n hosts:\n << HOST_NAME >>:\n selfsigenedcertificates: # Alternative providedcertificates\n hosts:\n << HOST_NAME >>:\n vars:\n #If no Subject Alternate Names are required, Leave only DNS: << FQDN >> entry (<< FQDN >> is the value set in deam_fqdnname)\n SAN_extensions:\n - DNS: << FQDN >>\n - IP: << HOST_PUBLIC_IP >>\n - DNS: << HOST_FQDN >>\n - DNS: << HOST_FQDN_2 >> ","type":"text"}]},{"type":"expand","attrs":{"title":"all->vars"},"content":[{"type":"paragraph","content":[{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":": FQDN of the EA Manager. Agents will use this FQDN to communicate to the EA Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"dea_ap_builder_update_etc_host","type":"text","marks":[{"type":"code"}]},{"text":": Indicates if the installation package of the endpoints will update ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" to communicate with the manager.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the FQDN set in ","type":"text"},{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" is public and the agents can reach it, set it as “no”.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the FQDN set in ","type":"text"},{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" is not reachable by the agents and the communication with the EA Manager is via internet, set it as “no”. Configure the parameter ","type":"text"},{"text":"dea_ap_overwrite_deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" with the public IP that the agents will use to communicate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the FQDN set in ","type":"text"},{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" is not reachable by the agents and the communication with the EA Manager is via private network, set it as “yes”. When an agent is deployed, the ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" will be modified to assign the IP configured in ","type":"text"},{"text":"ansible_host","type":"text","marks":[{"type":"code"}]},{"text":" to the FQDN value.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"dea_ap_overwrite_deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":": If the FQDN is not reachable by the agent, but the manager needs to be accessed via the internet, put here the public IP that the agent will use to connect. When using public FQDNs or local connection using ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" this parameter is not necessary and can be removed completely from the inventory.","type":"text"}]},{"type":"paragraph","content":[{"text":"set_deam_fqdnname_as_hostname","type":"text","marks":[{"type":"code"}]},{"text":": This parameter can be kept always as ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":". It is a legacy parameter that will be deprecated in the future.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_admin_email","type":"text","marks":[{"type":"code"}]},{"text":": E-mail of the admin user. The email is used to log in to the UI interface of the EA Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_admin_username","type":"text","marks":[{"type":"code"}]},{"text":": Username for the administrator user.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_admin_passwd","type":"text","marks":[{"type":"code"}]},{"text":": Password used to log in to the UI interface of the EA Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_client_org_name","type":"text","marks":[{"type":"code"}]},{"text":": Organization Name. It is displayed in the UI.","type":"text"}]},{"type":"paragraph","content":[{"text":"dea_ap_repo_user","type":"text","marks":[{"type":"code"}]},{"text":": User for the agent download repository.","type":"text"}]},{"type":"paragraph","content":[{"text":"dea_ap_repo_passwd","type":"text","marks":[{"type":"code"}]},{"text":": Password for the agent download repository.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_redis_address","type":"text","marks":[{"type":"code"}]},{"text":": REDIS address and port:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the deployment is self creating dockers for REDIS and MySQL, the value should be configured as ","type":"text"},{"text":"localhost:6379","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the deployment is using your own DB services, the value should be configured with the address of the REDIS database and the port of access. ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"deam_redis_password","type":"text","marks":[{"type":"code"}]},{"text":": REDIS password (when in use).","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_address","type":"text","marks":[{"type":"code"}]},{"text":": MySQL address and port:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the deployment is self creating dockers for REDIS and MySQL, the value should be configured as ","type":"text"},{"text":"localhost:3306","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the deployment is using your own DB services, the value should be configured with the address of the MySQL database and the port of access. ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"deam_mysql_database","type":"text","marks":[{"type":"code"}]},{"text":": Name of the database to be used by EA Manager. ","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_username","type":"text","marks":[{"type":"code"}]},{"text":": Username to access the database.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_password","type":"text","marks":[{"type":"code"}]},{"text":": Password to access the database.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_root_password","type":"text","marks":[{"type":"code"}]},{"text":": Password to access the database ","type":"text"},{"text":"as ","type":"text","marks":[{"type":"underline"}]},{"text":"root","type":"text","marks":[{"type":"code"}]},{"text":" user (MySQL admin user by default)","type":"text","marks":[{"type":"underline"}]},{"text":". ","type":"text"},{"text":"Only","type":"text","marks":[{"type":"underline"},{"type":"strong"}]},{"text":" used and necessary if the deployment is self creating dockers for REDIS and MySQL","type":"text","marks":[{"type":"underline"}]}]},{"type":"paragraph","content":[{"text":"deam_relay_entrypoint","type":"text","marks":[{"type":"code"}]},{"text":": Includes the entry point value of the Devo collector for your deployment:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If your domain is deployed in the US Cloud (","type":"text"},{"text":"us.devo.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://us.devo.com/"}}]},{"text":"): ","type":"text"},{"text":"tcp://collector-us.devo.io:443","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If your domain is deployed in the EU Cloud (","type":"text"},{"text":"eu.devo.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://eu.devo.com/"}}]},{"text":"): ","type":"text"},{"text":"tcp://eu.elb.relay.logtrust.net:443","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If your domain is deployed in a different cloud, contact your Devo representative to know your entry point.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"pre_checks_tls_certs_query_bearer","type":"text","marks":[{"type":"code"}]},{"text":": (Optional) Obtain a valid Query API v2 token that grant access to siem.logtrust.collector.counter to enable EA deployer to be able to validate data sent during deployment. How to obtain an ","type":"text"},{"text":"API Token","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"pre_checks_tls_certs_query_api_url","type":"text","marks":[{"type":"code"}]},{"text":": (Optional) Configure the query API endpoint corresponding to your domain. ","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_packs_enabled","type":"text","marks":[{"type":"code"}]},{"text":": List of YAML files including the definition of the packs that will be deployed into the EA Manager. ","type":"text"}]}]},{"type":"expand","attrs":{"title":"all->hosts"},"content":[{"type":"paragraph","content":[{"text":"hosts:","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"The hosts section of the inventory is composed by a group of hosts named with the hostname of the host. In the case of standalone deployment it will include only one. Replace ","type":"text"},{"text":"<< HOST_NAME >>","type":"text","marks":[{"type":"code"}]},{"text":" with the hostname of the server where the installation is happening. Ansible will connect via SSH to every host where it needs to take action using the data configured in this section.","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_host","type":"text","marks":[{"type":"code"}]},{"text":": IP of the EA Manager server that ansible is going to use to connect to the host. ","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_user","type":"text","marks":[{"type":"code"}]},{"text":": SSH User to connect to this host.","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_ssh_pass","type":"text","marks":[{"type":"code"}]},{"text":": Password for the SSH user. It is not mandatory to use a password when using the playbooks. If you want to use SSH keys, just comment out this parameter and add your ssh key at Linux session level or include it in this section using the parameter ","type":"text"},{"text":"ansible_ssh_private_key_file","type":"text","marks":[{"type":"code"}]},{"text":" .","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_python_interpreter","type":"text","marks":[{"type":"code"}]},{"text":": Specify what python interpreter will be used depending on your Linux distribution and version:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Python 2: /usr/bin/python","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Python 3: /usr/bin/python3","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Distributed deployment template","type":"text"}]},{"type":"paragraph","content":[{"text":"The following template is a deployment of Endpoint Agent with two EA Managers using existing databases. This deployment also requires a Load Balancer to be placed between the endpoints and the two EA Managers.","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n deam_fqdnname: << FQDN >>\n dea_ap_builder_update_etc_host: << yes/no >>\n set_deam_fqdnname_as_hostname: false\n deam_admin_email: << ADMIN_EMAIL >>\n deam_admin_username: << ADMIN_USER >>\n deam_admin_passwd: << ADMIN_PASS >>\n deam_client_org_name: << ORGANIZATION_NAME >>\n dea_ap_repo_user: << REPO_USER >>\n dea_ap_repo_passwd: << REPO_PASS >>\n deam_redis_address: << REDIS_ADDRESS:PORT >>\n deam_redis_password: << REDIS_PASSWORD >>\n deam_mysql_address: << MYSQL_ADDRESS:PORT >> \n deam_mysql_database: << MYSQL_DATABASE_NAME >>\n deam_mysql_username: << MYSQL_USER >>\n deam_mysql_password: << MYSQL_PASSWORD >>\n deam_relay_entrypoint: << ENTRYPOINT_URL >>\n pre_checks_tls_certs_query_bearer: << API v2 Bearer Token >>\n pre_checks_tls_certs_query_api_url: << Query API entrypoint>>\n deam_packs_enabled:\n - configuration.yaml\n - events.yaml\n - fetchfiles.yaml\n - performance.yaml\n - status.yaml\n hosts:\n << HOST_NAME_SERVER_1 >>:\n ansible_host: << HOST_IP >>\n ansible_user: << HOST_USER >>\n ansible_ssh_pass: << HOST_PASS >>\n # Only required if you connect with password\n ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n ansible_python_interpreter: << PYTHON_INTERPRETER >>\n << HOST_NAME_SERVER_2 >>:\n # Set ansible_host your public ip used to conncet from ansbile and devo-ea agents\n ansible_host: << HOST_IP >>\n ansible_user: << HOST_USER >>\n ansible_ssh_pass: << HOST_PASS >>\n # Only required if you connect with password\n ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n # python3 required for Ubuntu 18 ansible-playbooks\n ansible_python_interpreter: << PYTHON_INTERPRETER >>\n children:\n devoeamanagerserverone:\n hosts:\n << HOST_NAME_SERVER_1 >>:\n devoeamanagerreplicas:\n hosts:\n << HOST_NAME_SERVER_2 >>:\n vars:\n deam_am_i_replica: true \n deamintsrvs:\n hosts:\n << HOST_NAME_SERVER_1 >>:\n deaagentpackager:\n hosts:\n << HOST_NAME_SERVER_1 >>:\n << HOST_NAME_SERVER_2 >>:\n selfsigenedcertificates: # Alternative providedcertificates\n hosts:\n << HOST_NAME_SERVER_1 >>:","type":"text"}]},{"type":"expand","attrs":{"title":"all->vars"},"content":[{"type":"paragraph","content":[{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":": FQDN of the Load Balancer. Agents will use this FQDN to communicate with the EA Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"dea_ap_builder_update_etc_host","type":"text","marks":[{"type":"code"}]},{"text":": Indicates if the installation package of the endpoints will update ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" to communicate with the Load Balancer.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the FQDN set in ","type":"text"},{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" is public and the agents can reach it, set it as “no”.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the FQDN set in ","type":"text"},{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" is not reachable by the agents and the communication with the EA Manager is via internet, set it as “no”. Configure the parameter ","type":"text"},{"text":"dea_ap_overwrite_deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" with the public IP that the agents will use to communicate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If the FQDN set in ","type":"text"},{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":" is not reachable by the agents and the communication with the EA Manager is via private network, set it as “yes”. When an agent is deployed, the ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" will be modified to assign the IP configured in ","type":"text"},{"text":"ansible_host","type":"text","marks":[{"type":"code"}]},{"text":" to the FQDN value.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"dea_ap_overwrite_deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":": If the FQDN is not reachable by the agent, but the manager needs to be accessed via the internet, put here the public IP that the agent will use to connect. When using public FQDNs or local connection using ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" this parameter is not necessary and can be removed completely from the inventory.","type":"text"}]},{"type":"paragraph","content":[{"text":"set_deam_fqdnname_as_hostname","type":"text","marks":[{"type":"code"}]},{"text":": This parameter can be always kept as ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":". It is a legacy parameter that will be deprecated in the future.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_admin_email","type":"text","marks":[{"type":"code"}]},{"text":":Email of the admin user. The email is used to log in to the UI interface of the EA Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_admin_username","type":"text","marks":[{"type":"code"}]},{"text":": Username for the administrator user.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_admin_passwd","type":"text","marks":[{"type":"code"}]},{"text":": Password used to log in to the UI interface of the EA Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_client_org_name","type":"text","marks":[{"type":"code"}]},{"text":": Organization Name. It is displayed in the UI.","type":"text"}]},{"type":"paragraph","content":[{"text":"dea_ap_repo_user","type":"text","marks":[{"type":"code"}]},{"text":": User for the agent download repository.","type":"text"}]},{"type":"paragraph","content":[{"text":"dea_ap_repo_passwd:","type":"text","marks":[{"type":"code"}]},{"text":" Password for the agent download repository.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_redis_address","type":"text","marks":[{"type":"code"}]},{"text":": REDIS address and port.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_redis_password","type":"text","marks":[{"type":"code"}]},{"text":": REDIS password.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_address","type":"text","marks":[{"type":"code"}]},{"text":": MySQL address and port.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_database","type":"text","marks":[{"type":"code"}]},{"text":": Name of the database to be used by the EA Manager. The database should have been created in advance. Check the “Using existing databases” section.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_username","type":"text","marks":[{"type":"code"}]},{"text":": Username to access the database.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_mysql_password","type":"text","marks":[{"type":"code"}]},{"text":": Password to access the database.","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_relay_entrypoint","type":"text","marks":[{"type":"code"}]},{"text":": Includes the entry point value of the Devo collector for your deployment:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If your domain is deployed in the US Cloud (","type":"text"},{"text":"us.devo.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://us.devo.com/"}}]},{"text":"): ","type":"text"},{"text":"tcp://collector-us.devo.io:443","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If your domain is deployed in the EU Cloud (","type":"text"},{"text":"eu.devo.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://eu.devo.com/"}}]},{"text":"): ","type":"text"},{"text":"tcp://eu.elb.relay.logtrust.net:443","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If your domain is deployed in a different cloud, contact your Devo representative to know your entry point.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"pre_checks_tls_certs_query_bearer","type":"text","marks":[{"type":"code"}]},{"text":": (Optional) Obtain a valid Query API v2 token that grant access to ","type":"text"},{"text":"siem.logtrust.collector.counter","type":"text","marks":[{"type":"code"}]},{"text":" to enable the EA deployer to be able to validate data sent during deployment. How to obtain an ","type":"text"},{"text":"API Token","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Include it here if you want the Devo EA deployer to validate that it can send data to it before starting the deployment.","type":"text"}]},{"type":"paragraph","content":[{"text":"pre_checks_tls_certs_query_api_url","type":"text","marks":[{"type":"code"}]},{"text":": (Optional) Configure the query API endpoint corresponding to your domain. ","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_packs_enabled","type":"text","marks":[{"type":"code"}]},{"text":": List of YAML files including the definition of the packs that will be deployed into the EA Manager. ","type":"text"}]}]},{"type":"expand","attrs":{"title":"all->hosts"},"content":[{"type":"paragraph","content":[{"text":"hosts:","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"The hosts section of the inventory is composed by a group of hosts named with the hostname of the host. Replace ","type":"text"},{"text":"<< HOST_NAME >>","type":"text","marks":[{"type":"code"}]},{"text":" with the hostname of the server where the installation is happening. Ansible will connect via SSH to every host where it needs to take action using the data configured in this section.","type":"text"}]},{"type":"paragraph","content":[{"text":"For each host configure:","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_host","type":"text","marks":[{"type":"code"}]},{"text":": IP of the EA Manager server that ansible is going to use to connect to the host. ","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_user","type":"text","marks":[{"type":"code"}]},{"text":": SSH User to connect to this host.","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_ssh_pass","type":"text","marks":[{"type":"code"}]},{"text":": Password for the SSH user. It is not mandatory to use a password when using the playbooks. If you want to use SSH keys, just comment out this parameter and add your ssh key at Linux session level or include it in this section using the parameter ","type":"text"},{"text":"ansible_ssh_private_key_file","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"ansible_python_interpreter","type":"text","marks":[{"type":"code"}]},{"text":": Specify what python interpreter will be used depending on your Linux distribution and version:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Python 2: /usr/bin/python","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Python 3: /usr/bin/python3","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":1},"content":[{"text":"Deployment credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"The Devo EA Deployer uses SSH to connect to the different servers where it needs to install different components. When configuring the hosts in the inventory file, it is required to configure the SSH user and authentication method that the deployer needs to use in each task.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Using SSH user and password","type":"text"}]},{"type":"paragraph","content":[{"text":"For a user and password-based authentication method, configuration for the host should look like the one in the following snippet:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n ...\n hosts:\n devo-ea-manager:\n ansible_host: 192.168.57.5\n ansible_user: ssh_user\n ansible_ssh_pass: ssh_pass\n ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n ...","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Using SSH private key","type":"text"}]},{"type":"paragraph","content":[{"text":"Alternatively, in order to use a private key, use the following code:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n ...\n hosts:\n devo-ea-manager:\n ansible_host: 192.168.57.5\n ansible_user: ssh_user\n ansible_ssh_private_key_file: << PATH TO YOUR SSH KEY HERE >>\n ...","type":"text"}]},{"type":"paragraph","content":[{"text":"Adding the path to the private key to the inventory file is not mandatory. It can be added to the environment using ","type":"text"},{"text":"ssh-add 'key file'","type":"text","marks":[{"type":"code"}]},{"text":" instead of adding it to the inventory file. Note that you should make sure that the ssh-agent is running to be able to add your identity. You can start the agent with ","type":"text"},{"text":"eval $(ssh-agent)","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Initial packs configuration (new from EA v1.1.0)","type":"text"}]},{"type":"paragraph","content":[{"text":"From v1.1.0 onwards, the EA deployer enables customers to decide which query packs will be deployed with the solution, as opposed to all of them being added automatically during the installation process. As a result, it will be up to the installer responsible to decide which packs will be added to the baseline configuration to fulfill the customer’s particular needs and use cases. The complete list of available packs, along with a description of their functionality and set of supported use cases, can be found here in the ","type":"text"},{"text":"pre-integrated query packs","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":" section.","type":"text"}]},{"type":"paragraph","content":[{"text":"The process to enable packs is handled with two parameters in the inventory file:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_packs_enabled","type":"text","marks":[{"type":"code"}]},{"text":": Sets what packs will be deployed when running both ","type":"text"},{"text":"devo-endpoint-agent","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"deam-packs","type":"text","marks":[{"type":"code"}]},{"text":" playbooks. ","type":"text"}]}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"In the following example, only the configuration (represented by ","type":"text"},{"text":"configuration.yaml","type":"text","marks":[{"type":"code"}]},{"text":") and events (","type":"text"},{"text":"events.yaml","type":"text","marks":[{"type":"code"}]},{"text":") packs will be deployed:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":942,"id":"b8aa3e0c-5bb1-49ca-b2aa-b65decf1c7f6","collection":"contentId-1052967103","type":"file","height":450}}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"The file names included in this list come from the files placed in ","type":"text"},{"text":"$HOME/devo-ea-deployer/playbooks/roles/deam-packs/files/optional-devo-packs","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":1}}],"content":[{"text":"(Only From 1.2.1)","type":"text","marks":[{"type":"strong"}]},{"text":" The packs (and queries included in the pack) not included in the ","type":"text"},{"text":"deam_packs_enabled","type":"text","marks":[{"type":"code"}]},{"text":" will be automatically removed from the actual EA Manager if they were previously enabled. ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Deprecated in V1.2.1)","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"deam_packs_purge_cached_files","type":"text","marks":[{"type":"code"}]},{"text":": Use this option when you do not want to deploy a pack anymore. Once the packs are deployed for the first time, they are cached under (","type":"text"},{"text":"/var/devo-ea-manager/packs/devo-packs","type":"text","marks":[{"type":"code"}]},{"text":"). If you want to avoid some of the packages being redeployed, make sure to include them in the purge list before triggering the deploy operation. Otherwise, the deployer will use the cached version and deploy again the packs even if they are not included in ","type":"text"},{"text":"deam_packs_enabled","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"In the following example, the installation user is deploying only the ","type":"text"},{"text":"configuration.yaml ","type":"text","marks":[{"type":"code"}]},{"text":"pack and is purging the ","type":"text"},{"text":"events.yaml","type":"text","marks":[{"type":"code"}]},{"text":" pack that was previously deployed from the temporary folder:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":970,"id":"c58bd589-61af-4559-88a1-b78f5dccfd45","collection":"contentId-1052967103","type":"file","height":484}}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Python Interpreter","type":"text"}]},{"type":"paragraph","content":[{"text":"When deploying in Red Hat 7 or Amazon Linux 2, make sure that the host is configured to use python 2 instead of python 3 in the inventory file.","type":"text"}]},{"type":"paragraph","content":[{"text":"Hosts in RedHat 7 or Amazon Linux 2:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n ...\n hosts:\n devo-ea-manager:\n ...\n ansible_python_interpreter: /usr/bin/python","type":"text"}]},{"type":"paragraph","content":[{"text":"Other OS:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n ...\n hosts:\n devo-ea-manager:\n ...\n ansible_python_interpreter: /usr/bin/python3","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Firewalld and ufw management","type":"text"}]},{"type":"paragraph","content":[{"text":"(Only from 1.2.1)","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"By default, the EA deployer will take care of the configuration of ufw and firewalld to create the required exceptions in the default Linux firewalls if firewall services are up and running at deployment time.","type":"text"}]},{"type":"expand","attrs":{"title":"Example default configuration created by EA Deployer in ufw in a Ubuntu 20:"},"content":[{"type":"codeBlock","content":[{"text":"vagrant@ubuntu2004:~/devo-ea-deployer$ sudo ufw status verbose\nStatus: active\nLogging: on (low)\nDefault: deny (incoming), allow (outgoing), deny (routed)\nNew profiles: skip\n\nTo Action From\n-- ------ ----\n22 ALLOW IN Anywhere\n3306/tcp ALLOW IN Anywhere\n6379/tcp ALLOW IN Anywhere\n8080/tcp ALLOW IN Anywhere\n8081/tcp ALLOW IN Anywhere\n22 (v6) ALLOW IN Anywhere (v6)\n3306/tcp (v6) ALLOW IN Anywhere (v6)\n6379/tcp (v6) ALLOW IN Anywhere (v6)\n8080/tcp (v6) ALLOW IN Anywhere (v6)\n8081/tcp (v6) ALLOW IN Anywhere (v6)","type":"text"}]}]},{"type":"expand","attrs":{"title":"Example default configuration created by EA Deployer in firewalld in a RHEL8 (only relevant zones are shown):"},"content":[{"type":"codeBlock","content":[{"text":"public (active)\n target: default\n icmp-block-inversion: no\n interfaces: eth0 eth1 eth2\n sources:\n services: cockpit dhcpv6-client ssh\n ports: 8080/tcp 8081/tcp\n protocols:\n masquerade: no\n forward-ports:\n source-ports:\n icmp-blocks:\n rich rules:\n\ntrusted (active)\n target: ACCEPT\n icmp-block-inversion: no\n interfaces: br-912c94593591\n sources:\n services:\n ports: 3306/tcp 6379/tcp\n protocols:\n masquerade: no\n forward-ports:\n source-ports:\n icmp-blocks:\n rich rules:","type":"text"}]}]},{"type":"paragraph","content":[{"text":"When using firewalld (in Red Hat based linux) the firewall zones that EA Deployer will use are configurable in the inventory using the following parameters:","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_fleet_firewall_zone","type":"text","marks":[{"type":"code"}]},{"text":". The zone name where the ","type":"text"},{"text":"Devo EA manager","type":"text","marks":[{"type":"em"}]},{"text":" listening port (by default, port 8080) will be attached, in the event that ","type":"text"},{"text":"firewalld","type":"text","marks":[{"type":"code"}]},{"text":" service is up and running. No network interface is added to this zone. Default value ","type":"text"},{"text":"public","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"deam_intsrv_firewall_zone","type":"text","marks":[{"type":"code"}]},{"text":". The zone name where the new docker network interface (For MySQL and REDIS) will be attached, in the event that ","type":"text"},{"text":"firewalld","type":"text","marks":[{"type":"code"}]},{"text":" service is up and running. The network interface that docker creates is added to this zone. Default value ","type":"text"},{"text":"trusted","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"dea_ap_firewall_zone","type":"text","marks":[{"type":"code"}]},{"text":". The zone name where the ","type":"text"},{"text":"Devo EA packager","type":"text","marks":[{"type":"em"}]},{"text":" repository listening port (by default, port 8081) will be attached, in the event that ","type":"text"},{"text":"firewalld","type":"text","marks":[{"type":"code"}]},{"text":" service is up and running. No network interface is added to this zone. Default value ","type":"text"},{"text":"public","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"If you do not want the EA deployer to make any configuration in the firewall, you can add the following variable in the inventory file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n firewall_configuration_disabled: true","type":"text"}]},{"type":"paragraph","content":[{"text":"When the variable ","type":"text"},{"text":"firewall_configuration_disabled","type":"text","marks":[{"type":"code"}]},{"text":" is true, no action is taken in the firewall configuration. You need to do firewall configuration manually to allow the service to operate correctly.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Endpoint Agent <> EA Manager communication","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Using FQDN","type":"text"}]},{"type":"paragraph","content":[{"text":"In case the system administrator does not want to rely on explicitly setting the IP address of the EAM servers in the configuration, hence easing the introduction of changes in the future, or if the EA Manager is going to be available on an open Internet environment, it is recommended to set the deployer to use an FQDN (","type":"text"},{"text":"Fully Qualified Domain Name","type":"text","marks":[{"type":"em"}]},{"text":") for endpoints <> manager connection. To do so, add a code section such as in the following example to the inventory file -only add the fields that are not already included:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all\n vars:\n deam_fqdnname: itops-devo-ea-public-pre-1902513970.eu-west-1.elb.amazonaws.com\n set_deam_fqdnname_as_hostname: false\n dea_ap_builder_update_etc_host: \"no\"","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_fqdnname","type":"text","marks":[{"type":"code"}]},{"text":": FQDN of the Devo EA Manager or the Load Balancer FQDN in the case of multiple EA Managers. Endpoints will use this FQDN to connect to the Devo EA Manager.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"set_deam_fqdnname_as_hostname","type":"text","marks":[{"type":"code"}]},{"text":": Set to ","type":"text"},{"text":"false","type":"text","marks":[{"type":"code"}]},{"text":" to avoid changing the EA Manager hostname to the value set in the above field.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"dea_ap_builder_update_etc_host","type":"text","marks":[{"type":"code"}]},{"text":": Set to ","type":"text"},{"text":"\"no\"","type":"text","marks":[{"type":"code"}]},{"text":" to instruct the endpoint installers to not modify the endpoint ","type":"text"},{"text":"hosts","type":"text","marks":[{"type":"code"}]},{"text":" file.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Using ","type":"text"},{"text":"hosts","type":"text","marks":[{"type":"em"}]},{"text":" File","type":"text"}]},{"type":"paragraph","content":[{"text":"A simpler approach to enable the communication between agents and the manager is through the modification of the agents' ","type":"text"},{"text":"/etc/hosts","type":"text","marks":[{"type":"code"}]},{"text":" file. ","type":"text"}]},{"type":"paragraph","content":[{"text":"The deployment script is pre-defined to enable this mechanism by default, so there is no specific configuration change needed to use it. ","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"EA Manager <> Devo communication","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Direct connectivity","type":"text"}]},{"type":"paragraph","content":[{"text":"This is the default scenario, where the EA Manager has direct connectivity to Devo. In this case, there is no need for any specific configuration as the installer should work as is.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Using a Devo Relay","type":"text"}]},{"type":"paragraph","content":[{"text":"In some cases, it is necessary to centralize all ingested traffic for a particular deployment, such as to enforce an extra level of security or isolation of the EA Manager.","type":"text"}]},{"type":"paragraph","content":[{"text":"Assuming that the ","type":"text"},{"text":"in-house","type":"text","marks":[{"type":"em"}]},{"text":" Relay’s IP is 192.168.43.147, we just need to configure ","type":"text"},{"text":"deam_relay_entrypoint: tcp://192.168.43.147:13000","type":"text","marks":[{"type":"code"}]},{"text":". We chose port number 13000 port because the Relay service is configured to listen to that port by default.","type":"text"},{"type":"hardBreak"},{"text":"Example snippet of inventory file based on that configuration:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n ...\n deam_relay_entrypoint: tcp://192.168.43.147:13000\n deam_devo_key: \"\"\n deam_devo_cert: \"\"\n deam_devo_chain: \"\"","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Other special deployment cases","type":"text"}]},{"type":"expand","attrs":{"title":"Using a proxy during the installation"},"content":[{"type":"paragraph","content":[{"text":"The Devo EA installation process requires access to the Internet in order to be successful. If the server does not have Internet access and requires a proxy to be able to communicate externally, use the following configurations:","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"These configurations are outside of the EA Manager product. The following instructions are provided as recommendations to the customer and may have high variability depending on the system and specific scenario.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Depending on the system being deployed, append the following two lines:","type":"text"}]},{"type":"codeBlock","content":[{"text":"export http_proxy=http://:\nexport https_proxy=http://:","type":"text"}]},{"type":"paragraph","content":[{"text":"In the corresponding file, depending on the Linux distribution the EA Manager will be installed on:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If using ","type":"text"},{"text":"root","type":"text","marks":[{"type":"code"}]},{"text":" user in Ubuntu distribution: ","type":"text"},{"text":"/etc/bash.bashrc","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If using a ","type":"text"},{"text":"sudoer","type":"text","marks":[{"type":"code"}]},{"text":" in Ubuntu distribution: ","type":"text"},{"text":"~/.bashrc","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"paragraph","content":[{"text":"Create dir ","type":"text"},{"text":"~/.ssh","type":"text","marks":[{"type":"code"}]},{"text":" and file ","type":"text"},{"text":"~/.ssh/environment","type":"text","marks":[{"type":"code"}]},{"text":" if they do not exist and append the following lines to the file ","type":"text"},{"text":"~/.ssh/environment","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"http_proxy=http://:\nhttps_proxy=http://:","type":"text"}]},{"type":"paragraph","content":[{"text":"Append the following line to the file ","type":"text"},{"text":"/etc/sudoers","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"Defaults env_keep = \"http_proxy https_proxy\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Append the following line to the file ","type":"text"},{"text":"/etc/ssh/sshd_config","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"PermitUserEnvironment=yes","type":"text"}]},{"type":"paragraph","content":[{"text":"Reload the ssh service: ","type":"text"},{"text":"sudo systemctl reload sshd","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"If you are using dockers in your deployment, you need to configure the docker daemon to use the proxy. Follow the steps in ","type":"text"},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.docker.com/config/daemon/systemd/#httphttps-proxy"}}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"Deployment in a server with no outbound traffic allowed"},"content":[{"type":"paragraph","content":[{"text":"In some cases, the Devo EA Manager may need to be deployed into a server with very limited outbound Internet connectivity. The following list is a compilation of outbound domains that would need to be specifically opened in the firewall so the Devo EA Deployer can be executed properly:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"a49279e9-6a65-43fb-b23f-a728bfcff60f"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"Domain/URL","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"Purpose","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"*.devo.com","type":"text"}]},{"type":"paragraph","content":[{"text":"*.logtrust.net","type":"text"}]},{"type":"paragraph","content":[{"text":"https://d2ur64jmn3k7yt.cloudfront.net","type":"text","marks":[{"type":"link","attrs":{"href":"https://d2ur64jmn3k7yt.cloudfront.net"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"Devo connectivity, software packages and extension binaries","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"https://pkg.osquery.io","type":"text","marks":[{"type":"link","attrs":{"href":"https://pkg.osquery.io"}}]}]},{"type":"paragraph","content":[{"text":"https://osquery-packages.s3","type":"text","marks":[{"type":"link","attrs":{"href":"https://osquery-packages.s3"}}]},{"text":".*.amazonaws.com","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"Used to download the upstream osquery software required to build the agent packages","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"*.fedoraproject.org","type":"text"}]},{"type":"paragraph","content":[{"text":"http://mirrors.kernel.org/fedora","type":"text","marks":[{"type":"link","attrs":{"href":"http://mirrors.kernel.org/fedora"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"EPEL repositories for Red Hat, Alma Linux and Amazon Linux 2 only","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Take into account that the mirror list is dynamic and the package manager will automatically choose the better one, usually based on location and availability so you may need to enable other mirrors based on your distribution.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"https://subscription.rhsm.redhat.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://subscription.rhsm.redhat.com"}}]}]},{"type":"paragraph","content":[{"text":"https://cdn.redhat.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://cdn.redhat.com"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"For Red Hat repositories","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Take into account that the mirror list is dynamic and the package manager will automatically choose the better one, usually based on location and availability so you may need to enable other mirrors based on your distribution.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"*.almalinux.org","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"For Alma Linux repositories","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Take into account that the mirror list is dynamic and the package manager will automatically choose the better one, usually based on location and availability so you may need to enable other mirrors based on your distribution.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"http://amazonlinux.default.amazonaws.com","type":"text"}]},{"type":"paragraph","content":[{"text":"https://cdn.amazonlinux.com","type":"text"}]},{"type":"paragraph","content":[{"text":"https://dl.fedoraproject.org","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"For Amazon Linux 2 repositories","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Take into account that the mirror list is dynamic and the package manager will automatically choose the better one, usually based on location and availability so you may need to enable other mirrors based on your distribution.","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"http://deb.debian.org","type":"text","marks":[{"type":"link","attrs":{"href":"http://deb.debian.org"}}]}]},{"type":"paragraph","content":[{"text":"http://security.debian.org","type":"text","marks":[{"type":"link","attrs":{"href":"http://security.debian.org"}}]}]},{"type":"paragraph","content":[{"text":"http://http.us.debian.org","type":"text","marks":[{"type":"link","attrs":{"href":"http://http.us.debian.org"}}]}]},{"type":"paragraph","content":[{"text":"https://launchpad.net","type":"text","marks":[{"type":"link","attrs":{"href":"https://launchpad.net"}}]}]},{"type":"paragraph","content":[{"text":"https://keyserver.ubuntu.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://keyserver.ubuntu.com"}}]}]},{"type":"paragraph","content":[{"text":"http://ppa.launchpad.net","type":"text","marks":[{"type":"link","attrs":{"href":"http://ppa.launchpad.net"}}]}]},{"type":"paragraph","content":[{"text":"http://archive.ubuntu.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://archive.ubuntu.com"}}]}]},{"type":"paragraph","content":[{"text":"http://security.ubuntu.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://security.ubuntu.com"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"For Ubuntu/Debian repositories","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"https://nginx.org","type":"text","marks":[{"type":"link","attrs":{"href":"https://nginx.org"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"For NGINX repositories","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"https://pypi.org","type":"text","marks":[{"type":"link","attrs":{"href":"https://pypi.org"}}]}]},{"type":"paragraph","content":[{"text":"https://pypi.python.org","type":"text","marks":[{"type":"link","attrs":{"href":"https://pypi.python.org"}}]}]},{"type":"paragraph","content":[{"text":"https://files.pythonhosted.org","type":"text","marks":[{"type":"link","attrs":{"href":"https://files.pythonhosted.org"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"The Python packages","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"https://galaxy.ansible.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://galaxy.ansible.com"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"Directory for Ansible galaxy","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[246.0]},"content":[{"type":"paragraph","content":[{"text":"https://github.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com"}}]}]},{"type":"paragraph","content":[{"text":"https://codeload.github.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://codeload.github.com"}}]}]},{"type":"paragraph","content":[{"text":"https://github-releases.githubusercontent.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://github-releases.githubusercontent.com"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph","content":[{"text":"Ansible roles","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[242.0]},"content":[{"type":"paragraph"}]}]}]}]},{"type":"expand","attrs":{"title":"URL/Domain required for dockerized services only"},"content":[{"type":"paragraph","content":[{"text":"There are other domains/URLs whose connection must be granted if the ","type":"text"},{"text":"dockerized","type":"text","marks":[{"type":"em"}]},{"text":" version of MySQL and Redis is configured (see ","type":"text"},{"text":"Using Deployer DB self-deployment","type":"text","marks":[{"type":"em"}]},{"text":" chapter below):","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"a7a4f7b9-b59a-45f2-8b94-9701c87f8b77"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[367.0]},"content":[{"type":"paragraph","content":[{"text":"Domain/URL","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Purpose","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[367.0]},"content":[{"type":"paragraph","content":[{"text":"https://download.docker.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://download.docker.com"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Docker software requirement","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[367.0]},"content":[{"type":"paragraph","content":[{"text":"https://auth.docker.io","type":"text","marks":[{"type":"link","attrs":{"href":"https://auth.docker.io"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Docker hub authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[367.0]},"content":[{"type":"paragraph","content":[{"text":"https://registry-1.docker.io","type":"text","marks":[{"type":"link","attrs":{"href":"https://registry-1.docker.io"}}]}]},{"type":"paragraph","content":[{"text":"https://index.docker.io","type":"text","marks":[{"type":"link","attrs":{"href":"https://index.docker.io"}}]}]},{"type":"paragraph","content":[{"text":"https://production.cloudflare.docker.com","type":"text","marks":[{"type":"link","attrs":{"href":"https://production.cloudflare.docker.com"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[363.0]},"content":[{"type":"paragraph","content":[{"text":"Docker images pulling","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"High availability configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Some deployment scenarios will require the deployment of more than one EA Manager to handle all traffic generated from the endpoints and to ensure high availability of the data processing and forwarding is observed. In this case, a specific configuration during the installation process is required to instruct the Devo EA Deployer to instantiate those roles.","type":"text"}]},{"type":"paragraph","content":[{"text":"*","type":"text"},{"text":"NOTE","type":"text","marks":[{"type":"strong"}]},{"text":": Devo EA Deployer will take care of deploying several EA Managers, but in order to provide a single entry point to the endpoints, it is required that you set up a Load Balancer separately.","type":"text"}]},{"type":"expand","attrs":{"title":"Load balancer requirements"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Load Balancer(s) should have 2 HTTPS listeners, in port 8080 and in port 8081, as there will be two different services. TCP listeners are not supported by the Devo EA Manager.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Load Balancer(s) should present the same certificate to the endpoints that the EA Manager is presenting. When using self-signed certificated created automatically by the deployer, the certificate can be found in ","type":"text"},{"text":"/etc/devo-ea-manager/certs","type":"text","marks":[{"type":"code"}]},{"text":" after the installation process is completed.","type":"text"}]}]}]}]},{"type":"expand","attrs":{"title":"Inventory file configuration"},"content":[{"type":"paragraph","content":[{"text":"To add a secondary Devo EA Manager, add a new host in the ","type":"text"},{"text":"all.hosts","type":"text","marks":[{"type":"code"}]},{"text":" section and instruct that the EA Manager role should be installed on it in the ","type":"text"},{"text":"children","type":"text","marks":[{"type":"code"}]},{"text":" section. See the following code snippet as an example:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n ...\n hosts:\n devo-ea-manager:\n ansible_host: 10.0.0.10\n ansible_user: install_user\n ansible_python_interpreter: /usr/bin/python2\n devo-ea-manager-2:\n ansible_host: 10.0.0.11\n ansible_user: install_user\n ansible_python_interpreter: /usr/bin/python2\n children:\n devoeamanagerserverone:\n hosts:\n devo-ea-manager:\n devoeamanagerreplicas:\n hosts:\n devo-ea-manager-2:\n vars:\n duem_am_i_replica: true\n ...","type":"text"}]},{"type":"paragraph","content":[{"text":"In the above example, two hosts are declared (","type":"text"},{"text":"devo-ea-manager","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"devo-ea-manager-2","type":"text","marks":[{"type":"code"}]},{"text":") in the ","type":"text"},{"text":"hosts","type":"text","marks":[{"type":"code"}]},{"text":" section. In the ","type":"text"},{"text":"children","type":"text","marks":[{"type":"code"}]},{"text":" section, the deployer is instructed to install the the EA Manager in ","type":"text"},{"text":"devo-ea-manager","type":"text","marks":[{"type":"code"}]},{"text":" and a replica in ","type":"text"},{"text":"devo-ea-manager-2","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"expand","attrs":{"title":"Agent download service replication"},"content":[{"type":"paragraph","content":[{"text":"To enable the secondary manager to also provide the Agents download service in port 8081, it is needed to instruct explicitly the Deployer to enable that option in the inventory file. See the following code snippet as an example:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all\n ...\n children:\n ...\n deaagentpackager:\n hosts:\n devo-ea-manager:\n devo-ea-manager-2:\n vars:\n devo_ea_manager_port: 443\n ...","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Databases installation","type":"text"}]},{"type":"paragraph","content":[{"text":"The EAM relies on MySQL and Redis for data persistence. There are several scenarios to consider depending on the type of installation required for a particular customer.","type":"text"}]},{"type":"paragraph","content":[{"text":"The next section summarizes the most common alternatives for the deployment of the databases, as well as the procedure to implement them:","type":"text"}]},{"type":"expand","attrs":{"title":"Using Deployer DB self-deployment"},"content":[{"type":"paragraph","content":[{"text":"The Deployer can install a dockerized version of MySQL and Redis on the same server as the EA Manager or on a different server.","type":"text"}]},{"type":"paragraph","content":[{"text":"The parameters that need to be configured for both databases are the following:","type":"text"}]},{"type":"codeBlock","content":[{"text":"deam_redis_address: 10.0.0.24:6379\ndeam_redis_password: password\ndeam_mysql_address: 10.0.0.60:3306\ndeam_mysql_database: databasename\ndeam_mysql_username: user\ndeam_mysql_password: password\ndeam_mysql_root_password: root_password","type":"text"}]},{"type":"paragraph","content":[{"text":"Mandatory parameters:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_redis_address","type":"text","marks":[{"type":"code"}]},{"text":" : IP and port of the server that will host Redis","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_address","type":"text","marks":[{"type":"code"}]},{"text":" : IP and port of the server that will host MySQL","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Optional parameters (if the following parameters are not included in the inventory file, the default value is used): ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_redis_password","type":"text","marks":[{"type":"code"}]},{"text":" : Password of the Redis instance, if it exists. In case Redis uses no password, set the value as ““. Default value: ““","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_database","type":"text","marks":[{"type":"code"}]},{"text":" : Name of the database to be used. Default value: devoea","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_username","type":"text","marks":[{"type":"code"}]},{"text":" : Name of the user to access database. Default value: devoea","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_password","type":"text","marks":[{"type":"code"}]},{"text":" : Password of the user to access database. Default value: insecure","type":"text"}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_root_password","type":"text","marks":[{"type":"code"}]},{"text":" : Password of the root (admin) user of the database service. Default value: toor","type":"text","marks":[{"type":"underline"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Standalone deployment"},"content":[{"type":"paragraph","content":[{"text":"If the database dockers are going to be installed in the same server as the EA Manager, the role ","type":"text"},{"text":"deamintsrvs","type":"text","marks":[{"type":"code"}]},{"text":" must be configured to be deployed to the ","type":"text"},{"text":"devo-ea-manager","type":"text","marks":[{"type":"code"}]},{"text":" host. ","type":"text"}]},{"type":"codeBlock","content":[{"text":" all:\n ...\n children:\n ... \n deamintsrvs:\n hosts:\n devo-ea-manager:","type":"text"}]},{"type":"paragraph","content":[{"text":"This snippet indicates that the role ","type":"text"},{"text":"deamintsrvs","type":"text","marks":[{"type":"code"}]},{"text":" (MySQL and Redis) will be deployed in the host ","type":"text"},{"text":"devo-ea-manager","type":"text","marks":[{"type":"code"}]},{"text":" which is defined as well in the inventory file. Check the example configuration files to get some ideas on how your inventory file should look like.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Distributed deployment"},"content":[{"type":"paragraph","content":[{"text":"If the databases are going to be installed on server other than the EA Manager, the role ","type":"text"},{"text":"deamintsrvs","type":"text","marks":[{"type":"code"}]},{"text":" should be configured to be deployed to a different host: ","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n ...\n hosts:\n devo-ea-manager:\n ...\n deam-int-services:\n ansible_host: 10.0.10.10\n ansible_user: ubuntu\n ansible_ssh_private_key_file: /path/to/private.key.pem\n ansible_python_interpreter: /usr/bin/python3\n children:\n ...\n deamintsrvs:\n hosts:\n deam-int-services:","type":"text"}]},{"type":"paragraph","content":[{"text":"In the example above, a new host is defined called ","type":"text"},{"text":"deam-int-services","type":"text","marks":[{"type":"code"}]},{"text":" and the deployer is instructed to install the database services on it. The host information is included inside the ","type":"text"},{"text":"all.hosts","type":"text","marks":[{"type":"code"}]},{"text":" tag, so the deployer will know where and how to connect to the new server.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"In distributed deployments, it is important to make sure all necessary configurations to enable visibility between services is done beforehand, such as enabling traffic through the designated ports in any intermediary firewalls.","type":"text"}]}]}]},{"type":"expand","attrs":{"title":"Using existing databases"},"content":[{"type":"paragraph","content":[{"text":"Devo Endpoint Agent Deployer allows the option to use existing deployments of MySQL and Redis. This solution should be observed to enable full HA scenarios.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Prepare the MySQL database"},"content":[{"type":"paragraph","content":[{"text":"When using an existing MySQL database, you must manually create the database structures and the credentials that the EA Manager will use to interact with it.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access the MySQL instance with root credentials (or create database privilege granted): ","type":"text"},{"text":"mysql -uuser -ppasword","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create the database to be used by EA Manager (the database name can be changed, deamDB is just an example): ","type":"text"},{"text":"CREATE DATABASE deamDB;","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Grant ALL PRIVILEGES over the database to the user that DEAM will use (both username and password can be changed, the following is just an example):","type":"text"},{"text":"GRANT ALL PRIVILEGES ON deamDB.* TO 'deamUser'@'%' IDENTIFIED BY 'deamPassword';","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Prepare the Redis database"},"content":[{"type":"paragraph","content":[{"text":"No specific configurations in Redis are required other than having full accessibility to the database and valid credentials (password) to access it.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Prepare the EA Deployer"},"content":[{"type":"paragraph","content":[{"text":"The parameters that control the DB deployment in Devo EA Deployer are the following:","type":"text"}]},{"type":"codeBlock","content":[{"text":"deam_redis_address: 10.0.0.24:6379\ndeam_redis_password: password\ndeam_mysql_address: 10.0.0.60:3306\ndeam_mysql_database: databasename\ndeam_mysql_username: user\ndeam_mysql_password: password","type":"text"}]},{"type":"paragraph","content":[{"text":"Mandatory parameters:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_redis_address","type":"text","marks":[{"type":"code"}]},{"text":" : VIP and port of Redis instance/cluster.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_address","type":"text","marks":[{"type":"code"}]},{"text":" : VIP and port of MySQL instance/cluster.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_redis_password","type":"text","marks":[{"type":"code"}]},{"text":" : Password of the Redis instance, if it exists. In case Redis doesn’t use a password, input ““. (","type":"text"},{"text":"NOTE","type":"text","marks":[{"type":"strong"}]},{"text":": REDIS password cannot be set when creating a docker for the first time. It needs to be set by the user, and then included here to connect to the database).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_database","type":"text","marks":[{"type":"code"}]},{"text":" : Name of the database to be used.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_username","type":"text","marks":[{"type":"code"}]},{"text":" : Name of the user to access database.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"deam_mysql_password","type":"text","marks":[{"type":"code"}]},{"text":" : Password of the user to access database.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"When an existing database is used, make sure you remove the ","type":"text"},{"text":"deamintsrvs","type":"text","marks":[{"type":"code"}]},{"text":" from the installation plan in the inventory file. This will instruct the deployer to not deploy any database automatically. If a snippet like the following exists in the inventory file inside ","type":"text"},{"text":"all.children","type":"text","marks":[{"type":"code"}]},{"text":" tag, remove it:","type":"text"}]},{"type":"codeBlock","content":[{"text":"deamintsrvs:\n hosts:\n devo-ea-manager:","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Devo EA Manager users and passwords","type":"text"}]},{"type":"paragraph","content":[{"text":"After a successful deployment of Devo EA Manager, it will create two services that require authentication. User and password can be configured to include your own passwords. If these parameters are not included in the inventory file, default values are used.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"From EA 1.3 onwards, login the platform is done using ","type":"text"},{"text":"deam_admin_email","type":"text","marks":[{"type":"code"}]},{"text":" instead of ","type":"text"},{"text":"deam_admin_username","type":"text","marks":[{"type":"code"}]}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Devo EA Manager Web Interface (port 8080): To control the user and password for this service, the following parameters can be used in the inventory file:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"#deam_admin_email: _Devo EA manager_ username for initial admin user setup. Default value: `admin`\ndeam_admin_email: no-reply@localhost.local\n#deam_admin_username: _Devo EA manager_ username for initial admin user setup. Default value: `admin`\ndeam_admin_username: admin\n#deam_admin_passwd: _Devo EA manager_ password for initial admin user setup. Default value: `Th3Adm1n!`\ndeam_admin_passwd: Th3Adm1n!","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Devo Endpoint Agent download (port 8081): To control the user and password for this service, the following parameters can be used in the inventory file:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"#dea_ap_repo_user: Username required by _Devo EA packager_ repository for basic authentication. Default value `dea-agent`\ndea_ap_repo_user: dea-agent\n#dea_ap_repo_passwd: Password required by _Devo EA packager_ repository for basic authentication. Default value `Th3Ag3nt!`\ndea_ap_repo_passwd: Th3Ag3nt!","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Certificates","type":"text"}]},{"type":"paragraph","content":[{"text":"The Devo EA Deployer is configured to generate self-signed certificates and configure them by default but you can configure EA Deployer to use your own certificates. ","type":"text"}]},{"type":"paragraph","content":[{"text":"It is recommended to use ECDSA certificates instead of RSA as TLS decryption in the EA Manager side is smoother and increases the performance significantly. The EA Deployer will generate ECDSA certificates by default when using self-generated certificates.","type":"text"}]},{"type":"expand","attrs":{"title":"Using self-signed certificates"},"content":[{"type":"paragraph","content":[{"text":"The Devo EA Deployer is configured to generate self-signed certificates and configure them by default.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Using your own certificates"},"content":[{"type":"paragraph","content":[{"text":"You can provide your own key/certificate when you deploy EA Manager using Devo EA Deployer. ","type":"text"}]},{"type":"paragraph","content":[{"text":"To do this, replace ","type":"text"},{"text":"selfsigenedcertificates","type":"text","marks":[{"type":"code"}]},{"text":" section with ","type":"text"},{"text":"providedcertificates","type":"text","marks":[{"type":"code"}]},{"text":" in the inventory file (at same yaml level). ","type":"text"},{"text":"Only one of these sections can be present in the inventory file.","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Inventory file with self-signed certificates generation:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":" selfsigenedcertificates: # Alternative providedcertificates\n hosts:\n devo-ea-manager:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Inventory file with provided certificates:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":" providedcertificates:\n hosts:\n devo-ea-manager:","type":"text"}]},{"type":"paragraph","content":[{"text":"Save your ","type":"text"},{"text":"devo-ea-manager.key","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"devo-ea-manager.crt","type":"text","marks":[{"type":"code"}]},{"text":" files in ","type":"text"},{"text":"$HOME/devo-ea-deployer/provided-deam-certs","type":"text","marks":[{"type":"code"}]},{"text":" path. Provided certs must match with entrypoint used by DEA agents to connect with EA Manager.","type":"text"}]}]},{"type":"expand","attrs":{"title":"NGINX Custom certificates (only from 1.2.1)"},"content":[{"type":"paragraph","content":[{"text":"It is possible to also provide custom certificates to the NGINX server which is in charge of providing a repository for the Endpoint Agents generated at deployment time.","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to do so, add the following variables to your inventory file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n ...\n dea_ap_repo_fqdn_name: << REPO_FQDN_NAME >>\n dea_ap_repo_provided_certs: true ","type":"text"}]},{"type":"paragraph","content":[{"text":"Where << REPO_FQDN_NAME >> is the FQDN of the NGINX server and the FQDN that is trusted by the custom certificates. Expected local path for source certificates is ","type":"text"},{"text":"$HOME/devo-ea-deployer/provided-deam-certs/REPO_FQDN_NAME.{crt,key}","type":"text","marks":[{"type":"code"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Appendix A - Example inventory files","type":"text"}]},{"type":"expand","attrs":{"title":"Full high-availability installation example"},"content":[{"type":"paragraph","content":[{"text":"The following code shows a deployment inventory file that enables the installation of two Devo EA Managers, with customized usernames and passwords, and leveraging on an existing MySQL and Redis deployment (e.g., customer-provided). Endpoints connectivity is enabled via FQDN:","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n #deam_fqdnname: Put the Load Balancer FQDN here. This FQDN will be used by the endpoints to reach the EA Manager\n deam_fqdnname: loadbalancer_fqdn.com\n set_deam_fqdnname_as_hostname: false\n dea_ap_builder_update_etc_host: \"no\"\n #deam_redis_address: Input here the VIP and port for the Redis cluster\n deam_redis_address: 10.0.0.24:6379\n #deam_redis_password: Redis service password. If there is no password, input \"\"\n deam_redis_password: password\n #deam_mysql_address: Input here the VIP and port for the MySQL cluster\n deam_mysql_address: 10.0.0.60:3306\n #deam_mysql_database: Input here the database name\n deam_mysql_database: databasename\n #deam_mysql_username: MySQL user name. User must have enough permissions to create schema, tables, views, etc.\n deam_mysql_username: user\n #deam_mysql_password: MySQL password\n deam_mysql_password: password\n deam_relay_entrypoint: tcp://collector-us.devo.io:443\n #deam_admin_email: _Devo EA manager_ username for initial admin user setup. Default value: `admin`\n deam_admin_email: no-reply@localhost.local\n #deam_admin_username: _Devo EA manager_ username for initial admin user setup. Default value: `admin`\n deam_admin_username: admin\n #deam_admin_passwd: _Devo EA manager_ password for initial admin user setup. Default value: `Th3Adm1n!`\n deam_admin_passwd: Th3Adm1n!\n #dea_ap_repo_user: Username required by _Devo EA packager_ repository for basic authentication. Default value `dea-agent`\n dea_ap_repo_user: dea-agent\n #dea_ap_repo_passwd: Password required by _Devo EA packager_ repository for basic authentication. Default value `Th3Ag3nt!`\n dea_ap_repo_passwd: Th3Ag3nt!\n\n hosts:\n #ansible_host: Input IP for Devo EA Manager 1. Can be private, the IP from where the deployer is going to SSH the server for installation tasks.\n #ansible_user: SSH user to perform installation tasks\n #Depending on the type of SSH user used for the instalation, uncomment the proper lines in each host and fill a value:\n #ansible_ssh_pass: Password for the SSH user\n #ansible_ssh_private_key_file: Private key path to the used PEM file if not using password\n # Only required if you connect with password\n #ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n devo-ea-manager:\n ansible_host: 10.0.0.10\n ansible_user: install_user\n #ansible_ssh_pass:\n #ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n #ansible_ssh_private_key_file:\n ansible_python_interpreter: /usr/bin/python2\n devo-ea-manager-2:\n ansible_host: 10.0.0.11\n ansible_user: install_user\n #ansible_ssh_pass:\n #ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n #ansible_ssh_private_key_file:\n ansible_python_interpreter: /usr/bin/python2\n children:\n devoeamanagerserverone:\n hosts:\n devo-ea-manager:\n devoeamanagerreplicas:\n hosts:\n devo-ea-manager-2:\n vars:\n deam_am_i_replica: true\n deaagentpackager:\n hosts:\n devo-ea-manager:\n devo-ea-manager-2:\n vars:\n devo_ea_manager_port: 443\n selfsigenedcertificates: # Alternative providedcertificates\n hosts:\n devo-ea-manager:\n vars:\n SAN_extensions:\n - DNS: loadbalancer_fqdn.com ","type":"text"}]}]},{"type":"expand","attrs":{"title":"Standalone installation example"},"content":[{"type":"paragraph","content":[{"text":"The following code shows a deployment inventory file that enables an AIO (All In One) deployment. Everything is automatically deployed in the same server, including 2 dockers running the database services. Endpoints connectivity is enabled via ","type":"text"},{"text":"hosts","type":"text","marks":[{"type":"em"}]},{"text":" file.","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n deam_fqdnname: devo-ea-manager\n deam_redis_address: localhost:6379\n deam_mysql_address: localhost:3306\n #deam_admin_email: _Devo EA manager_ username for initial admin user setup. Default value: `admin`\n deam_admin_email: no-reply@localhost.local\n #deam_admin_username: _Devo EA manager_ username for initial admin user setup. Default value: `admin`\n deam_admin_username: admin\n #deam_admin_passwd: _Devo EA manager_ password for initial admin user setup. Default value: `Th3Adm1n!`\n deam_admin_passwd: Th3Adm1n!\n deam_relay_entrypoint: tcp://collector-us.devo.io:443\n hosts:\n devo-ea-manager:\n # Set ansible_host your public ip used to conncet from ansbile and devo-ea agents\n ansible_host: 192.168.57.5\n ansible_user: user\n ansible_ssh_pass: pass\n # Only required if you connect with password\n ansible_ssh_common_args: '-o StrictHostKeyChecking=no'\n # python3 required for Ubuntu 18 ansible-playbooks\n ansible_python_interpreter: /usr/bin/python3\n children:\n devoeamanagerserverone:\n hosts:\n devo-ea-manager:\n deamintsrvs:\n hosts:\n devo-ea-manager:\n deaagentpackager:\n hosts:\n devo-ea-manager:\n selfsigenedcertificates: # Alternative providedcertificates\n hosts:\n devo-ea-manager:\n vars:\n SAN_extensions:\n - DNS: devo-ea-manager\n devoeaagents:\n hosts: ","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Appendix B - Security Recommendations","type":"text"}]},{"type":"paragraph","content":[{"text":"EA Manager deployment will not modify any configuration present on the system as it is the responsibility of a system administrator to have the system hardened following their company’s policies. ","type":"text"}]},{"type":"paragraph","content":[{"text":"However, since the EA Manager will be an element present there are several recommended good practices that can be followed at your discretion:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ensure following directives are included in ","type":"text"},{"text":"sshd_config","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"X11Forwarding no\nIgnoreRhosts yes\nPermitEmptyPasswords no\nMaxAuthTries 3\nPermitRootLogin no\nProtocol 2\nPermitTunnel no\nPasswordAuthentication no","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restrict access to connections coming from certain ips using certain users, even including password authentication, but only from trusted origins, for example:","type":"text"}]}]}]},{"type":"codeBlock","content":[{"text":"PasswordAuthentication no \nAllowUsers user1@ip1 user1@ip2 user2@ip3 ... \nMatch User XXX Address XXX.XXX.XXX.XXX \n PasswordAuthentication yes PermitTunnel yes","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create unique users associated to a certain person and avoid usage of generic users with shared keys.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Linux hosts: Creation of a separate partition for containers:","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Security considerations regarding docker data storage are taken into account when it comes to the deployment of MySQL and Redis services. The Endpoint Agent Manager offers such deployment. ","type":"text"}]},{"type":"paragraph","content":[{"text":"All Docker containers along with their data and metadata is stored under the ","type":"text"},{"text":"/var/lib/docker","type":"text","marks":[{"type":"code"}]},{"text":" directory. The ","type":"text"},{"text":"/var/lib/docker","type":"text","marks":[{"type":"code"}]},{"text":" should be mounted under either the ","type":"text"},{"text":"/","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"/var","type":"text","marks":[{"type":"code"}]},{"text":" partitions, depending on how the Linux operating system in use is configured.","type":"text"}]},{"type":"paragraph","content":[{"text":"CIS Docker Benchmark v1.3.1 guidelines for Linux specifies that, in order to follow best practices, a separate partition for the ","type":"text"},{"text":"/var/lib/docker","type":"text","marks":[{"type":"code"}]},{"text":" mount point should exist in order to preserve system stability in case the directory fills up. This partitioning can be performed when installing the system, using the Logical Volume Manager (LVM) within Linux, or by any other means.","type":"text"}]},{"type":"paragraph","content":[{"text":"CIS proposes ","type":"text"},{"text":"this documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://projectatomic.io/docs/docker-storage-recommendation/"}}]},{"text":" for creating partitions on already-installed systems.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Appendix C - Python Interpreter Pre-steps in Amazon Linux 2","type":"text"}]},{"type":"paragraph","content":[{"text":"Some images of Amazon Linux 2 come with ","type":"text"},{"text":"python3","type":"text","marks":[{"type":"code"}]},{"text":" pre-installed. Ansible 2.9 installed on a virtual environment by ","type":"text"},{"text":"getansible-venv.sh","type":"text","marks":[{"type":"code"}]},{"text":" is incompatible with ","type":"text"},{"text":"python3","type":"text","marks":[{"type":"code"}]},{"text":" in Amazon Linux hosts. The solution is to remove ","type":"text"},{"text":"python3","type":"text","marks":[{"type":"code"}]},{"text":" from the host.","type":"text"}]},{"type":"paragraph","content":[{"text":"Check if ","type":"text"},{"text":"python3","type":"text","marks":[{"type":"code"}]},{"text":" is installed with the command:","type":"text"}]},{"type":"codeBlock","content":[{"text":"python3 --version","type":"text"}]},{"type":"paragraph","content":[{"text":"If this command returns the python version, for example:","type":"text"}]},{"type":"codeBlock","content":[{"text":"Python 3.8.10","type":"text"}]},{"type":"paragraph","content":[{"text":"It must be unninstalled by running the command:","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo yum remove python3","type":"text"}]}],"version":1}

Browser not supported