• Deployment

Setting up PrivX Components

This article describes setting up and maintaining PrivX components.

To get started with PrivX, you will need to set up at least one PrivX server.

PrivX-Server Setup

PrivX servers provide PrivX services, such as the PrivX GUI and certificate-based authentication services.

Before installing PrivX, please update your host to ensure the latest packages:

yum update

If your system uses dnf instead of yum to manage packages, run:

dnf update

To set up a PrivX server:

  1. Set up repositories for downloading PrivX packages and dependencies.

    • On Red Hat/Rocky Linux 9:

      yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
yum install postgresql-server # or postgresql if using an external DB
yum install firewalld
rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
curl https://product-repository.ssh.com/rhel9/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo

    • On Red Hat/Rocky Linux 8:

      yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
yum install epel-release
yum install firewalld
dnf module enable postgresql:16
yum install postgresql-server # or postgresql if using external DB
rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
curl https://product-repository.ssh.com/rhel8/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo

    • On Amazon Linux 2023:

      dnf install postgresql15-server # or postgresql15 if using external DB
dnf install libxcrypt-compat firewalld
rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
curl https://product-repository.ssh.com/rhel8/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo

    • On Amazon Linux 2:

      amazon-linux-extras install -y nginx1 epel
amazon-linux-extras enable postgresql14
yum install postgresql-server # or postgresql if using an external DB
yum install firewalld
rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
curl https://product-repository.ssh.com/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo

  2. Install the latest PrivX packages with:

    yum install PrivX

    The PrivX application binaries are saved to the /opt/privx/bin/ directory. Configuration files are located in /opt/privx/etc/, and utility scripts can be found in /opt/privx/scripts/.

  3. To automate PrivX configuration, you may define post-installation settings using environment variables. The post-installation script will skip any prompts for values that are already set via environment variables.

    A list of supported environment variables is available at /opt/privx/scripts/postinstall_env.

    To export the variables, run:

    source /opt/privx/scripts/postinstall_env

  4. Run the post-installation script to configure the server:

    /opt/privx/scripts/postinstall.sh

    Unless defined via environment variables, the post-installation script will prompt you for the following settings:

    • PKCS#11 key vault settings: Enable and configure this only if using an external Hardware Security Module (HSM). For detailed instructions, refer to the HSM setup articles.
    • Number of load balancers in front of PrivX servers: Set to 0 for single-server deployments.
    • NTP server address: Used for time synchronization.
    • DNS and IP address(es) of the server.
    • External database settings (if applicable):
      • Database address (IP or FQDN), e.g., database.example.com
      • Arbitrary name for the PrivX database
      • Arbitrary username and password for the PrivX database user
      • Password for the PostgreSQL postgres user
      • Notification back-end: select the existing PostgreSQL database
    • Initial superuser credentials: Required to create the first admin account.

    If you encounter an "unable to open pg_trgm.control" error, ensure that the pg_trgm PostgreSQL extension is installed. Learn more here.

  5. Install the PrivX license to enable product functionality.

    Open your browser and navigate to the PrivX web interface (replace privx.example.com with your server's FQDN or IP address) at https://privx.example.com/.

    Log in using your superuser credentials.

    In the PrivX UI, go to Settings→License. Under Online license update, enter your license code and click Update. PrivX will automatically contact the license server to retrieve and apply your license. Make sure your system clock is correctly set to allow license activation.

    For more details on license types and activation management, see License Management.

    PrivX licenses allow a limited number of activations. If you deactivate any PrivX server, be sure to release the license activation according to the instructions in License Management.

    Without a valid license, PrivX will not allow you to add hosts or establish SSH, RDP, or Web connections.

You have now successfully set up a PrivX server.

To verify that all PrivX microservices are running correctly, visit the status page (replace privx.example.com with your server's FQDN or IP address):

https://privx.example.com/status.html

To prevent unintentional PrivX upgrades, you can disable the PrivX repository until you are ready to update. For instructions, see Disable PrivX Repository.

In large-scale deployments, PrivX can generate substantial log data. To avoid running out of disk space, we recommend configuring log rotation for both syslog and PrivX microservice logs.

You can also set up Disk-Space Alerts to be automatically notified when disk usage becomes critical on PrivX servers or components.

Manual PrivX package installation

Instead of installing PrivX packages from the SSH product repository, you may install the PrivX package manually as follows:

  1. Obtain the PrivX RPM package. The package should be named PrivX-***.x86_64.rpm, where *** represents the product version.

  2. Copy the PrivX RPM file to the target server.

  3. Install the PrivX package (replace PrivX-***.x86_64.rpm with the name of your RPM file):

    yum install PrivX-***.x86_64.rpm

Setting Up Optional Components

This section provides setup instructions for optional PrivX components.

PrivX Extender Setup

PrivX Extenders relay host connections, allowing connections to target hosts that are inaccessible from PrivX servers.

To set up PrivX Extender:

  1. Obtain an Extender configuration. Either:

    • Create a new Extender configuration, or
    • Download an existing Extender configuration.

    You can create and download Extender configurations via the PrivX GUI at Administration→Deployment→Deploy PrivX VPC/VPN Extenders.

    In Extender configurations, Addresses and Subnets should only be set after you have verified successful connections via the Extender.

    If you plan to set up multiple Extenders for high-availability (HA), identify the HA clusters using the Routing prefix as described in High-Availability Deployment.

  2. Install the PrivX Extender software on the Extender host in either of the following ways:
    Install from the SSH product repository. To do this, set up the repository and install the software package:

    • On Amazon Linux 2:

      sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install firewalld
sudo yum install PrivX-Extender

    • On Red Hat or Rocky Linux 8:

      sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/rhel8/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install firewalld
sudo yum install PrivX-Extender

    • On Red Hat or Rocky Linux 9:

      sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/rhel9/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install firewalld
sudo yum install PrivX-Extender

    • Alternatively, you may manually obtain the RPM. To do this, go to Settings→Deployment→Deploy PrivX VPC/VPN Extenders and click Download PrivX Extender. Then copy the rpm to the Extender host and install it with (replace /path/to/PrivX-Extender.*.rpm with the path to which you placed the Extender package):

      yum install /path/to/PrivX-Extender-*.rpm

  3. Save the Extender configuration to the following path on the Extender host:
    /opt/privx/etc/extender-config.toml

  4. Run postinstall to complete the setup:

    sudo /opt/privx/scripts/extender-postinstall.sh

    The PrivX Extender is now set up. You may verify back on the Settings→Deployment→Deploy PrivX VPC/VPN Extenders page that the Status is Registered.

    If the Extender failed to register to PrivX, you may find additional troubleshooting information from the Extender host at /var/log/privx/privx-extender.log

  5. Configure the target host(s) for access via Extenders. For more information about accessing targets via Extenders, see the section called "Proxying Connections to Hosts".

PrivX Carrier and Web Proxy Setup

This section provides setup instructions for PrivX Carriers and Web Proxies, which allow connecting to HTTP/HTTPS targets. The high-level workflow involves:

  1. Create or download a web-access-gateway configuration.
  2. Set up a PrivX Carrier.
  3. Set up a PrivX Web Proxy.

For best system security, you should set up Carrier and Web-Proxy components on separate hosts.

To Create and Download Carrier/Web-Proxy Configurations

  1. In the PrivX GUI navigate to Settings→Deployment→Deploy PrivX web-access gateways.

  2. Obtain a web-access-gateway configuration. Either:

    • Create a new configuration, or
    • Download an existing configuration.

    You can create and download Extender configurations via the PrivX GUI at Administration→Deployment→Deploy PrivX web-access gateways.

    In web-access-gateway configurations, Addresses and Subnets should only be set after you have verified successful connections via the Carrier and Web Proxy.

    If you plan to set up multiple Carriers and Web Proxies for high-availability (HA), identify the HA clusters using the Routing prefix as described in High-Availability Deployment.

    The Web Proxy address must be a valid IP or DNS address without schema headers and port numbers, pointing to the address of the server where the Web Proxy will be installed to. Loopback addresses are not allowed.

  3. Download the configurations (required later for setting up Carriers and Web Proxies). To do this, click next to your configuration, then click Download Carrier Config and Download Proxy Config.

To Set Up a PrivX Carrier

  1. Install the prerequisites and the Carrier package:

    • On Red Hat 9 or Rocky Linux 9:

      sudo yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
sudo yum install docker-ce
sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/rhel9/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install PrivX-Carrier

    • On Red Hat 8 or Rocky Linux 8:

      sudo yum config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo
sudo yum install docker-ce
sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/rhel8/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install PrivX-Carrier

    • On Amazon Linux 2:

      sudo yum install docker
sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install PrivX-Carrier

    • On Amazon Linux 2023:

      sudo yum install docker
sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/rhel8/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install PrivX-Carrier

You may install the Carrier package via RPM obtained from Get PrivX software (instead of SSH repositories). This can be useful in environments without Internet access. Note that you will still need to install the prerequisites first.

If you are upgrading from Carrier 34 or older version and want to switch Docker to Podman, you can do this by deleting the privx user on the Carrier host first. After that, follow the regular install procedure and run carrier-postinstall.sh afterwards.

  1. Copy your Carrier-configuration file to your Carrier machine, to the following path:
    /opt/privx/etc/carrier-config.toml

  2. To finalize setup and register the Carrier with PrivX, run:

    sudo /opt/privx/scripts/carrier-postinstall.sh

The Carrier machine must be able to connect to port 443 on the PrivX server.

To Set Up a PrivX Web Proxy

  1. Install prerequisites and the Web Proxy package:

    • On Red Hat 9 or Rocky Linux 9:

      sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm
sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/rhel9/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install firewalld
sudo yum install PrivX-Web-Proxy

    • On Red Hat 8 or Rocky Linux 8:

      sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/rhel8/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install firewalld
sudo yum install PrivX-Web-Proxy

    • On Amazon Linux 2:

      sudo amazon-linux-extras install -y epel
sudo rpm --import https://product-repository.ssh.com/info.fi-ssh.com-pubkey.asc
sudo curl https://product-repository.ssh.com/ssh-products.repo -o /etc/yum.repos.d/ssh-products.repo
sudo yum install firewalld
sudo yum install PrivX-Web-Proxy

    You may install the Web-Proxy package via RPM obtained from Get PrivX software (instead of SSH repositories). This can be useful in environments without Internet access. Note that you will still need to install the prerequisites first.

  2. Copy the Web-Proxy configuration file to the machine, to the following location:
    /opt/privx/etc/web-proxy-config.toml

  3. Allow the Carrier host to access the Web-Proxy host (ports 18080, 18443 and 18444):

    sudo firewall-cmd --permanent --add-port=18080/tcp
sudo firewall-cmd --permanent --add-port=18443/tcp
sudo firewall-cmd --permanent --add-port=18444/tcp
sudo firewall-cmd --reload

  4. To finalize setup and register the Web Proxy with PrivX, run:

    sudo /opt/privx/scripts/web-proxy-postinstall.sh

Make sure the Web-Proxy host is able to connect to port 443 on the PrivX server. The host running the PrivX Carrier must also be able to connect to ports 18080 and 18443 on the Web-Proxy host.

After you have the required Carrier and Web-Proxy components, add target websites as known targets. To do this, go to Settings→Hosts and Add hosts with Web-type services. For more information about configuring Web-type services, see Web Targets.

For advanced configuration of PrivX Carrier and Web Proxy components, see Setting up PrivX Components.

PrivX-Agent Setup

This section provides instructions for installing PrivX agents, which allow PrivX users to connect using SSH native clients.

Unix setup

To set up native clients against PrivX for a user on a Unix workstation:

  1. Obtain the PrivX-agent software, available from Get PrivX software.
    Save the Agents.zip package to the workstation.

  2. Extract and install the PrivX agents to the workstation. For example (replace Agents.zip with the path to the agent-software package):

    unzip -j Agents.zip linux-amd64/privx-* -d /usr/local/bin/

    The example command installs the PrivX agent, and the agent utility to:
    /usr/local/bin/privx-agent-unix
    /usr/local/bin/privx-agent-ctl
    The following steps assume the PrivX agent and the agent utility to be in these locations.

  3. Enable PrivX agent to start automatically when the user logs into the workstation. You can do this by appending the following to the users' .profile file:

    # Start PrivX Agent unless there is already an ssh-agent running                                                          
START_PRIVX_AGENT="yes"                                                                                                   
PRIVX_AGENT_UNIX="/usr/local/bin/privx-agent-unix"                                                                        
if [ -n "$START_PRIVX_AGENT" ] && [ -z "$SSH_AUTH_SOCK" ] && \
[ -x "$PRIVX_AGENT_UNIX" ]; then                             
    PRIVX_AGENT_DIR=`mktemp -d /tmp/ssh-XXXXXXXX 2>/dev/null || \
    mktemp -d -t 'mytmpdir'`                                                     
    export PRIVX_AUTH_SOCK="$PRIVX_AGENT_DIR/agent.$$"                                                                                      
    setsid nohup $PRIVX_AGENT_UNIX -a $PRIVX_AUTH_SOCK \
    -config $HOME/.privx/agent.json > /dev/null 2>&1 &                       
    export PRIVX_AGENT_PID=$!                                                                                                                  
    export SSH_AUTH_SOCK="$PRIVX_AUTH_SOCK"                                                                                                    
    export SSH_AGENT_PID="$PRIVX_AGENT_PID"                                                                                                    
    trap 'test -n "$SSH_AGENT_PID" && kill $SSH_AGENT_PID' 0                                                                                   
fi

    The provided example commands for agent startup are not run if another application sets the SSH_AUTH_SOCK variable (such as a default ssh agent), nor if the PrivX agent is installed to a custom location. You may have to adjust the agent-startup conditions to suit your environment.

    The temporary-directory path /tmp/ssh-XXXXXXXX is used by the agent. Do not change this path.

  4. Add PrivX servers to the agent. To do this, log in to the workstation as the user who will be using native clients (in order to start the agent), then run the following (replace https://privx.example.com with the address of your PrivX server):

    privx-agent-ctl server probe https://privx.example.com

    Unless the PrivX server certificate is trusted on the workstation, you will be presented with additional information, such as the SHA checksums of the certificate.

    PrivX server 'https://privx.example.com' certificate is untrusted
Server TLS certificate:
Issuer        DC=com, DC=ssh, DC=fi, DC=hel, OU=QA, CN=MSCA-PKI-TEST2-ROOT-CA
Subject       OU=PrivX Web Server, CN=privx.hel.fi.ssh.com
Serial        2453081971937566630710942289116460769316175891
Not Before    2018-03-28 09:00:15 +0000 UTC
Not After     2028-03-28 09:10:15 +0000 UTC
Fingerprints
    SHA1        B5 F3 70 E2 DB 61 56 D9 AC AE 03 4D AE DC 01 4C FB D2 AB C0
    SHA256      17 22 63 69 D1 AA 77 34 96 BD B7 90 69 83 E7 30 97 A2 78 10 \
                73 5C 93 D0 D6 01 99 5C 04 C5 55 B2

Would you like to add this server to trusted servers? Y/N:

    You may ensure that these match to the checksums of the PrivX server certificate, which you can obtain by running the following on the PrivX server:

    openssl x509 -noout -fingerprint -sha1 -in /etc/nginx/ssl/nginx.crt
openssl x509 -noout -fingerprint -sha256 -in /etc/nginx/ssl/nginx.crt

    Once you have confirmed the server identity, enter Y to add the PrivX server.

  5. You may verify setup by running:

    privx-agent-ctl status

PrivX SSH Agent Status
PrivX Server          https://privx.example.com
Login status          logged out

MacOS setup

To set up native clients against PrivX for a user on a MacOS workstation:

  1. Obtain the PrivX-agent software, available from Get PrivX software.
    Save the Agents.zip package to the workstation.

  2. Extract and install the PrivX agents to the workstation. For example (replace Agents.zip with the path to the agent-software package):

    unzip Agents.zip darwin-amd64/*
cp darwin-amd64/privx-agent-unix /usr/local/bin/
cp darwin-amd64/privx-agent-ctl /usr/local/bin/
cp darwin-amd64/privx-agent-start.sh /usr/local/bin/

    The example commands install the PrivX agent, the agent utility, and the agent-startup script to:
    /usr/local/bin/privx-agent-unix
    /usr/local/bin/privx-agent-ctl
    /usr/local/bin/privx-agent-start.sh
    The following steps assume the PrivX agent, the agent utility, and the agent-startup script to be in these locations.

  3. Enable PrivX agent to start automatically when the user logs into the workstation. To do this, first install the agent launcher with:

    cp darwin-amd64/com.privxagent.plist ~/Library/LaunchAgents/
launchctl load -w ~/Library/LaunchAgents/com.privxagent.plist
launchctl start ~/Library/LaunchAgents/com.privxagent.plist

    Also append the following to the users' .bash_profile file:

    # Register SSH_AUTH_SOCK & SSH_AGENT_PID to local environment
# if started by Launchd
if sock=$(launchctl getenv SSH_AUTH_SOCK); then
    export SSH_AUTH_SOCK=$sock
fi

if pid=$(launchctl getenv SSH_AGENT_PID); then
    export SSH_AGENT_PID=$pid
fi

    Alternatively, users may manually start the PrivX agent with:

    ./privx-agent-unix bash

  4. Add PrivX servers to the agent. To do this, log in to the workstation as the user who will be using native clients (in order to start the agent), then run the following (replace https://privx.example.com with the address of your PrivX server):

    privx-agent-ctl server probe https://privx.example.com

    Unless the PrivX server certificate is trusted on the workstation, you will be presented with additional information, such as the SHA checksums of the certificate.

    PrivX server 'https://privx.example.com' certificate is untrusted
Server TLS certificate:
Issuer        DC=com, DC=ssh, DC=fi, DC=hel, OU=QA, CN=MSCA-PKI-TEST2-ROOT-CA
Subject       OU=PrivX Web Server, CN=privx.hel.fi.ssh.com
Serial        2453081971937566630710942289116460769316175891
Not Before    2018-03-28 09:00:15 +0000 UTC
Not After     2028-03-28 09:10:15 +0000 UTC
Fingerprints
    SHA1        B5 F3 70 E2 DB 61 56 D9 AC AE 03 4D AE DC 01 4C FB D2 AB C0
    SHA256      17 22 63 69 D1 AA 77 34 96 BD B7 90 69 83 E7 30 97 A2 78 10 \
                73 5C 93 D0 D6 01 99 5C 04 C5 55 B2

Would you like to add this server to trusted servers? Y/N:

    You may ensure that these match to the checksums of the PrivX server certificate, which you can obtain by running the following on the PrivX server:

    openssl x509 -noout -fingerprint -sha1 -in /etc/nginx/ssl/nginx.crt
openssl x509 -noout -fingerprint -sha256 -in /etc/nginx/ssl/nginx.crt

    Enter Y to add the PrivX server.

  5. You may verify setup by running:

    privx-agent-ctl status
# This should output similarly to the following:
# PrivX SSH Agent Status
#   PrivX Server          https://privx.example.com
#   Login status          logged out

Windows setup

To set up native clients against PrivX for a user on a Windows workstation:

  1. Ensure that the native clients on the workstation are in the system PATH.

  2. Obtain the PrivX-agent software, available from Get PrivX software.
    Save the Agents.zip package to the workstation.

  3. Extract the PrivX agents to the workstation. Navigate to the extracted folder, and in its windows-386 folder, run the privx-agent-windows.msi file to install the PrivX agent.

  4. Start the PrivX agent in Start Menu→SSH Communications Security→PrivX Windows Agent.

    The PrivX agent may become blocked by other agent software (such as pageant) are running. In such cases, first close any blocking software, then try starting the PrivX agent.

    For easier access to the agent, you can pin the PrivX Windows Agent to Start, taskbar, or Quick Launch Menu.

  5. Configure the agent to connect to PrivX: In the system tray, right click the PrivX icon and then select Settings.

  • Enter the PrivX server URL. To verify the connection, click Test.
  • You may verify the PrivX-server certificate:
    • Click View to open the Certificate Properties.
    • Check the certificate details. You do not need to install the certificate to the system.
  • Click OK to save your settings.

If native-client paths change after setup, the PrivX agent has to be restarted to apply these path changes.

PrivX-Router Setup

A PrivX Router is Linux iptables-based component, required for accessing network targets. PrivX Routers are controlled by PrivX and must be placed on the path between the VPN server and the protected targets.

Setting up a PrivX Router involves the following:

  • Installing and configuring PrivX-Router software on the Router machine.
  • Registering the Router machine in PrivX.

The machine on which you set up PrivX Router must satisfy the following:

PrivX Router
System requirements- iptables and user-space tools
- SSH server allowing exec
- IP-packet forwarding
Network requirements- Ability to route network traffic between PrivX network and target network.
- Traffic from public/insecure networks must be secured with external solutions (such as VPN). Alternatively, configure the router to accept traffic from trusted sources only.
- To force all connections to go via PrivX, direct access from users to network targets may be blocked.

To set up the PrivX Router, download PrivX IPtables Router and follow the instructions in the README file.

After PrivX Router is configured you may set up network targets via this Router, as described in Network Connections.

UEBA-Server Setup

UEBA servers allow PrivX to use machine learning to detect potentially anomalous connections. PrivX deployments support up to one UEBA server.

To set up a UEBA server:

  1. Ensure that your machine satisfies the requirements at User and Entity Behavioural Analytics (UEBA). Particularly, note that the default Docker version included with some OS distributions may need to be upgraded to support UEBA.

  2. Provide the UEBA-server details via the PrivX GUI: At Administration→Deployment→User Behavior Analytics, click Edit and provide at least the UEBA-server address and TLS trust anchor.

If you don't see Administration→Deployment→User Behavior Analytics option, ensure that your PrivX license allows UEBA. You may enquire more about license details from the SSH licensing team at licensing@ssh.com.

Then on the same page, obtain the UEBA startup script by clicking Download UEBA Server Configuration.

  1. Gain root terminal access to the UEBA-server machine. Copy the UEBA startup script to this machine.

  2. Install UEBA-server software with:

    sudo chmod u+x ueba-startup.sh
sudo ./ueba-startup.sh ueba-tls.crt ueba-tls.key

    In the previous commands, replace example values as follows:

    • ueba-startup.sh - path to the UEBA startup script
    • ueba-tls.crt - path to the UEBA-server TLS certificate
    • ueba-tls.key - path to the UEBA-server TLS key

    After successful setup you may verify the UEBA-server status on the PrivX GUI Home page, under Service Status.

Upgrading PrivX deployment

This section provides instructions for upgrading your PrivX deployment.

Single-Server-Deployment Upgrade

Ensure the PrivX database has enough free space before upgrade: Migrations during upgrade may temporarily triple the database size. If necessary, you may reduce the database size before upgrade with Data Retention settings.

To upgrade the PrivX server, gain root-terminal access to your PrivX server and run:

yum install PrivX

The system fetches and sets up the latest PrivX package. Upgrade is complete once the command completes.

If you haven't set up the PrivX product repository, obtain the latest version from available from Get PrivX software and run:

yum install PrivX-*.x86_64.rpm

PrivX services are automatically stopped during the rpm upgrade, then automatically restarted by postinstall.

High-availability deployment upgrade

For instructions about upgrading high-availability deployments, see PrivX high availability deployment.

Upgrading Optional Components

PrivX Extenders, Carriers, and Web Proxies can be upgraded after PrivX-server and database upgrade. The specific steps for each optional component are provided in the following subsections.

Upgrading PrivX Extenders

There are two ways for upgrading Extenders:

  • Option 1: Uploading the new RPM to PrivX, then upgrading Extenders via the GUI.
  • Option 2: Upgrading Extender RPMs on Extender machines.

Option 1: upgrading Extenders via the GUI is not supported for Extenders running on Amazon Linux.

Option 1

  1. Upload the Extender RPM to PrivX, as described in Uploading Component-RPM Files Into PrivX.

  2. The Extender machines must be able to verify any new RPMs used for upgrade: If not done already, you will need to set up our GPG key on the Extender machines.

    You can obtain the GPG key from the SSH Repository.

    Gain root terminal access to your Extender machines. Upload the GPG key there. Then import it with (replace /path/to/info.fi-ssh.com-pubkey.asc with the path to the GPG key):

    rpm --import /path/to/info.fi-ssh.com-pubkey.asc

    The Extender machine can now verify RPMs on upgrade.

  3. Access the PrivX GUI, on the Monitoring→Status page, find and expand your Extender instances.

  4. Under Version, the version should have an Upgrade Available tag.

    Click ☰ next to the version and select Upgrade.

  5. Select the RPM version you want to upgrade to. Then click Apply.

    The target Extender will automatically upgrade and restart. The Extender should be functional after a few minutes.

  6. You may need to manually merge extender-config.toml changes.

Extender upgrades do not upgrade the RPM library, so running rpm -q PrivX-Extender on Extender machines will show the wrong RPM version.

If you want to revert to the version in the RPM library, you can do so by running:

/opt/privx/scripts/privx-extender.sh revert_to_original_rpm

You can upgrade the RPM version with installation Option 2, described later in this guide.

By default, Extenders will verify any RPMs used for upgrade and abort upgrade on failed verification. You may toggle verification using the require_signature setting in the Extender configuration file. We recommend keeping this enabled in production environments.

Option 2

  1. Install the latest Extender package to the Extender machine:

    • If the PrivX repository is enabled on the machine. Install the package with:
    yum install PrivX-Extender
    • Without the PrivX repository, go to Settings→Deployment→Deploy PrivX VPC/VPN Extenders and click Download PrivX Extender. Then copy the RPM to the Extender machine and install it with (replace `/path/to/PrivX-Extender..rpm`* with the path to which you placed the Extender package):
    yum install /path/to/PrivX-Extender-*.rpm

  2. You may need to manually merge extender-config.toml changes.

  3. Run postinstall to complete the upgrade:

    /opt/privx/scripts/extender-postinstall.sh

    Upgrading Extenders in this way will remove any upgrades installed with Option 1.

Upgrading PrivX Carriers and PrivX Web Proxies

PrivX Carriers and Web Proxies together enable web connections, and should be upgraded together.

To upgrade PrivX Carriers:

  1. Install the latest Carrier package in either of the following ways:

    • If the PrivX repository is enabled on the machine. Install the package with:
    yum install PrivX-Carrier
    • Without the PrivX repository, go to Settings→Deployment→Deploy PrivX web access gateways and click Download PrivX Web Access Gateway Components:
      Then copy the rpm to the Carrier host and install it with (replace `/path/to/PrivX-Carrier..rpm`* with the path to which you placed the Carrier package):
    yum install /path/to/PrivX-Carrier-*.rpm

  2. You may need manually merge carrier-config.toml changes

  3. Run postinstall to complete the upgrade:

/opt/privx/scripts/carrier-postinstall.sh

To upgrade PrivX Web Proxies:

  1. Install the latest Web-Proxy package in either of the following ways:

    • If the PrivX repository is enabled on the machine. Install the package with:
    yum install PrivX-Web-Proxy
    • Without the PrivX repository, go to Settings→Deployment→Deploy PrivX web access gateways and click Download PrivX Web Access Gateway Components:
      Then copy the rpm to the Web-Proxy host and install it with (replace `/path/to/PrivX-Web-Proxy..rpm`* with the path to which you placed the Web-Proxy package):
    yum install /path/to/PrivX-Web-Proxy-*.rpm

  2. You may need manually merge web-proxy-config.toml changes

  3. Run postinstall to complete the upgrade:

/opt/privx/scripts/web-proxy-postinstall.sh

Uninstalling PrivX

This section provides steps for completely removing PrivX from a machine. These steps may be used in preparation for PrivX reinstallation.

To delete all PrivX related data from a PrivX server:

  1. Uninstall the PrivX package:

    sudo yum erase PrivX

  2. Remove the leftover PrivX installation directory (includes configurations and keyvault data):

    sudo rm -rf /opt/privx
sudo rm -rf /opt/py

  3. If using a local database, remove PostgreSQL and its data directory:

    sudo yum erase postgresql
sudo rm -rf /var/lib/pgsql/

  4. Remove Nginx:

    sudo yum erase nginx

    Also remove the leftover Nginx server configuration and SSL-certificate files:

    sudo rm -rf /etc/nginx

  5. Finally remove the leftover privx-cert.json-file:

    sudo rm /tmp/privx-cert.json

Was this page helpful?