Multi-Node Linux Install Prerequisites

Prerequisites and requirements for Multi-Node and High-Availability AgileSec Linux installations, including system requirements, firewall rules, etc.

Requirements

Ensure you meet the following requirements prior to AgileSec installation.

Operating System Requirements

The following Linux operating systems are supported:

• Officially supported: Red Hat Enterprise Linux (RHEL) 9+

• Compatible (expected to work): CentOS 9+, Alma Linux 9+

System Requirements

This section provides the minimum requirements for each available Node types. Not every AgileSec cluster configuration will use every Node type. For more information see On-Prem Deployment Topologies .

Install User Requirements

The installing user must have sudo rights on the nodes in order to use required scripts such as tune.sh.

Networking Requirements

The following ports and firewalls should be configured prior to AgileSec install.

Ports

The following defaults ports are used by various internal components. All ports are configurable.

Firewall Rules

Note: This assumes any intra-node (within VM) traffic is allowed. This does not include platform-egress firewall rules, e.g. outgoing traffic going to github, gitlab resources, etc., as those are dependent on end user scanning preferences.

All traffic is on TCP.

The following firewall rules are needed for multi-node clusters, including those with scan nodes or load balancers when using default ports for services.

Note: If ports have been updated from default, ensure you update firewall rules accordingly.

Prepare for Installation

Prepare the following prior to install.

Set up SSH key-based password-less access (backend-1 to all nodes)

Certificates and other configuration files will be generated on backend-1. For easier file transfers between nodes, we recommend setting up SSH key-based password-less access from backend-1 to all other nodes.

Prepare Installation Files (all nodes)

Ensure your nodes meet the minimum memory, CPU, and disk requirements then prepare AgileSec installer files on each node.

1. Download the installation zip archive from the Keyfactor download portal and place on all nodes.

2. Extract the zip archive <installer_package>.zip to your preferred location installer_dir on each node:

   unzip <installer_package>.zip
   export installer_dir = <installer-directory-location>
   cd $installer_dir
   

3. Ensure the installation script is executable:

   cd $installer_dir
   chmod +x install_analytics.sh
   

Create .pass File (all nodes)

Creating a .pass file is required to enable non-interactive installation. When running in non-interactive mode, the install_analytics.sh script reads the AgileSec platform admin password from the .pass file.

By default, password requirements include minimum 14 characters, at least 1 uppercase letter, at least 1 number, and at least 1 special character from `@ ! # $ & ?`.

To create the .pass, follow these instructions on each node:

1. Copy the example file: cp .pass.example .pass .

   1. To see all files, including files starting with a ., use ls -a

2. Edit .pass and set admin_password. Save the file and exit the editor.

3. Set secure permissions: chmod 600 .pass

Configuration Decisions

Ensure stakeholders confirm the following configuration items prior to installation. Ensure your configuration file multi_node_config.conf aligns with these decisions during installation.

External Domain Name

Choose your desired external FQDN. A single external FQDN for AgileSec platform access is required. When assigning configuration variables during installation (instructions in provided guides), the external FQDN will be <analytics_hostname>.<analytics_domain>.

The following format is recommended: agilesec.<external domain>

For example: agilesec.dilithiumbank.com.

BYOC Only: Certificate Management Prerequisites

If you intend to bring your own certificates (BYOC) from a public CA or enterprise PKI rather than using self-signed installer-generated certificates, review BYOC: Prerequisites. Ensure prerequisites are met and determine all required configuration details for proper certificate management.