|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Sandfly Security LTD www.sandflysecurity.com |
| 3 | +# Copyright (c) 2016-2021 Sandfly Security LTD, All Rights Reserved. |
| 4 | + |
| 5 | +# Make sure we run from the correct directory so relative paths work |
| 6 | +cd "$( dirname "${BASH_SOURCE[0]}" )" |
| 7 | + |
| 8 | +SETUP_DATA=../setup/setup_data |
| 9 | +VERSION=${SANDFLY_VERSION:-$(cat ../VERSION)} |
| 10 | +IMAGE_BASE=${SANDFLY_IMAGE_BASE:-quay.io/sandfly} |
| 11 | + |
| 12 | +# Use standard docker image unless overriden. |
| 13 | +if [[ -z "${SANDFLY_MGMT_DOCKER_IMAGE}" ]]; then |
| 14 | + SANDFLY_MGMT_DOCKER_IMAGE="quay.io/sandfly/sandfly-server-mgmt${IMAGE_SUFFIX}:$VERSION" |
| 15 | +fi |
| 16 | + |
| 17 | + |
| 18 | +# See if we can run Docker |
| 19 | +which docker >/dev/null 2>&1 || { echo "Unable to locate docker binary; please install Docker."; exit 1; } |
| 20 | +docker version >/dev/null 2>&1 || { echo "This script must be run as root or as a user with access to the Docker daemon."; exit 1; } |
| 21 | + |
| 22 | +docker network create sandfly-net 2>/dev/null |
| 23 | +docker rm sandfly-server-mgmt 2>/dev/null |
| 24 | + |
| 25 | +# We can only upgrade if Sandfly is already installed and configured. |
| 26 | +if [ ! -f $SETUP_DATA/config.server.json ]; then |
| 27 | + echo "" |
| 28 | + echo "********************************** ERROR **********************************" |
| 29 | + echo "* *" |
| 30 | + echo "* Sandfly does not appear to be configured. Please use install.sh to *" |
| 31 | + echo "* install Sandfly on this host, not upgrade.sh. *" |
| 32 | + echo "* *" |
| 33 | + echo "********************************** ERROR **********************************" |
| 34 | + echo "" |
| 35 | + exit 1 |
| 36 | +fi |
| 37 | + |
| 38 | +# Don't upgrade if currently running |
| 39 | +server_result=$(docker inspect --format="{{.State.Running}}" sandfly-server 2> /dev/null) |
| 40 | +rabbit_result=$(docker inspect --format="{{.State.Running}}" sandfly-rabbit 2> /dev/null) |
| 41 | +if [ "${server_result}z" == "truez" -o "${rabbit_result}z" == "truez" ]; then |
| 42 | + echo "" |
| 43 | + echo "********************************** ERROR **********************************" |
| 44 | + echo "* *" |
| 45 | + echo "* Sandfly is currently running, so cannot be upgraded. Please stop all *" |
| 46 | + echo "* Sandfly containers (e.g. \`docker ls\` to get list, then for each name, *" |
| 47 | + echo "* \`docker stop <name>\`). *" |
| 48 | + echo "* *" |
| 49 | + echo "********************************** ERROR **********************************" |
| 50 | + echo "" |
| 51 | + exit 1 |
| 52 | +fi |
| 53 | + |
| 54 | +# jq might not be available on the outer Docker host, so we'll do a simple grep |
| 55 | +# to make sure the config version isn't set yet (and thus needs to be upgraded) |
| 56 | +grep -q \"config_version\":\ 2, $SETUP_DATA/config.server.json |
| 57 | +if [ $? == 0 ]; then |
| 58 | + echo "" |
| 59 | + echo "********************************** ERROR **********************************" |
| 60 | + echo "* *" |
| 61 | + echo "* Sandfly appears to already be upgraded to the correct version. *" |
| 62 | + echo "* *" |
| 63 | + echo "********************************** ERROR **********************************" |
| 64 | + echo "" |
| 65 | + exit 1 |
| 66 | +fi |
| 67 | + |
| 68 | +# Get the old configuration. |
| 69 | +CONFIG_JSON=$(cat $SETUP_DATA/config.server.json) |
| 70 | +export CONFIG_JSON |
| 71 | + |
| 72 | +# Back up the old config |
| 73 | +mkdir -p $SETUP_DATA/backup |
| 74 | +cp $SETUP_DATA/*.json $SETUP_DATA/backup |
| 75 | + |
| 76 | +# Start the Postgres server |
| 77 | +# The first time we start Postgres, we need to assign a superuser password. |
| 78 | +if [ ! -f $SETUP_DATA_DIR/postgres.admin.password.txt ]; then |
| 79 | + POSTGRES_ADMIN_PASSWORD=$(< /dev/urandom tr -dc A-Za-z0-9 | head -c40) |
| 80 | + echo "$POSTGRES_ADMIN_PASSWORD" > $SETUP_DATA/postgres.admin.password.txt |
| 81 | +fi |
| 82 | +echo "*** Starting Postgres database." |
| 83 | +../start_scripts/start_postgres.sh |
| 84 | +if [ $? -ne 0 ]; then |
| 85 | + echo "*** ERROR: Error starting Postgres container; cannot proceed." |
| 86 | + exit 1 |
| 87 | +fi |
| 88 | +sleep 5 |
| 89 | + |
| 90 | +### Start ElasticSearch if not already running |
| 91 | +esresult=$(docker inspect --format="{{.State.Running}}" elasticsearch 2> /dev/null) |
| 92 | +if [ "${esresult}z" != "truez" ]; then |
| 93 | + echo "*** Starting ElasticSearch." |
| 94 | + ../start_scripts/start_elastic.sh |
| 95 | + if [ $? -ne 0 ]; then |
| 96 | + echo "*** ERROR: Error starting ElasticSearch container; cannot proceed." |
| 97 | + exit 2 |
| 98 | + fi |
| 99 | + temp_cnt=30 |
| 100 | + while [[ ${temp_cnt} -gt 0 ]]; |
| 101 | + do |
| 102 | + printf "\rWaiting %2d second(s) for Elasticsearch to start and settle down." ${temp_cnt} |
| 103 | + sleep 1 |
| 104 | + ((temp_cnt--)) |
| 105 | + done |
| 106 | + echo "" |
| 107 | +else |
| 108 | + echo "*** ElasticSearch container already running." |
| 109 | +fi |
| 110 | + |
| 111 | +docker run \ |
| 112 | +-v $PWD/setup_data:/usr/local/sandfly/install/setup_data \ |
| 113 | +--name sandfly-server-mgmt \ |
| 114 | +--network sandfly-net \ |
| 115 | +$SANDFLY_MGMT_DOCKER_IMAGE /usr/local/sandfly/install/upgrade.sh |
| 116 | + |
| 117 | +if [ $? != 0 ]; then |
| 118 | + echo "*** ERROR: Upgrade process failed. See above messages for details." |
| 119 | + exit 1 |
| 120 | +fi |
| 121 | + |
| 122 | +echo "Stopping Elasticsearch" |
| 123 | +docker stop elasticsearch |
| 124 | +docker rm elasticsearch |
| 125 | + |
| 126 | +echo "" |
| 127 | +echo "*********************************** INFO ***********************************" |
| 128 | +echo "* *" |
| 129 | +echo "* The upgrade to Sandfly 3.1 is complete. Users, credentials, hosts, *" |
| 130 | +echo "* schedules, and other configuration data has been migrated to the 3.1 *" |
| 131 | +echo "* Postgres database. You will need to run new scans (or wait for scheduled *" |
| 132 | +echo "* scans) for results to start re-populating. *" |
| 133 | +echo "* *" |
| 134 | +echo "* Sandfly no longer uses Elasticsearch for local data storage. When *" |
| 135 | +echo "* starting Sandfly 3.1, use the start_postgres.sh start script instead of *" |
| 136 | +echo "* the old start_elastic.sh start script. (Or use the start_sandfly.sh *" |
| 137 | +echo "* script which starts all necessary server components automatically.) *" |
| 138 | +echo "* *" |
| 139 | +echo "* Your Sandfly 3.0 Elasticsearch database Docker volume is still available *" |
| 140 | +echo "* if you need to roll back the upgrade. The Sandfly 3.0 configuration *" |
| 141 | +echo "* files have been backed up to the setup_data/backup directory. *" |
| 142 | +echo "* *" |
| 143 | +echo "* When you are satisfied with the Sandfly 3.1 upgrade, you may permanently *" |
| 144 | +echo "* delete your Sandfly 3.0 Elasticsearch database with the command: *" |
| 145 | +echo "* docker volume rm sandfly-elastic-db-vol *" |
| 146 | +echo "* *" |
| 147 | +echo "* Sandfly support is available at https://support.sandflysecurity.com/ *" |
| 148 | +echo "* *" |
| 149 | +echo "*********************************** INFO ***********************************" |
| 150 | +echo "" |
0 commit comments