Upgrading from a Standalone PAM to PAM HA Pair
This section looks at how to upgrade from an existing standalone PAM Server to a PAM HA Pair configuration.
Prerequisites
Before you can configure a PAM HA Pair you will need the following prerequisites:
Prerequisite | Description |
---|---|
Upgrade path | Review the Upgrade paths to ensure you are applying the correct upgrade method based on the version you are upgrading from and to. |
Hardware and Software | Ensure the correct resources are available before upgrading. The following outlines the hardware and software requirements.![]() |
Software downloads | Download the latest upgrade kit click here. |
Disk space | Ensure the internal disk has a minimum of 5GB free disk space. |
Recent backup | We recommend that you have a recent PAM backup as well as VM level backup or snapshot of the standalone PAM Server being upgraded. |
No active user connections | Ensure there are no active user connections. |
Disable Task 'Regenerate Account Credentials for all devices' | Within the Admin Interface, disable all scheduled Regenerate Account Credentials for all devices tasks within profiles. |
Osirium Support account | Within the Admin Interface ensure the Osirium Support account has been enabled and a password set. |
.local DNS domains | If you are using .local DNS domains, ensure matching records have been entered in the DNS Search Suffixes. |
We also recommend the following:
Prerequisite | Description |
---|---|
SMB filestore | RECOMMENDED Configure an SMB filestore to store Session Recording files. For instructions click here SMB Filestore. |
Floating IP address | RECOMMENDED Allocating a floating ip address will allow the ip address to be dynamically assigned to the active PAM Server. This means the user will only need a single ip address when connecting to PAM and not have to switch ip addresses if a failure occurs. |
Upgrade procedure
The diagram provides a high-level overview of the process for upgrading a standalone PAM Server to a PAM HA Pair configuration.
Standalone to PAM HA Pair upgrade procedure flowchart
Upgrade steps
- Upgrade the Standalone PAM Server
- System Configuration
- Deploy Second PAM Server
- Configure the HA Secondary
- Initialise High Availability
Upgrading the Standalone PAM Server
-
Open a file transfer tool of your preference and copy the upgrade kit onto the standalone PAM Server using the osirium_support account.
-
Open the PAM Server Console window, then press ALT + F2. The server login prompt appears.
Note
Alternatively, you could use an SSH connection to the PAM Server.
-
Enter osirium_support at the login prompt and press ENTER.
-
When prompted, enter the password of the osirium_support account and press ENTER.
-
Extract the upgrade kit copied to the server using the following command:
sudo bash Osirium_PAM_Server_vA.B.C_upgrade.bin
Where A.B.C is the version you are upgrading to.
-
When the kit has been extracted, type the command specified on the screen and press ENTER.
-
Press ENTER when prompted to start the setup and configuration.
-
The EULA screen will be displayed. Press ENTER once you have read it.
-
Wait while the upgrade completes and the server is rebooted.
System Configuration
The following system configuration steps are required on the upgraded PAM Server:
SMB Filestore RECOMMENDED
We highly recommend that an SMB filestore is configured to maintain resilience and ensure session recordings continue to be available in case of any failovers.
Warning
If an SMB filestore is not configured then you are at risk of losing files stored locally on the PAM Server.
To configure:
-
Within the Admin Interface navigate to the System configuration > System settings tab.
-
Click on the
next to SMB share configuration.
-
Enter the SMB share details.
Field name Description UNC path The UNC path by which PAM can connect to the SMB share. For example \server-name\shared-resource-pathname
Username The username of the SMB share location. Password The password of the SMB share location. Options (comma-separated) Optional
Allows additional parameters to be passed to the SMB share as a comma separated list if required. -
Click
SAVE
. -
Click on the
next to File store.
-
Select SMB Share and click
SAVE
.
Uploading a trusted certificate RECOMMENDED
By default, Osirium PAM provides a generic certificate to allow secure web connections to the UI and Admin Interface.
We recommend that you upload a trusted certificate valid within your organisation. For further details on the types of certificates that can be uploaded click here.
The steps to upload a certificate differ depending upon the certificate type.
Certificate with RSA private key
To upload:
-
Within the Admin Interface navigate to the System configuration > Certificates tab.
-
On the Certificates tab, click LOAD NEW CERTIFICATE.
-
In the Upload TLS Certificate window, upload your trusted certificate and RSA private key. Both are required for a successful upload.
- TLS Certificate: Uploaded certificates will be verified to ensure they are an X.509 certificate with a .pem file format.
- RSA Private Key: Uploaded keys are verified to ensure they are an rsa key with a .key file format. Passwords/passphrase are NOT supported on the the rsa key.
-
If the private key you are uploading has been encrypted, enter the password in the Key password (optional) input box.
-
Click UPLOAD. The certificate is uploaded.
PKCS12 archive file
To upload:
-
Within the Admin Interface navigate to the System configuration > Certificates tab.
-
On the Certificates tab, click LOAD NEW CERTIFICATE.
-
In the Upload TLS Certificate window, upload your PKCS #12 file.
- The certificate contained within the PKCS #12 file will be verified to ensure it is a X.509 certificate.
- The private key contained within the PKCS #12 file will be verified to ensure it is an rsa key.
-
If the private key you are uploading has been encrypted, enter the password in the Key password (optional) input box.
-
Click UPLOAD. The certificate is uploaded.
Deploy Second PAM Server
To create the HA Pair you will need to create a Secondary PAM Server. Deploy the software package into your chosen supported infrastructure. Click on the appropriate link below to be navigated to the deployment steps.
- Deploy using VMware vSphere
- Deploy using Microsoft Azure
- Deploy using Microsoft Hyper-V
- Deploy using Amazon Web Services
- Deploy using Nutanix Prism Central
Configure the HA Secondary
Follow these configuration steps if you are setting up a Secondary server.
-
Within the Console window, press ENTER when prompted to start the setup and configuration.
-
Read and accept the EULA to continue.
-
Select HA secondary (or replacement primary) as the installation type.
-
Within the Configure Networking screen, configure the following server settings. Press TAB to navigate between the fields.
- IP Address: Enter the IP Address which will be used to connect to the server.
- Netmask: Enter the network mask.
- Gateway: Enter the network default gateway IP address.
- Primary DNS: Enter the network primary DNS IP address.
- (Secondary DNS): Enter the secondary DNS IP address if relevant, else leave blank.
- (Tertiary DNS): Enter the tertiary DNS IP address if relevant, else leave blank.
- (DNS Suffixes): Enter the DNS Suffixes. Multiple entries can be separated with a comma, else leave blank.
Note
If you are using a .local domain, DNS suffixes MUST be added.
-
Once completed TAB down to the
OK
button and press ENTER. -
Within the Enter a hostname window, enter a name to identify the new server.
-
TAB down to the
OK
button and press ENTER. -
Once the setup has completed a message will be displayed. Your system is now ready for High Availability.
Make a note of the joining code displayed on the screen as it will be required to initialise your PAM HA pair.
Initialise High Availability
Once you have upgraded your standalone PAM Server and deployed and configured your Secondary server, the final step is to initialise your HA pair and setup replication.
-
Open up a web browser and enter the address of the Primary server:
[PAM Server Address]:8443
You will be presented with the Management Interface.
-
Login with a username and password.
Note
PAM user must belong to the PAM Owner group that gives them Owner role level access to PAM.
-
You will be presented with Management Interface SSH window.
-
At the prompt type ha-initialise and press ENTER.
Note
If an SMB share is not configured you will be presented with a warning message. We recommend you configure an SMB share before continuing.
-
Enter the IP address of the Secondary server and press ENTER.
-
Enter a floating IP address and press ENTER.
-
Read what will happen on the Secondary server then type y and press ENTER to continue.
-
Enter the joining code of your Secondary server which can be found on the server console window and press ENTER.
-
Wait while the joining procedure completes.
-
When the operation has completed, review the follow-up actions listed and complete as required.
HA Pair configuration is now complete.
Post upgrade tasks
Once the PAM Server upgrade to a HA Pair has successfully completed, log on to the Primary server and check the following before allowing users to reconnect:
Post upgrade task | Description |
---|---|
Trigger AD audit | Before opening any device connections that use an Active Directory account, an audit needs to be manually triggered on all provisioned Active Directories. You can do this by right clicking the Active Directory on the Manage Active Directory page, and select Trigger audit from the menu. |
Check device states | Check device status to ensure they are running successfully. |
Check user connections | Check users can connect to devices. |
Re-enable scheduled tasks | Re-enable scheduled Regenerate Account Credentials for all devices tasks. |
Backup | Run the Osirium PAM Server backup task as well as VM level backup of both the HA Pair PAM Servers. |
Upgrade PAM UI | If you are using a standalone PAM UI Server then use the PAM Component Compatibility Matrix to check if the PAM UI Server needs updating inline with the PAM version you have upgraded to. Upgrade as appropriate. |
Upgrade MAP Server | If you are using a MAP Server then use the PAM Component Compatibility Matrix to check if the MAP Server needs updating inline with the PAM version you have upgraded to. Upgrade as appropriate. |