Offline installation full

[aarz-snl]

🗣 Description

💭 Motivation and context

📷 Screenshots (DELETE IF UNAPPLICABLE)

🧪 Testing

Redhat:
Build two machines using the exporter.txt in this format. Use r1 and r2

export RESOURCE_GROUP="lme-yourname-r1"
export PUBLIC_IP="0.0.0.0/0"  
export VM_SIZE="Standard_D8_v4"
export LOCATION="westus"
export AUTO_SHUTDOWN_TIME="00:00"
export LME_USER="lme-user"

Source the exporter.txt file and login to azure:

source exporter.txt
az login 

Build the machines using a larger disk.

./azure/build_azure_linux_network.py -g $RESOURCE_GROUP -s $PUBLIC_IP -vs $VM_SIZE -l $LOCATION -ast $AUTO_SHUTDOWN_TIME --use-rhel -os 256 

On the build machine (r1):

sudo dnf -y install git
git clone https://github.com/cisagov/LME.git
cd LME/
git checkout offline-installation-full
sudo ./scripts/expand_disk_for_offline.sh
./scripts/prepare_offline.sh

You will now have a tar file in your home directory that you are going to copy to r2

Change exporter.txt resource group to r2.
Source the exporter.txt file and build r2:

source exporter.txt

Build the r2 machine using a larger disk.

./azure/build_azure_linux_network.py -g $RESOURCE_GROUP -s $PUBLIC_IP -vs $VM_SIZE -l $LOCATION -ast $AUTO_SHUTDOWN_TIME --use-rhel -os 256 

Note the ip and password. You will need it for when you are copying the build and such from r1 to r2

Now you want to copy the expand_disk_for_offline.sh to r2 (The target machine) from r1 (The build machine):
On the build machine:

scp /home/lme-user/LME/scripts/expand_disk_for_offline.sh r2ipaddress:~

Then you need to ssh into r2 and run the expand_disk_for_offline.sh as root:

# On r2
sudo /home/lme-user/expand_disk_for_offline.sh

Now go back to r1 and scp the offline tarball to r2:

cd ~/
# Replace with the real name of the tarball and the real ip of r2
scp lme-offline-todaysdate-uniqueid.tar.gz  r2ipaddress:~

Now go back to r2 and move the tarball to a larger volume and untar it:

sudo mv /home/lme-user/lme-offline-todaysdate-uniqueid.tar.gz /var
# Untar the file into the lme-user home directory
tar -xzf /var/lme-offline-todaysdate-uniqueid.tar.gz -C /home/lme-user/
cd ~/LME

Now you need to set up the outbound traffic on r2
Go into the azure web interface and find the r2 NSG1 and open it.
Click on the left Settings->Outbound Security Rules
Click the plus to add a new rule and add two rules, one at a time.

Instructions for Creating SSH Access Rule

1. Source: Select "Any"
2. Source port ranges: Enter "*" (asterisk)
3. Destination: Select "Any"
4. Service: Select "Custom"
5. Destination port ranges: Enter "22"
6. Protocol: Select "Any"
7. Action: Select "Allow"
8. Priority: Set to "1000"
9. Name: Enter "ssh"
10. Description: Leave blank or add an optional description

This will create a rule allowing SSH traffic (port 22) from any source to any destination using any protocol.

Now you need to block all of the other traffic.

Instructions for Creating Deny All Traffic Rule

To create the network security rule shown in the image, follow these steps in this exact order:

1. Source: Select "Any"
2. Source port ranges: Enter "*" (asterisk)
3. Destination: Select "Any"
4. Service: Select "Custom"
5. Destination port ranges: Enter "*" (asterisk)
6. Protocol: Select "Any"
7. Action: Select "Deny"
8. Priority: Set to "1015"
9. Name: deny_all
10. Description: Leave blank or add an optional description

This will create a rule denying all traffic from any source to any destination using any protocol. Note that this is a blocking rule with a priority of 1015, which means it will be processed after rules with lower priority numbers.

Now ssh back into r2 and run ping until the packets stop getting out.

ping google.com

Once the traffic stops flowing hit ctrl-c to stop the ping.

Now you can run the install in offline mode.

cd ~/LME
./install.sh -o -d 

Running the tests

You can either run the tests on your local machine pointing the .env file to the server, or you can install the python environment on r2 and run the tests on it.
In either case, you will have to go back to the azure web gui and remove (click the trash can) the deny rule to test, because you either have to get to it from your local machine or you have to install the pip requirements from the web for the tests.

✅ Pre-approval checklist

• Changes are limited to a single goal AND
  the title reflects this in a clear human readable format
• Issue that this PR solves has been selected in the Development section
• I have read and agree to LME's CONTRIBUTING.md document.
• The PR adheres to LME's requirements in RELEASES.md
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated to reflect the changes in this PR.

✅ Pre-merge Checklist

• All tests pass
• PR has been tested and the documentation for testing is above
• Squash and merge all commits into one PR level commit

✅ Post-merge Checklist

• Delete the branch to keep down number of branches

[cbaxley]

We are going to have to add the tests for redhat in here. A merge with development would add them.

[cbaxley]

Change this to 8.18.3