Skip to Content

Upgrade Ezeelogin Jump server to the latest version

136  Manu Chacko September 18, 2023  Installation

Upgrade Ezeelogin jump server on Primary / Master Node

If you are running Version 5.x.x, you would first need to upgrade to Version 6.0.x before upgrading to Version 7.0.x.

  • To upgrade to Version 6.0.x, download 6.0.0 and upgrade to Version 6.0.0 first.
http://downloads.ezeelogin.com/ezlogin_6.0.0.bin
  • To upgrade to Version 7.0.x, download 7.0.x and upgrade
http://downloads.ezeelogin.com/ezlogin_7.0.0.bin

If you are already running Version 6. x.x, you would first need to upgrade to Version 7.0.x before upgrading to version 7.10.0

  • To upgrade to Version 7.0.x, download 
http://downloads.ezeelogin.com/ezlogin_7.0.0.bin
  •   Once you have upgraded to Version 7.0.0, download version 7.10.0 or the latest from the customer portal.

If you are running Version 7. x.x to the 7.9.x version, you would first need to upgrade to Version 7.10.0 before upgrading to the latest version

Make sure to download the binary package to /root

Ezeelogin 7.10.0 version can be downloaded from your customer portal area.

 If you are already running Version 7.10.x, you can upgrade to the latest version

The latest version of Ezeelogin can be downloaded from the customer portal area 

Check out the latest system requirements

https://www.ezeelogin.com/user_manual/Systemrequirements.html

You are required to upgrade your Ioncube encoder to the latest version 6 and above. Refer to the following article to upgrade Ioncube to the latest.

How do I install Ioncube on the server?

It is recommended to have the secondary node configured and synchronized (cluster setup) to ensure that we can still log in to servers via the secondary node and not be locked out in the event of an unsuccessful upgrade.

Install-slave-secondary-node-for-high-availability-in-jump-server

Backup current Ezeelogin installation 

Execute the following script on your server to generate a backup of your installation so that you can restore the backup in case the upgrade breaks. Run /usr/local/sbin/backup_ezlogin.php -help for the help menu. 

root@primary_gateway:~$/usr/local/sbin/backup_ezlogin.php

The directory /var/log/ezlogin stores the user ssh sessions that are recorded. This dir could run into huge size ( 1GB >) which would cause the backup_ezlogin.php script to take long to complete ( The ssh logs recorded has to be tar 'red and the gzip 'ed compressed which is time and resource intensive).  In such, cases its advisable to skip the ssh logs directory while running the backup _ezlogin.php script as follows so that a backup archive is created super quickly.

          [root@primary_gateway ~]#  /usr/local/sbin/backup_ezlogin.php -nologs

By default, the backup archives are created in /var/ directory. To change the destination directory,  use 

           [root@primary_gateway ~]#php /usr/local/sbin/backup_ezlogin.php -out /backup_directory/

This would create an executable archive of your Ezeelogin installation in /var/ezlogin_backup_v6.2.0_b167_Fri_Mar_02_2012_04_23_22_CST.bin

Execute the backup bin file to restore if something goes wrong and you would like to revert. 

Ok, now that we have the backups ready, let's go ahead with the update on the primary node as follows, preferably in the screen

Check the  /var/log/ezlogin_backup.log  for any errors that occurred during the backup process.

Upgrading Ezeelogin jump server 

 To upgrade Ezeelogin, download and run the Ezeelogin setup file as follows

Refer to the article if you are upgrading PHP.  Upgrading PHP along with the Ezeelogin upgrade
Refer to the article if you get the error ERROR db user: Incorrect datetime value: ’0000-00-00 00:00:00’ for column ’expiry’ at row 1

root@primary_gateway:~$ sh ezlogin_7.x.x.bin -- -update

Follow the onscreen prompts to complete the upgrade.

To upgrade in one step with your existing settings and without being prompted.  Be ready with MySQL root password if not in /root/.my.cnf

-dbsuser <username> : Specify database super (root) user name
-dbspass <password> : Specify database super (root) user password

[root@gateway~]#  sh ezlogin_7.15.0._x_x.bin --  -dbsuser <enter db (root)username>  -dbspass <enter-_(root)db_password> -skipgeolite    -auto -force   -ACCEPT_SETTINGS    -I_ACCEPT_EULA   -update

To upgrade in one step and to prevent the backup_ezlogin.php script from generating a backup again. Be ready with MySQL root password if not in /root/.my.cnf

[root@gateway ~]#   sh ezlogin_7.15.0._x_x.bin  --   -dbsuser <enter (root)db username>  -dbspass <enter_(root)db_password>  -skipgeolite    -auto -force   -ACCEPT_SETTINGS    -I_ACCEPT_EULA   -skipbackup -update

Frequently occurring issues after the upgrade.

Refer ezsh shell disallowed article if you get the error on ssh to the upgraded ssh jump server. 
Refer No Two-factor Authentication enabled article if you get the error while login into the web panel after the upgrade.
Refer Could not load style files while accessing Ezeelogin after the upgrade. 
Refer Integrate Ezeelogin with WAF(Cloudflare)in case the error to login to Ezeelogin persists.

Refer remote host identification changed article to reset fingerprint on all remote servers.

Refer remote host identification changed article to reset the fingerprint of the gateway machine to add or edit users.

Refer view/hide IP address article to grant the privilege to view the IP of remote servers. (This feature is available from 7.29.2)

Refer configure DUO article if you get "invalid_grant" or "An Error Was Encountered" in Ezeelogin GUI.

Refer your system folder path does not appear to be set correctly article to correct the file permissions.

Refer Error while logging into Ezeelogin GUI article if get the login expired error in Ezeelogin software GUI

 

Check the  /var/log/ezlogin_update.log for any errors that occurred during the upgrade.

If you are using WEBSSH, WEBRDP OR EZPROXY on Webportal please enter the following command to update the node modules

      root@jumpserver:~#  php /usr/local/ezlogin/eztool.php -install_node_modules

Restoring the Ezeelogin jump server from backup 


If something is broken after the upgrade, no worries. We will restore the backup from the archive that was created. You would first need to uninstall the current installation on the gateway. Run the following script to uninstall

Backup Ezeelogin configuration file directory and ssh logs before uninstall 

root@primary_gateway:~# cp /usr/local/etc/ezlogin  /usr/local/etc/ezlogin_backup

root@primary_gateway:~# cp /var/log/ezlogin  var/log/ezlogin_backup

root@primary_gateway:~$ /usr/local/sbin/uninstall_ezlogin.php


Now that we have uninstalled it, we can go ahead and restore the binary backup archive that was created.

root@primary_gateway:~$sh /var/ezlogin_backup_v7.0.0_b167_Fri_Mar_02_2012_04_23_22_CST.bin

If you want to do the restore in one step with your existing settings and without being prompted.

root@primary_gateway:~sh ezlogin_backup_v7.9.0_b381_Wed_Feb_13_2019_23_26_03_IST.bin  -- -skipgeolite -auto -force -ACCEPT_SETTINGS -I_ACCEPT_EULA

 Replace the backup filename with your backup file. Follow the onscreen prompts to complete the restoration.

Increase PHP memory in /etc/php.ini  if backup restoration fails without any reason. Do check /var/log/ezlogin_restore.log for errors.

Refer to the following article to restore ssh logs if you have skip logs while backup Ezeelogin.

Upgrading Ezeelogin jump server on the Secondary Node

     For Ezeelogin Version 7.23.0  and above

This option will support only from Ezeelogin version 7.23.0 and above. 

     You can upgrade secondary node with following command

root@secondary_gateway:~ sh ezlogin_7.x.x.bin -- -secondary <ip_adress of the secondary/slave node> -othernode <ip_address of master node> -update

You should upgrade the slave node only after upgrading the master node. If the slave node is once upgraded, you should need to upgrade the master before upgrading the slave node again.

To upgrade slave in one step with your existing settings and without being prompted.  Be ready with MySQL root password if not in /root/.my.cnf

-dbsuser <username> : Specify database super (root) user name
-dbspass <password> : Specify database super (root) user password
-orport <port> : Specify the SSH port on the other node. Only applicable if installing as secondary.

[root@gateway~]#  sh ezlogin_7.15.0._x_x.bin -- -secondary <ip_adress of the secondary/slave node> -othernode <ip_address of master node> -dbsuser <enter db (root)username>  -dbspass <enter-_(root)db_password>   -skipgeolite  -orport <othernode_ssh_port>  -auto -force   -ACCEPT_SETTINGS    -I_ACCEPT_EULA   -update

To upgrade in one step and to prevent the backup_ezlogin.php script from generating a backup again. Be ready with MySQL root password if not in /root/.my.cnf

[root@gateway ~]#   sh ezlogin_7.15.0._x_x.bin -- -secondary <ip_adress of the secondary/slave node> -othernode <ip_address of master node> -dbsuser <enter db (root)username>  -dbspass <enter-_(root)db_password>   -skipgeolite  -orport <othernode_ssh_port>  -auto -force   -ACCEPT_SETTINGS    -I_ACCEPT_EULA   -skipbackup  -update

     For Ezeelogin Version 7.22.0  and below

Unfortunately, the secondary nodes need to be re-installed for Ezeelogin version 7.22.0 and below

  • Backup Ezeelogin configuration file directory and ssh logs directory before uninstall 

    root@secondary_gateway:~# cp /usr/local/etc/ezlogin  /usr/local/etc/ezlogin_backup

    root@secondary_gateway:~# cp /var/log/ezlogin  /var/log/ezlogin_backup

  • Uninstall Ezeelogin with the following command

    root@secondary_gateway:~$ /usr/local/sbin/uninstall_ezlogin.php

  • Download the same package used for the primary

    wget https://downloads.ezeelogin.com/ezlogin_7.x.x.bin

  • Execute the following command

    root@secondary_gateway:~sh ezlogin_7.x.x.bin -- -secondary <ip_adress of the secondary/slave node> -othernode <ip_address of master node>

Copy the lic.dat from the /usr/local/etc/ezlogin_backup to /usr/local/etc/ezlogin directory if you are using the standalone license. Also, copy tls_cert.pem and tls_key.pem to /usr/local/etc/ezlogin directory, if you are using webssh, ezproxy or webrdp  feature

   Refer to the following article to set up a secondary node.

Install-slave-secondary-node-for-high-availability-in-jump-server
Rating: 4.2 (5 Votes)