Upgrade Key Trustee Server

1. Stop the httpd service:

   $ sudo service httpd stop

2. Install the EPEL Repository
   Dependent packages are available through the Extra Packages for Enterprise Linux (EPEL) repository. To install the EPEL repository, install the epel-release package:

   1. Copy the URL for the epel-release-<version>.noarch file for RHEL 6 or RHEL 7 located in the How can I use these extra packages? section of the EPEL wiki page.
   2. Run the following commands to install the EPEL repository:

      $ sudo wget <epel_rpm_url>
      $ sudo yum install epel-release-<version>.noarch.rpm

      Replace <version> with the version number of the downloaded RPM (for example, 6-8).

   If the epel-release package is already installed, you see a message similar to the following:

   Examining /var/tmp/yum-root-jmZhL0/epel-release-6-8.noarch.rpm: epel-release-6-8.noarch
   /var/tmp/yum-root-jmZhL0/epel-release-6-8.noarch.rpm: does not update installed package.
   Error: Nothing to do
   

   Confirm that the EPEL repository is installed:

   $ sudo yum repolist | grep -i epel

3. Install the Cloudera Repository
   Create or edit the /etc/yum.repos.d/gazzang.repo file (for example, sudo vi /etc/yum.repos.d/gazzang.repo) and add the following text. Replace USER and PASSWD with the username and password provided by Cloudera. If you do not know your username or password, contact your Cloudera account team.

   [gazzang_stable]
   name=RHEL $releasever - gazzang.com - base
   baseurl=https://USER:PASSWD@archive.gazzang.com/redhat/stable/$releasever
   enabled=1
   gpgcheck=1
   gpgkey=http://archive.gazzang.com/gpg_gazzang.asc

     Important: If you are using CentOS, add the following line to the CentOS base repository:

   exclude=python-psycopg2*

   By default, the base repository is located at /etc/yum.repos.d/CentOS-Base.repo. If you have an internal mirror of the base repository, update the correct file for your environment.
   Import the GPG key by running the following command:

   $ sudo rpm --import http://archive.gazzang.com/gpg_gazzang.asc

4. Upgrade Key Trustee Server using yum:

   $ sudo yum update keytrustee-server python-keytrustee

5. Start the httpd service:

   $ sudo service httpd start

Migrate Apache Web Server to CherryPy

  Note: Confirm that all ports listed in the network requirements within Data at Rest Encryption Requirements are open before proceeding.

For versions 5.4.0 and higher, Key Trustee Server uses CherryPy for the front end web interface; lower versions use the Apache web server. The CherryPy service is managed using the keytrusteed service. The Apache web server is managed using the httpd service. Run the following commands to migrate the web server from Apache to CherryPy.

1. On the active Key Trustee Server, run the ktadmin db --configure command as follows:

   $ sudo -u keytrustee ktadmin db --configure --port 11381 --pg-rootdir /var/lib/keytrustee/db --slave keytrustee02.example.com

   Replace keytrustee02.example.com with the hostname of the passive Key Trustee Server. For standalone Key Trustee Server, omit the --slave keytrustee02.example.com portion of the command.

2. Export the active Key Trustee Server database. Run the following commands on the active Key Trustee Server:

   $ sudo -u postgres pg_dump keytrustee > /var/lib/keytrustee/ktdbexport.pgsql
   $ chown keytrustee:keytrustee /var/lib/keytrustee/ktdbexport.pgsql

3. Start the Key Trustee Server database and import ktdbexport.pgsql:

   $ sudo -u keytrustee /usr/pgsql-9.3/bin/pg_ctl -D /var/lib/keytrustee/db start --log /var/lib/keytrustee/db/pg_ctl.log
   $ sudo -u keytrustee /usr/pgsql-9.3/bin/createdb --host /tmp --port 11381 -O keytrustee keytrustee
   $ sudo -u keytrustee psql -d keytrustee -h /tmp -p 11381 < /var/lib/keytrustee/ktdbexport.pgsql

     Note: The /etc/init.d/postgresql script does not work when the PostgreSQL database is started by Key Trustee Server, and cannot be used to monitor the status of the database. Use /etc/init.d/keytrustee-db instead.
4. (High Availability Key Trustee Servers Only) Start the passive Key Trustee Server. Run the following commands on the passive Key Trustee Server:

   $ sudo -u keytrustee ktadmin --confdir /var/lib/keytrustee/.keytrustee init-slave --master keytrustee01.example.com --pg-rootdir /var/lib/keytrustee/db --no-import-key --master-host-port 11381 --logdir /var/lib/keytrustee/.keytrustee/logs --postgres-config=local --no-start
   $ sudo -u keytrustee /usr/pgsql-9.3/bin/pg_ctl -D /var/lib/keytrustee/db start

5. Edit /var/lib/keytrustee/.keytrustee/keytrustee.conf on the active and passive Key Trustee Servers to reference the new database and port. Set the DB_CONNECT parameter as follows:

       "DB_CONNECT": "postgresql://localhost:11381/keytrustee?host=/tmp",

6. Restart the Apache web server. Run this command on all Key Trustee Servers:

   $ sudo service httpd restart

7. Start the Key Trustee daemon (which starts the CherryPy web server). Run this command on all Key Trustee Servers:

   $ sudo /etc/init.d/keytrusteed start

8. After verifying that the Key Trustee daemon and CherryPy web server are running, stop the Apache web server and original database and prevent them from starting after reboots. Run these commands on all Key Trustee Servers:

   $ sudo service httpd stop
   $ sudo -u postgres /usr/pgsql-9.3/bin/pg_ctl -D /var/lib/pgsql/9.3/keytrustee stop
   $ sudo chkconfig httpd off
   $ sudo chkconfig postgresql-9.3 off

(High Availability Key Trustee Servers Only) Enable Synchronous Replication

$ sudo -u keytrustee ktadmin enable-synchronous-replication --pg-rootdir /var/lib/keytrustee/db