Kiuwan on premise installer is a powerful tool that suits multiple environment scenarios:
Depending on your needs, a different installation approach will be needed. Check this installation guide for details on how to proceed and find the solution that best fits your requirements.
It is mandatory for any host where a Kiuwan on premises service is installed to meet this requirements:
These software is also needed:
Please follow Docker official recommendations when installing Docker. These URLs describe the installation process for different Linux distributions:
We also recommend using the target installation hosts exclusively for Kiuwan services. If you plan running other containers than Kiuwan's in a single-host installation, please make sure that non of them is using the following network:
Please make sure your host machines have connection to this servers when installing Kiuwan on premises:
|https://hub.docker.com||Installing||This is the main Docker server where the needed images will be pulled from.|
|https://static.kiuwan.com||Installing||This is Kiuwan's static content server, needed by the installer to download needed resources.|
You own a Kiuwan on premises Insights license, both for installing and running
|This is Kiuwan's central API endpoint, needed to update Insights vulnerabilities database.|
The following table shows the minimum requirements for each service. Note that these are only minimum requirements. You should take care of giving each service enough resources depending on your system demands.
Note: CPU clock speed and disk speed will affect overal response time.
With the configuration above a system with the following load should give continuous service without problems:
Given the table above, for a single-host installation where no service is externalized the minimum system requirements are:
It is recommended that you overscale these characteristics for the OS to have resources available for itself.
Kiuwan on premise installation process is carried out by our "kiuwan-cluster" tool.
The tool is provided as a tar.gz file. The following table summarizes the resources you will find once the tool distribution is extracted:
|/config/volumes.properties||Configuration file to set where your persistent volumes will reside.|
|/docker/*.sh||Advanced shell scripts to interact with your Kiuwan on premise installation.|
|/logs||The folder where the tool will write installation logs.|
|/ssl||Tools that ease the certificate creation to keep Kiuwan on premise under a secure environment.|
|/user-content||The folder where you will have to put some resources the installation process will need.|
|/volumes||The base persistent volumes (that may be copied to different locations depending on your installation needs).|
|Main shell scripts to interact with your Kiuwan on premise installation.|
The following sections will guide you through the installation process.
This guide will reference two important folders:
Sometimes this folders will be referenced inside command line examples. Please make sure you replace any of them with the needed real path.
Note that it is up to you where this folders will be located.
The first step is to download kiuwan-cluster, the Kiuwan on premises installation tool. It can be downloaded directly from a terminal like this:
This will download to the current directory the latest available installation tool.
Once downloaded you should untar the provided gz file:
tar xvzpf kiuwan-cluster_master.tar.gz
This will untar the installation tool to a folder with extended version information of the tool. For example:
This folder will be referred to as [INSTALL_DIR] through this guide.
In order to be able to start a Kiuwan on premises installation, you will need two license files:
Copy these files to the user-content folder of your installation tool directory (please replace [INSTALL_DIR] with the real location of your installation directory):
cp configq1.zip [INSTALL_DIR]/user-content cp license.zip [INSTALL_DIR]/user-content
Kiuwan on premise needs this exact MySQL driver:
You can download it by executing this command:
Copy the downloaded jar file to the user content folder:
cp mysql-connector-java-5.1.39.tar.gz [INSTALL_DIR]/user-content
The installation tool comes with the base volumes to boot a first installation of Kiuwan on premises. We provide three volumes:
Copy the provided volumes to a location of your desire:
sudo cp -rp [INSTALL_DIR]/volumes/config-shared [VOLUMES_DIR]/config-shared sudo cp -rp [INSTALL_DIR]/volumes/data-shared [VOLUMES_DIR]/data-shared sudo cp -rp [INSTALL_DIR]/volumes/data-local [VOLUMES_DIR]/data-local
Take note of the locations you choose for each volume. You will need these paths for the next installation step.
Edit the file located in [INSTALL_DIR]/config/volumes.properties and set the previous paths to each property:
config.shared=[VOLUMES_DIR]/config-shared data.shared=[VOLUMES_DIR]/data-shared data.local=[VOLUMES_DIR]/data-local
Please remember that [VOLUMES_DIR] here is just a placeholder for the real path you chose.
Kiuwan needs an working and accessible e-mail server to send notifications.
Edit with your favourite editor the main configuration file, found in your [VOLUMES_DIR]:
sudo vim [VOLUMES_DIR]/config-shared/globalConfig.properties
Note that this is the file located in your [VOLUMES_DIR], not in the [INSTALLER_DIR], which only contains the base volumes.
Edit the following properties under the section named "Kiuwan instances shared configuration":
kiuwan.mail.host: the host of your email server.
kiuwan.mail.port: the port of your email server.
kiuwan.mail.username: the username to use when authenticating with your email server.
kiuwan.mail.password: the password to use when authenticating with your email server.
kiuwan.mail.from: the email account to use as the sender.
Follow this section if you want to proceed and install Kiuwan on premise with no further customization.
The defaults will install Kiuwan on premise with these characteristics:
If this is enough for you, just continue with the following steps.
On a terminal, navigate to the [INSTALL_DIR] folder and execute this command:
This will copy the user-content files to the configured volumes and set the needed permissions.
On a terminal, navigate to the [INSTALL_DIR] folder and execute this command:
Once the installation is finisished please refere to the Installation guide section.
All configuration properties you can edit are located in this file located inside your data-shared volume:
Here is a complete list of the properties you can configure and their meaning (default passwords are ommited):
|kiuwan.protocol||https||Kiuwan default access protocol|
|kiuwan.domain||kiuwan.onpremise.local||Kiuwan default domain|
|kiuwan.port||443||Kiuwan default access port|
|kiuwan.mail.host||Email server host|
|kiuwan.mail.port||Email server port|
|kiuwan.mail.username||Email server username|
|kiuwan.mail.password||Email server password|
|kiuwan.mail.from||Email account you want Kiuwan to use when sending emails|
|kiuwan.default.mail.account||Email account to set to the built-in Kiuwan users|
|Kiuwan instances shared configuration|
|timezone||Europe/Madrid||Kiuwan servers timezone|
|Kiuwan front instances configuration|
|kiuwan.nodes.front.max.memory||1024m||Max memory to set to front instances|
|session.timeout||3600||Time a session can be inactive before close it (in seconds)|
|session.secure||false||Use the secure attribute of the session cookie|
|session.httponly||false||Use the httponly attribute of the session cookie|
|Kiuwan analyzer instances configuration|
|kiuwan.nodes.analyzers.max.memory||1024m||Max memory to set to analyzer instances|
|queues.reportsGeneratedQueueSize||2||Number of slots enabled for analysis processing|
|Kiuwan scheduler instances configuration|
|kiuwan.nodes.schedulers.max.memory||1024m||Max memory to set to front instances|
|Kiuwan file repositories configuration|
|centralFileRepository.type||filesystem||Central file repository storage type [filesystem|s3]|
|sourceCodeFileRepository.type||filesystem||Source code repository storage type [filesystem|s3]|
|Amazon S3 bucket configuration (only applies when using AWS S3 type repositories)|
|s3.privateBucket.bucketName||S3 bucket name|
|s3.privateBucket.subDirectoryName||S3 subdirectory name|
|s3.privateBucket.accessKeyId||Access key id|
|s3.privateBucket.secretKeyId||Secret key id|
|s3.dir.centralFileRepository||Central file repository directory|
|s3.dir.sourceCodeFileRepository||Source code file repository directory|
|mysql.host||mysqlkiuwan||MySQL server host|
|mysql.port||3306||MySQL server port|
|mysql.username||csaas||MySQL server username|
|mysql.password||MySQL server password|
|mysql.config.useSSL||false||Enable or disable the use of encryption when connecting to MySQL|
|mysql.config.requireSSL||false||Force the use of encryption when connecting to MySQL|
|mysql.config.verifyServerCertificate||false||Force the validation of the certificate served MySQL|
|Redis Cluster cache and store configuration|
|redis.[cache|store].nodes||redis_0000[1-6]:6379||Redis nodes hosts (use the provided single host name when using elasticache)|
|redis.[cache|store].timeout||2000||Redis connection timeout|
|redis.[cache|store].clientName||Redis client name|
|java.keystore.password||Java keystore password. This must be aligned with the generated keystore password (in case you change the default Kiuwan host name)|
|java.truststore.password||Java truststore password. This must be aligned with the generated truststore password (in case you change the default Kiuwan host name)|
To access your Kiuwan on premises installation you should take into account whether the selected domain is available in the DNSs your local network may use.
In order to access Kiuwan you will need to do one of the following options:
For testing purposes or if you choose the second option, edit this file in the host where you plan to access Kiuwan from:
Add the following entry to the previous file:
For example, the previous entry may look like this for an installation pointing to the default host (note that the IP of the example may change in your local network):
Note that although installation proccess may have finished, the Kiuwan servers may need some minutes to start up. Please wait if you receive a "404 - Not Found" error message when accessing Kiuwan on premise.
Once the previous steps have been done, you should be able to access Kiuwan on premises entering your Kiuwan host in your browser:
Kiuwan on premises installer tool provides default certificates for the default host name, signed by a supplied CA (Certificate Authority).
The CA public certificate is provided in this file:
In order to make your browser trust the supplied certificates, you will need to add this CA to your browser, and Java clients that access your Kiuwan on premises installation:
Kiuwan on premise supplies two user accounts:
Please make sure you change these passwords as soon as possible accessing the upper right menu option "Account management", section "Change password".