Notes on intentionally Air-Gapping an IEM Installation
Premise
We need to install IEM in such a way that it cannot automatically update content from IBM.
Reasons
- Strict adherence to ITIL Change Management Controls.
- Requirement that even though IBM is actively developing the OS Deployment abilities in IEM, our group that Manages Workstation/Laptop images is insisting on a stable environment.
IBM Documentation Links
Random Thoughts
From reading the IBM Documentation, it looks like the assumption with an Air-Gapped environment is that the server is not able to access the Internet at all, thus it cannot access neither the IBM Fixlet content not the Vendor Patch content itself.
What I'm going to be trying to do is 'trick' the server into thinking that it cannot find the server that hosts the IBM Fixlet Content, but leave it able (hopefully) to access the actual Patch content from the Vendors sites.
I believe that all I need to do is create an entry in the 'hosts' file that redirects the sites below to 127.0.0.1 or some other address where the server cannot find the IBM Fixlet content.
- http://sync.bigfix.com - I believe this is the current Content source site.
- http://www-01.ibm.com/support/docview.wss?uid=swg21468445 - References unfiltered access to http://sync.bigfix.com as being required for proper operation.
- IBM IEM General Troubleshooting Methods refers to needing access to http://sync.bigfix.com for proper Gather processes to function.
- http://bigfix-2kserv.bigfix.com - I have found references to this server in several of the IBM Wiki pages, but it doesn't appear to be active any longer.
Utilities
- Air-Gap.exe tool
Procedures
- Avoid Downloading content in the Baremetal OS Deployment site when downloading Fixlets and Tasks using the Air-Gap.exe tool
- Generate the XML file with the Air-Gap.exe tool
- Remove reference to the Baremetal OS Deployment site
- Gather content from IBM on a different machine that can access http://sync.bigfix.com
- Import the content into the Air-Gapped server.
