000029295 - How to apply a temporary license to a service if  the RSA NetWitness UI is unavailable

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000029295
Applies ToRSA Product Set: Security Analytics
RSA Product/Service Type: Decoder, Log Decoder, Concentrator, Hybrid, Broker, Malware Broker, All-in-One, Security Analytics Server
RSA Version/Condition: 10.3.2, 10.3.3, 10.3.4, 10.3.5, 10.4.X
Platform: CentOS
O/S Version: CentOS 5, CentOS 6
IssueIt is necessary to apply a temporary license to a security analytics service running 10.3 SP2 or later when the SA UI is not available.
This is particularly useful if the SA Server is being RMA'd and a service becomes unlicensed.
ResolutionUse python scripting language to interface with the service's REST interface.
The example below shows how a 10.4 concentrator service would be licensed.
Assumptions used by commands below:
  • Concentrator appliance IP address is 192.168.55.6
  • Concentrator service listens on the following REST port: 50105/TCP
  • The credentials are default
  • The trial bin directory is in the same directory from which the python interpreter is launched
Follow the steps below to license the service.
  1. Obtain the trial license from RSA Support.
  2. Transfer the file to the appliance using WinSCP, FileZilla, or your preferred file transfer client.
  3. Apply trial license bin file to service using the python interpreter with the commands below.
    [root@Concentrator ~]# python
    Python 2.6.6 (r266:84292, Jan 22 2014, 09:42:36)
    [GCC 4.4.7 20120313 (Red Hat 4.4.7-4)] on linux2
    Type "help", "copyright", "credits" or "license" for more information.
    >>> import requests
    >>> licensecmd = 'http://192.168.55.6:50105/sys/license?msg=trial'
    >>> cred = ('admin', 'netwitness')
    >>> header = {'Content-Type': 'application/octet-stream'}
    >>> payload = open('./31Jan2017_90DAY_smcConcentrator_2330_Trial.bin','rb')
    >>> r = requests.post(licensecmd, auth=(cred), data=payload, headers=header)
    >>> restartcmd = 'http://192.168.55.6:50105/sys/license?msg=trial'
    >>> restartsrv = requests.get(restartcmd, auth=(cred))

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.
NotesOnly services which support licensing via REST can be licensed this way. This includes: broker, concentrator, log decoder and packet decoder services. This includes the broker services present on SA Security Analytics Server, SA Malware Analysis & SA Archiver appliances.
If the Security Analytics service is running version 10.3 SP1 or earlier, then this method cannot be used as there is no support for temporary licensing.
Installing python-requests RPM
The python request module needs to be installed to use this under 10.3.X
The needed RPMs from the 10.4.0.256B buildstick can be found in this link.
  1. Transfer python_requests.tar.bz2 to appliance
  2. Decompress using the command:
    tar xvjf python_requests.tar.bz2

  3. Install RPMs using the command:
    yum localinstall python-backports-1.0-3.el6.x86_64.rpm python-backports-ssl_match_hostname-3.4.0.2-1.el6.noarch.rpm python-chardet-2.0.1-1.el6.noarch.rpm python-ordereddict-1.1-2.el6.noarch.rpm python-six-1.5.2-1.el6.noarch.rpm python-urllib3-1.5-7.el6.noarch.rpm python-requests-1.1.0-4.el6.noarch.rpm

Attachments

    Outcomes