Linux OS patches for FREL

Hello M,

This feature is beyond CMR stage and being worked on. You can expect it within a future feature release.

-Evan

Hi, yes, that is planned for future feature release. Till that time, please use ‘automatic OS updates’ option part of FREL deployment which has internet connection to get os updates.

https://documentation.commvault.com/11.23/expert/32011_deploying_vmware_file_recovery_enabler_for_linux.html

Regards

Gopinath

Hi @Evan@Commvault  @Gopinath:

what is the FR number plan for this? Will this be 25?

In our environment that won’t work because these FREL are in a secure zone without any internet access. That the reason that we want to have this embedded within the Commvault software repository 

HI Team, @Gopinath @Evan@Commvault , @Mike Struening 

Do you have any latest update on this topic? we are facing same issue where our frels are not connected with internet and we are pushed to remediate PKEXE vulnerability - can you suggest how do we patch the frels in CentOS? does only redeploy works?

Appreciate your respond. 

Thankyou!

I’ll defer to @Gopinath and reach out internally!

Hi Ashok,

For PKEXE vulnerability, you can update polkit from download it separate and copying to to FRELs or from mounting your local repo on to FREL and use in updating that polkit package.

Regards

Gopinath

we have updated FREL from 11.20.85 to 11.24.29. We have many OS vulnerabilites. So we are planning for re-deploying FREL with new OVA (11.24) provided by Commvault, so that it will have updated OS (CentOS 8.4 I guess with security patches). This will clear up all our vulnerabilities. 

I have manually updated Commvault version on FREL from 11.20.85  to 11.24.29. But OS patches still needs to be applied. If Commvault can make available all FREL related patches on Commvault software repository which will help us to manually download and install it on our FREL. This would be great help and great improvement. 

@Arvind Satyanarayan Bingi FR 11.20 FREL is CentOS 7.x based and FR 11.24 FREL is OEL 8.4 based, yes it will cover most vulnerabilities. This needs a re-deploying as you planned, which also has XFS 5 file system support that required for RHEL/CentOS/OEL 8.x VM’s live file browse.

yes, OS updates with CV software cache is on road map for future FRs which will be good enhancement.

Regards

Gopinath

Thanks Gopinath for the update and clarification. 
We all are waiting for this new improvement. Great going.

CV  Team,

We have raised FREL re-deployment ticket to get new  OVA for 11.24 deployed . That is providing OEL 8.4. Before 11.24 it was CentOS i guess.

Is there any plan to change OS again in any of the feature released ? 

Is there any chance to get OS patches included in 11.24 software repository ? 

This for us to fix any future OS vulnerabilities. So keeping OS vulnerabilities in mind is Commvault taking any preventive measures ?

Hi,

From FR24 onwards it will be OEL based only, OS will not be changed in future FRs. Adding OS updates with CV software cache is on road map for future FRs not possible with old FRs.

Regards

Gopinath

Ok. Please keep us posted as soon as you will have  any further updates on it.

@Gopinath 

Can we get our FREL OS regularly patched ? 

This will  require BigFix  agent installation and its connectivity to BigFix. 

So can we install BigFix agent too on our FREL to get it reported to BigFix console so that it can be regularly patched ?

@Gopinath@Mike Struening 

are there any updates on this? 

Just tried in a customer environment the new deploy feature for the FREL. But now get with the offline methode been configured that it still try to download the FREL OVA from internet. It would be intresting if a new “re-deploy” feature will be added to this lifecycle a FREL in case of big changes in OS what can’t be done easily with linux updates.

Hi,

Adding OS updates with CV software cache is on road map for future FR.

Regards

Gopinath

hello

any chance to get the at least some timeframe?

yours

josef

Hi,

we can not commit on specific FR but mostly around Dec 2022 release timeframe, if all dev/test efforts and other complete by that time.

Regards

Gopinath

and progess on this?

regards

josef

@cheese see the releases notes of FR2023 → https://documentation.commvault.com/2023/essential/148771_newsletter_for_new_features_in_commvault_platform_release_2023.html#updating-os-for-linux-access-node-file-recovery-enabler-for-linux-or-frel

any progress with “Adding OS updates with CV software cache is on road map for future FR”

I though it was added to FR30 and the documentation/releases notes also mention it, but only as of FR32 there is real documentation see: https://documentation.commvault.com/2023e/essential/156304_updating_os_for_linux_frel_clients.html

I just created a topic on the community as I opted back in the past to instead of introducing a OS update function to introduce an automated FREL appliances refresh option that basically redeploys a FREL with a newer version while preserving the current configuration using a one-button approach. This makes the appliances remain a standardized and secured appliance. See also: 

• Upgrading existing FREL appliances to FR32 might fail in case FREL appliance cannot access public Internet

Onno van den Berg wrote:

I though it was added to FR30 and the documentation/releases notes also mention it, but only as of FR32 there is real documentation see: https://documentation.commvault.com/2023e/essential/156304_updating_os_for_linux_frel_clients.html

I just created a topic on the community as I opted back in the past to instead of introducing a OS update function to introduce an automated FREL appliances refresh option that basically redeploys a FREL with a newer version while preserving the current configuration using a one-button approach. This makes the appliances remain a standardized and secured appliance. See also: 

• Upgrading existing FREL appliances to FR32 might fail in case FREL appliance cannot access public Internet

 

thanks for your quick answer. we already installed FREL with Version 32 and noticed that it tried to connect to an external site to get OS-Updates, which is - in our case - not allowed as we dont want systems to connect to external sites neither directly without a proxy, nor indirect - with a standard-http-proxy. we would have preferred the last option, that commcell has the os-updates,  too. our commcell can connect to those extern site, but this was some kind of a hazzle to get allowed.

I would prefer monthly or bi-monthly refreshes of the OVA template to be released on a repository that can be pulled it automatically or manually. This way Commvault can fully grant and preserve the security and stability of the FREL OVA appliance. I think in the end if customers would embrace this that it would really benefit the overall user experience for each and every customer.