Skip to main content

Installation without internet

Video walkthrough: Install DerScanner on a Server Without Internet — DerSecur Control Panel (YouTube).

This process has two locations: an internet-connected server prepares the delivery folder, and the closed target server installs from it. Preparing the folder does not install DerScanner on the preparation server. You prepare the folder yourself, for your own module set: in the wizard (below) or with sudo dcp pack prepare on the console.

Prepare the folder on a server with internet​

  1. Open the installation wizard on the preparation server. At the initial country step, choose the country where the target installation will be used. The panel language can be changed independently.
  2. In the source choices select Prepare for a server without internet. Check the explanation that files will be downloaded here and moved to the closed server.
  3. Read the Version shown in the preparation form. This form presents the available delivery version; do not assume there is a selector for any historical release. Confirm that the offered version is the one required on the target.
  4. Review the contents. The base is included. Explicitly select each offered scanner required on the target; optional modules are not automatically selected. If selecting SCA, read the SCA database information as part of its size requirement.
  5. Check the selected-module summary. A module omitted from the folder cannot later be installed from that folder alone.
  6. If a verified registry account is already shown, confirm its username. Otherwise enter the Login and Password issued by DerSecur, then press Check the account. Correct errors before proceeding.
  7. Wait for the preparation estimate. Read the total download size, estimated time and disk-space result. Preparation can need more working space than the final folder size. Free space on the preparation server before starting if required.
  8. Press Prepare the folder once. Follow the download and verification progress. Keep the server running and its internet connection available.
  9. If preparation stops, use the offered continuation action after resolving the cause. The process reuses downloaded content; do not treat a partial folder as ready for transfer.
  10. Wait for The folder for the server without internet is ready. Record the exact folder path, version, edition and modules shown. The folder is created in the home-directory location reported by the wizard. Preparation also writes the folder fingerprint to a text file beside the folder (the folder name with .FINGERPRINT.txt added; the file is never inside the folder); dcp pack prepare prints it as well. Note the fingerprint and keep it apart from the folder.

The registry account is not included in the folder. Keep access credentials available separately. The DerSecur signature is checked during the download and again on the target.

What the checks of a folder cover​

  • The release description and the images in the folder are checked against the DerSecur signature during preparation and again on the target. The folder as a whole has no signature of its own. DCP checks every file named in the folder's checksum list (PACK.SHA256SUMS), and the folder fingerprint lets you see whether the folder changed on its way.
  • Files in the folder that the checksum list does not name are ignored: DCP does not read, stage or install them.
  • The operating-system Docker packages (.deb, .rpm) of a prepared folder are protected by that list only. A person who can change the folder can change a package together with its checksum, and DCP then accepts it. The fingerprint comparison is what reveals such a change; DCP does not ask for it and does not refuse a folder because of it.
  • Therefore keep the folder under your control from preparation to installation, move it by a route you trust, and before every use compare the fingerprint shown on the closed server with the one you noted. A different fingerprint means the folder was changed on its way: do not use it, prepare it again. dcp pack verify does not check the Docker packages of such a folder against a DerSecur signature.

Prepare the folder on the console​

An administrator can prepare the same folder without the wizard, on a server with internet:

sudo dcp pack prepare --release 13.2.11 --edition international \
  --modules sast,dast,sca --registry-user LOGIN --dry-run
sudo dcp pack prepare --release 13.2.11 --edition international \
  --modules sast,dast,sca --registry-user LOGIN

Replace LOGIN with the login issued by DerSecur and the module list with the modules the target needs; dcp asks for the password and never prints it. The dry run shows the download size and the space needed without downloading. --release 13.2 takes the newest version of the line in the registry. At the end the command prints the folder path and the folder fingerprint and writes the fingerprint to <folder>.FINGERPRINT.txt beside the folder. Before the installation, compare the fingerprint that dcp install and the wizard show on the closed server with this one.

Transfer the complete delivery​

  1. Copy the entire ready folder, including its installation script, metadata and all content files, to an approved disk, removable medium or internal network location.
  2. Copy it onto the target server or connect and mount the disk there. Make sure the target can read every file and has enough local working space for installation; space on the transport disk is not a substitute for Docker storage.
  3. Preserve the directory contents and structure. Do not extract selected images and discard the rest of the folder.
  4. Keep the source copy until transfer is complete and the target can verify its contents. Do not remove the transfer disk while the target is verifying or using files.

Start the target panel from the folder​

  1. Connect to the closed target with administrator access and confirm the hostname.
  2. Change into the copied delivery folder and run:
sudo sh install.sh
  1. Open the target panel address or sign-in link printed by the script. Check that you are opening the target, not the preparation server.
  2. Follow the panel sign-in instructions using the registry account issued by DerSecur. If the wizard requests account details because this panel does not yet have an account, enter them there. An existing panel account does not need to be created again. On a server without internet the login and password cannot be checked: the first login and password you type become this panel's account, and later only they work. Type the login and password issued by DerSecur carefully.
  3. The delivery can determine the edition. If an initial country screen is shown, choose the actual country and continue before the server checks.
  4. If the server already has DerScanner, use the offered update route. A delivery for updating an existing installation must be handled through the update procedure, not a fresh installation.

Select, verify and install the local files​

  1. On a new target select From the delivery folder. The wizard lists folders it finds on the server and accessible media; this is not a field where you type an arbitrary path.
  2. If no folder is found, confirm that the complete folder is present on this server. A home directory is a suitable location. Have the administrator mount the disk if necessary and press Refresh.
  3. Select the intended folder from the list. Check its displayed path, version, edition and included modules. For a folder you prepared yourself, also compare the Folder fingerprint shown beside it with the one you noted at preparation. Resolve a version mismatch before continuing.
  4. Read its verification state. Wait for signature and file verification to finish. A pending check or a failed signature is not permission to install; replace or restore the delivery as directed by the error.
  5. Review the server checks and the modules to be installed. Choose only modules included in the folder and supported by the target.
  6. If Docker is absent, use the offered installation action. The wizard can wait for folder verification before installing Docker. Wait for Docker and resource checks to complete.
  7. Press Install DerScanner once and follow the same installation-progress and completion procedure as for an online installation.
  8. On completion, obtain the generated admin password, open the product address, and activate the licence using this target's Installation ID. Transfer the licence file into the closed environment through your approved process.

If the source folder must later be removed, do so only after installation no longer uses it. Retain the required delivery and recovery materials according to your maintenance policy.