[KB7805] Best practices for using the ESET PROTECT On-Prem in an offline environment

Windows server with Microsoft IIS

1. Copy the whole folder downloaded by the Mirror tool to C:\inetpub\wwwroot.

2. Enable Directory Browsing in IIS Manager.

3. Add MIME type with extension * as text/plain.

   

    

   Unable to read the extension

   If ESET PROTECT On-Prem is unable to read the added extension, edit web.config in the IIS root folder and add a line with fileExtension=".".

   <?xml version="1.0" encoding="UTF-8"?>
   <configuration>
       <system.webServer>
           <directoryBrowse enabled="true" />
           <staticContent>
               <mimeMap fileExtension=".*" mimeType="text/plain" />
               <mimeMap fileExtension="." mimeType="text/plain" />
           </staticContent>
       </system.webServer>
   </configuration>

Windows server with ESET Bridge (distributed with ESET PROTECT On-Prem)

1. Install ESET Bridge (ESET PROTECT On-Prem)

2. Using a simple text editor, open the pkgid file from C:\Program Files\ESET\Bridge. Change the http_proxy_settings_static_content_enabled setting to true to activate the offline repository server. Save the changes and close the pkgid file. 

3. Copy the downloaded repository to the offline repository server directory: 

• The default location of the offline repository server directory is C:\ProgramData\ESET\Bridge\OfflineRepository with proper access rights.
• To use a custom directory, create a new folder for the offline repository (for example, C:\Repository). In the pkgid file, replace the line "http_proxy_settings_offline_repository_dirPath": "%DATADIR%\\OfflineRepository" with "http_proxy_settings_offline_repository_dirPath": "C:\\Repository". The NETWORK SERVICE user needs full access rights to the directory.

4. Restart the ESET Bridge service using the command line commands: net stop "EsetBridge" and net start "EsetBridge". You must restart the service only after changing the pkgid file—the service restart is unnecessary when the repository data is changed, deleted or added.

5. The offline repository runs on the address http://YourIPaddress:4449 (for example, http://10.1.1.10:4449).

Linux and ESET PROTECT Virtual Appliance (CentOS) with ESET Bridge

1. Install ESET Bridge (ESET PROTECT On-Prem)

2. Using a simple text editor, open the pkgid file from /opt/eset/bridge/etc. Change the http_proxy_settings_static_content_enabled setting to true to activate the offline repository server. Save the changes and close the pkgid file. 

3. Copy the downloaded repository to the offline repository server directory: 

• The default location of the offline repository server directory is /var/opt/eset/bridge/OfflineRepository with proper access rights.
• To use a custom directory, create a new folder for the offline repository (for example, /var/opt/CustomOfflineRepository). In the pkgid file, replace the line "http_proxy_settings_offline_repository_dirPath": "%DATADIR%\\OfflineRepository" with "http_proxy_settings_offline_repository_dirPath": "/var/opt/CustomOfflineRepository". The NETWORK SERVICE user needs full access rights to the directory.

4. Restart the ESET Bridge service using this terminal command: sudo systemctl restart EsetBridge.service. You must restart the service only after changing the pkgid file—the service restart is unnecessary when the repository data is changed, deleted or added.

5. The offline repository runs on the address http://YourIPaddress:4449 (for example, http://10.1.1.10:4449).

SELinux (applicable on Linux and ESET PROTECT Virtual Appliance)

SELinux can block the other devices from accessing the repository machine. Add an exception for the repository/updates files location or disable the SELinux.

To turn off this feature, follow the steps below:

1. Open /etc/selinux/config in your editor, find and set the following value:

   SELINUX=disabled

2. Restart the system (machine) to apply the changes.

Open ports 4449 a 3128 on Linux or VA firewall

1. When using the ESET PROTECT Virtual Appliance, use Webmin to add port 4449 to the rule where 3128 is already listed, and save the configuration.
   

   

If you prefer the Linux Console, use the following command to do the same:

iptables -A INPUT -p tcp --dport 4449 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 4449 -j ACCEPT
service iptables save
service ip6tables save

Server settings

1. Open ESET PROTECT On-Prem in your web browser and log in.

2. Navigate to More → Settings → Advanced Settings → Repository.

3. Type your address in the Server field.

   

4. Navigate to the Updates section.

5. Type your offline server's address in the Update server field and click Save. Type the whole address with the folder structure, according to the product you are setting up.

   

Agent policy

You need to apply the new settings to all machines (their Agents) that are using the offline server for updates and repositories. Select a suitable policy or create a new one and assign it to those machines.

1. Open ESET PROTECT On-Prem in your web browser and log in.

2. Navigate to Policies.
   

3. Select the appropriate policy.

4. In the policy Settings section, navigate to → Advanced Settings → Repository.

5. Type your address in the Server field.

   

6. Navigate to Updates section.

7. Type your offline server's address in the Update server field and click Save. Ensure you type the whole address with the folder structure, according to the product you are setting up.

   

Policies for ESET Endpoint products (on Windows)

1. Activate ESET Endpoint products in the offline environment.

You need to apply the new settings to all machines (their ESET security products) that are using the offline server for updates. Select a suitable policy or create a new one and assign it to those machines.

2. Open ESET PROTECT On-Prem in your web browser and log in.

3. Navigate to Policies.
   

4. Select the appropriate policy.

5. In the policy Settings section, navigate to → UPDATE → Profiles → Updates → Modules Updates.

6. Disable the toggle next to Choose automatically.

7. Type your offline server's address in the Custom server field and click Finish. Make sure to enter the whole address with the folder structure, according to the product you are setting up. The example image below shows the ESET Endpoint folder address.