[KB7805] Maintain updates using ESET PROTECT On-Prem in an offline environment

Windows server with Microsoft IIS

1. Copy the whole folder downloaded by Mirror Tool to C:\inetpub\wwwroot.

2. Enable Directory Browsing in IIS Manager.

3. Add MIME type with extension * as text/plain.

   

   Unable to read the extension

   If ESET PROTECT On-Prem is unable to read the added extension, edit web.config in the IIS root folder and add a line with fileExtension=".".

   <?xml version="1.0" encoding="UTF-8"?>
   <configuration>
       <system.webServer>
           <directoryBrowse enabled="true" />
           <staticContent>
               <mimeMap fileExtension=".*" mimeType="text/plain" />
               <mimeMap fileExtension="." mimeType="text/plain" />
           </staticContent>
       </system.webServer>
   </configuration>

Windows server with ESET Bridge (distributed with ESET PROTECT On-Prem)

1. Install ESET Bridge (ESET PROTECT On-Prem)

2. Using a simple text editor, open the pkgid file from C:\Program Files\ESET\Bridge. Change the http_proxy_settings_static_content_enabled setting to true to activate the offline repository server. Save the changes and close the pkgid file.

3. Copy the downloaded repository to the offline repository server directory:

   • The default location of the offline repository server directory is C:\ProgramData\ESET\Bridge\OfflineRepository with proper access rights.
   • To use a custom directory, create a new folder for the offline repository (for example, C:\Repository). In the pkgid file, replace the line "http_proxy_settings_offline_repository_dirPath": "%DATADIR%\\OfflineRepository" with "http_proxy_settings_offline_repository_dirPath": "C:\\Repository". The NETWORK SERVICE user needs full access rights to the directory.
     
     

4. Restart the ESET Bridge service using the command line commands: net stop "EsetBridge" and net start "EsetBridge". You must restart the service only after changing the pkgid file—the service restart is unnecessary when the repository data is changed, deleted, or added.

5. The offline repository runs on the address http://YourIPaddress:4449 (for example, http://10.1.1.10:4449).

Linux and ESET PROTECT Virtual Appliance (CentOS) with ESET Bridge

1. Install ESET Bridge (HTTP Proxy) on Linux.

2. Using a simple text editor, open the pkgid file from /opt/eset/bridge/etc. Change the http_proxy_settings_static_content_enabled setting to true to activate the offline repository server. Save the changes and close the pkgid file.

3. Copy the downloaded repository to the offline repository server directory:

   • The default location of the offline repository server directory with proper access rights is:

     /var/opt/eset/bridge/OfflineRepository

   • To use a custom directory, create a new folder for the offline repository:

     /var/opt/CustomOfflineRepository

     In the pkgid file, replace the line:

     http_proxy_settings_offline_repository_dirPath": "%DATADIR%\\OfflineRepository

     with:

     http_proxy_settings_offline_repository_dirPath": "/var/opt/CustomOfflineRepository

     The NETWORK SERVICE user needs full access rights to the directory.

4. Restart the ESET Bridge service using this terminal command:

   sudo systemctl restart EsetBridge.service

   You must restart the service only after changing the pkgid file—the service restart is unnecessary when the repository data is changed, deleted, or added.

5. The offline repository runs on the address http://YourIPaddress:4449 (for example, http://10.1.1.10:4449).

SELinux (applicable on Linux and ESET PROTECT Virtual Appliance)

SELinux can block the other devices from accessing the repository machine. Add an exception for the repository/updates files location or disable the SELinux.

To turn off this feature, follow the steps below:

1. Open /etc/selinux/config in your editor, find and set the following value:

   SELINUX=disabled

2. Restart the system (machine) to apply the changes.

Open ports 4449 and 3128 on Linux or VA firewall

When using the ESET PROTECT Virtual Appliance, use Webmin to add port 4449 to the rule where 3128 is already listed, and save the configuration.

If you prefer the Linux Console, use the following command to do the same:

iptables -A INPUT -p tcp --dport 4449 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 4449 -j ACCEPT
service iptables save
service ip6tables save

Server settings

1. Open the ESET PROTECT Web Console.

2. Click More → Settings and expand Advanced Settings.

3. In the Server field under Repository, type your web server address.

   

4. Expand Updates.

5. In the Update server field, type your web server address and click Save.

   Use the correct path for each application

   For the Update server settings, always type the full path according to the application you are setting up. For ESET PROTECT On-Prem, use folder era6:
   http://update.server.local/mirror-final/eset_upd/era6/

   

Agent policy

You need to apply the new settings to all machines (their Agents) that are using the offline server for updates and repositories. Select a suitable policy or create a new one and assign it to those machines.

1. Open the ESET PROTECT Web Console.

2. Open Policies.
   

3. Click the appropriate policy and click Edit.

4. In the policy Settings section, expand Advanced settings.

5. In the Server field under Repository, type your web server address.

   

6. Expand Updates.

7. In the Update server field, type your web server address and click Save. Ensure to type the entire address, including the folder structure, according to the application you are setting up.

   

Policies for ESET Endpoint applications (on Windows)

You need to apply the new settings to all machines (their ESET security applications) that are using the offline server for updates. Select a suitable policy or create a new one and assign it to those machines.

1. Activate ESET Endpoint applications in the offline environment.

2. Open the ESET PROTECT Web Console.

3. Open Policies.
   

4. Click the appropriate policy and click Edit.

5. In the policy Settings section, click Update → Profiles → Updates → Modules Updates.

6. Disable the toggle next to Choose automatically.

7. Type your web server address in the Custom server field and click Finish. Ensure to type the entire address, including the folder structure, according to the application you are setting up. The example image below shows the ESET Endpoint folder address.

   Use the correct path for each application

   For the Custom server settings, always type the full path according to the application you are setting up. For example: http://update.server.local:8080/mirror-final/eset_upd/ep12

   The last folder in the path should be one of the following:

   Folder Name	Updated applications
   ep11	ESET Endpoint 11.x
   ep12	ESET Endpoint 12.x

   

Other applications

If necessary, create policies for any ESET application similar to the examples shown above.