Manually upgrading openSUSE to Leap 16 -

Manually upgrading openSUSE to Leap 16 -

Applies to

Alert
Cryptshare Appliance with openSUSE 15.6

Problem

The operating system is not up to date and may have unpatched security vulnerabilities.

Cause

No regular OS updates made via the Cryptshare Server Admin Interface when these were available.

Solution/Workaround

Warning
Backup of the entire system
It is highly recommended to make a full backup/snapshot of the server in order to be able to restore the state before the first update steps were made.

Upgrade Preparation Step: Migrate SSH access before starting the upgrade process

With openSUSE Leap 16, by default it is no longer possible to use password authentication with the root user over SSH. The workaround is to either setup an SSH key for the root user, or create a second user and use sudo with it.

Option 1 — SSH Key Authentication for Root (Recommended)

Replace password login with key-based authentication for the root user.

    1. On the client machine, generate an SSH key pair (if not already available):
      1. ssh-keygen -t ed25519
    2. Copy the public key to the target server:
      1. ssh-copy-id root@<server-ip>
    3. Verify key-based login works before upgrading:
      1. ssh root@<server-ip>
    Option 2 — Create a Non-Root User with sudo Privileges

    Use a non-root account for remote access post-upgrade.
    1. Create a new user:
      1. useradd -m -s /bin/bash -c "Test User" testuser
      2. sudo passwd testuser
    2. Grant sudo privileges:
      1. usermod -a -G wheel testuser
    3. Verify the user can log in via SSH and run sudo commands before upgrading.

    Step 1: Updating the existing operating system to the latest version

    - Log in as root on the appliance

    - Stop the Cryptshare service with the command
    1. systemctl stop cryptshare

    - Run the following commands, to install current patches
    1. zypper refresh
    2. zypper up -t patch

    - Execute the following command as often as necessary until you receive the message “Nothing to do.”
    1. zypper up -t patch

    Step 2: Repair RPM database

    On older systems, the RPM database can cause problems during the upgrade to Leap 16. To mitigate this, run these commands to fix any problems and to set the database backend to "ndb":
    1. rpm -qa | wc -l
    2. rpmdb --verifydb
    3. rpm --define='%_db_backend ndb' --verbose --rebuilddb
    4. sed -ri 's/^(%_db_backend[[:space:]]+)bdb$/\1ndb/g' /usr/lib/rpm/macros

    Step 3: Manually OS upgrade to openSUSE Leap 16

    - Download the scripts needed for the upgrade

    - Run the following command to back up your current network configuration
    1. sh pre-upgrade-network-backup.sh

    - Run the following command, to add the new repositories for Leap 16
    1. sh addRepo-16.0.sh

    - Run the following command, to perform the OS upgrade
    1. zypper --releasever 16.0 dup

    - Wait for the process to finish

    - Run the post migration network configuration backup script
    1. sh post-upgrade-network-backup.sh

    - Run the commands
    1. sync
    2. reboot

    - after rebooting log in again as root

    - check the OS version with
    1. hostnamectl
    The following output should be shown:

    - run the following command, to reset the OS update notifications
    1. rm /opt/cryptshare-3/CS_EXECUTION_SERVICE_INDEX

    Step 3: Starting Clamd

    The Clamd service might not start correctly after the upgrade. To fix this, run these two commands:
    1. systemctl start clamd
    2. systemctl enable clamd

    Potential issues during the upgrade

    I receive notifications that the temp folder is full
    This is caused by the /tmp directory being no longer persistent, while still being configured as the temp directory.

    To fix this, ensure that the directory configured in the launcher.ini, and on the System Events in the Admin interface match, and are not /tmp.

    Alert
    We highly recommend updating the application's temporary folder configuration by following the instructions here: System Startup Configuration – Temporary Folder.
    Please note that the application's  temporary directory path must also be updated in the     System Events within the Admin Interface to ensure system alerts reflect the correct directory.

    The Cryptshare server is unreachable after the upgrade
    In some cases, the integrated firewall will be activated after the upgrade and block everything.
    To fix this, you need to open at least these three ports:
    1. firewall-cmd --add-port=8080/tcp --permanent
    2. firewall-cmd --add-port=443/tcp --permanent
    3. firewall-cmd --add-port=22/tcp --permanent
    To apply these settings, run
    1. firewall-cmd --reload
    Depending on your setup, additional ports might need to be opened. You can check the default ports for Cryptshare here: 
    There is a package conflict during the upgrade process
    On some systems, package conflicts with "tlp" and "tuned" might occur. Usually, it is because some old versions for Leap 15.6 are not removed automatically, causing these errors. Both packages can be safely removed from the server.

    You can reach out to us if you receive errors regarding other packages to confirm which option to choose.

    Example of conflict with "tlp" and "tuned":
    In this case, "Solution 2: deinstallation of tlp-1.6.1-bp156.1.2.noarch" should be selected. In most cases, you will get a similar message regarding the tuned package immediately after this. There, select the solution to remove the package "tuned-2.10.0.150600.28.3.1.noarch".
    Running Zypper commands after the upgrade shows an error saying "Repository already exists"
    In some cases, there is a conflict with the package "openSUSE-repos-Leap" causing these issues. Removing it fixes the issue.

     

      • Related Articles

      • Upgrading the distribution from openSUSE Leap 15.6 to 16.0

        Users of Cryptshare Appliance version 7.7.0 should be aware of several critical changes introduced alongside this release. Version 7.7.0 includes the ability to upgrade the underlying operating system from openSUSE Leap 15.6 to openSUSE Leap 16.0. As ...

      • SSH Root Access Restriction openSUSE Leap 16.0

        Inhaltsverzeichnis 1 Applies To 2 Problem 3 Cause 4 Solution/Workaround Applies To OpenSUSE upgrade performing from version Leap 15.6 to Leap 16.0. Problem After upgrading to openSUSE Leap 16.0, SSH root login with a password no longer works. ...

      • Temporary Directory No Longer Persistent in openSUSE Leap 16.0

        Inhaltsverzeichnis 1 Applies To 2 Problem 3 Cause 4 Solution/Workaround Applies To OpenSUSE upgrade performing from version Leap 15.6 to Leap 16.0. Problem After upgrading to openSUSE Leap 16.0, any files stored in /tmp are permanently deleted on ...

      • Updating openSUSE manually

        Applies to Cryptshare Appliance with openSUSE 15.3 or later Problem The operating system is not up to date and may have unpatched security vulnerabilities. Cause No regular OS updates made via the Cryptshare Server Admin Interface when these were ...

      • Network Interface Naming Changes in openSUSE Leap 16.0

        Inhaltsverzeichnis 1 Applies To 2 Problem 3 Cause 4 Solution/Workaround Applies To OpenSUSE upgrade performing from version Leap 15.6 to Leap 16.0. Problem After upgrading to openSUSE Leap 16.0, network interfaces are renamed from legacy names (e.g., ...