Manage a Publisher

1. Go to Settings > Security Cloud Platform > Publishers and click Configure Auto-Update on the right side of the page.
   

   

2. You can search for and sort existing profiles in the Auto-Updates Profiles dialog box, plus edit and delete profiles using the pencil and trash can icons. To create a new Auto-Update profile, click Add New.

   

3. Enter a profile name.

   

4. From the dropdown list, select Latest Release, or one of the previous versions of the latest release.

   Tip

   If you want to downgrade to a previous version, select the Latest-1 or Latest-2 version.

5. Specify a release frequency. For a Weekly update, specify the day of the week. For a Monthly update, specify the week and the day.
6. Select a time and a time zone to start the update. Publisher updates take around two hours to complete from the start time specified in the Update Profile.
7. When finished, click Save.

 

Manage Auto-Update Profiles

After Auto-Update profiles have been created, you can search for a profile, and also sort the profiles in the table in the Auto-Update Profile dialog box.

Auto-Update profiles can be applied to a single Publisher or multiple Publishers.

There are a couple of methods to modify an existing Auto-Update Profile, depending on whether you’re modifying single Publishers or multiple Publishers.

Single Publisher

For a single Publisher, select Edit from the Publisher side menu.

In the Edit Publisher dialog box, you can change the Update Profile for a Publisher by searching for and selecting a profile from the dropdown list.

You can also delete and update a Publisher using the options on Publisher dropdown list. Click Update to immediately upgrade the Publisher to the Publisher version specified in the Update Profile.

Click Configure Auto-Update to open the Auto-Updates Profile dialog box, which allows you to edit and delete a profile using the pencil and trash can icons.

Multiple Publishers

For multiple Publishers, select the Publishers (in the left column), and then click Update to immediately upgrade all the Publishers to the Publisher version specified in the Update Profile.

To change Auto-Update Profiles for multiple Publishers, click Change Update Profile To and select an Update profile from the dropdown list. Click Save and Continue and then Save.

Configure a Publisher for Software Updates via Explicit Proxy

This section explains how to configure an Ubuntu host to enable Publisher’s software updates via an Explicit Proxy. Note that this only applies to Publisher outbound traffic for OS and Docker updates. The Publisher tunnel itself does not support traversing explicit proxy and must be allowed to connect direct to the Netskope NPA stitcher IP space.

1. Configure the http_proxy and https_proxy environment variables via /etc/environment. Make sure to not modify the PATH= definition that should already exist, as this can impact other Publisher operations. Follow standard “vi” operating instructions to exit the file once created (Esc then :wq).
   Here is an example used in a configuration to ensure *.<tenant-domain> (replace with your tenant) is excluded. 169.254.0.0/16 will also need to be excluded for AWS installations.

   sudo vi /etc/environment
   export http_proxy="http://10.1.10.1:3128/"
   export https_proxy="http://10.1.10.1:3128/"
   export no_proxy="localhost, 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, *.<tenant-domain>"

2. Next configure docker-ce proxy settings, similar to the Ubuntu settings.

   sudo mkdir /etc/systemd/system/docker.service.d/
   sudo vi /etc/systemd/system/docker.service.d/http-proxy.conf
   [Service]
   Environment="HTTP_PROXY=http://10.1.10.1:3128"
   Environment="HTTPS_PROXY=http://10.1.10.1:3128"
   

   Exit vi and then restart the docker services to make the changes take effect.

   sudo systemctl daemon-reload
   sudo systemctl restart docker

3. Log out and log in so the /etc/environment variables are applied.
4. Test connectivity by attempting to Upgrade the Publisher through the Netskope UI.

Upgrade a Publisher for PRC (China)

In the Publisher release R111, a new verification feature has been added for PRC (China) Publishers to verify the authenticity of the Publisher docker image being installed. For this feature to work, certain certificates need to be present in a specific path before the verification and upgrade occurs.

There are two options to upgrade the Publisher:

• Option 1: Re-deploy the latest Publisher OVA VM Image 
  Once the verified R111 ova image is installed, it will also install all the necessary certificates in the publisher vm which shall be used for subsequent upgrades with verification (such as R111 to R112). Refer to the Netskope Private Access Publisher Release Notes to get the OVA URL hosting on AliCloud.
• Option 2: Using automation on existing Publishers
  If you do not wish to re-deploy the complete Publisher VM through OVA, you can run a python based automation on your existing Publishers, which upgrades the Publisher docker image to the latest (R111) version, and also installs all the necessary certificates in the Publisher VM that will be used for subsequent upgrades with verification (such as R111 to R112). 

Use these steps to execute this automation.

1. Retrieve the script from AliCloud. Execute this curl command to retrieve the script as verify_and_upgrade_publisher.py under the directory where the command is run.

   curl https://npa-ova.oss-cn-shenzhen.aliyuncs.com/publisher.netskope.com/latest/generic/verify_and_upgrade_publisher.py > verify_and_upgrade_publisher.py

2. Verify the hash of the script. Execute this command in the same path where the script was downloaded, and verify whether the resulting SHA256 hash is same as: 904c26f4a2b5941a63edce5cfa1bdc0b4f8f9af23fd3f8919e7f535d73a00d2c. This step is important to make sure the verified Netskope provided automation is being executed on the Publisher VM.

   shasum -a 256 verify_and_upgrade_publisher.py

3. Execute the automation to initiate upgrade with verification.  Run this command in the terminal under the same path where the script was downloaded.

   sudo python3 verify_and_upgrade_publisher.py

As part of Publisher software update, it’s recommended to regularly update the kernel of the host Ubuntu OS. The unattended kernel updates are used for updating the kernel on Publisher images. Publisher Release Notes contains the latest kernel versions for reference.

If the kernel version of your Publisher instance is not the latest, or the Publisher wizard shows a pending reboot, a reboot of the machine will update the kernel to the latest version. As a best practice, you could schedule regular reboots to update the kernel version to the latest version.

Enable Kernel Updates on an OVA Publisher

You can leverage automated/unattended kernel updates for OVA Publishers in one of two ways:

1. Enable as part of fresh installation: Unattended Kernel updates on OVA images are enabled starting from release 110. You need to fresh install the Publisher to enable the unattended kernel updates.
   In addition, you could also enable kernel updates on your existing OVA instances. Follow these steps if you wish to enable unattended kernel updates.
2. Enable existing OVA Publisher instances: Follow these steps to enable unattended kernel updates on existing OVA Publisher instances.
   1. Expand the disk of the OVA running instances from 8GB to 16GB using VM orchestrators. For ESXi, log in to ESXi, select the virtual machine, and power it off. Click Edit Settings, change the size of the Hard Disk, click OK, and power it on.
   2. Log in to your Publisher instance, download and run the script below. The script will expand the disk, install the required softwares, and reboot the machine.
      • File:

        https://s3-us-west-2.amazonaws.com/publisher.netskope.com/latest/generic/expand_drive.sh

      • shasum 256:

        1e858c0b600184462a661e4390169d7ce779b6f4de5d455f081f74dab8a48f7c

   3. Execute the script:

      chmod +x ./expand_drive.sh
      sudo ./expand_drive.sh

      Note

      Run the script with sudo. If the script was interrupted by the user, or due to the SSH session down, re-run the script.

   4. Check the disk size on the Publishers. The total disk size should be 16GB minimum now.
   5. Check the package newly installed linux-image-generic.
   6. The Linux kernel should be up to date

Enable Kernel Updates on a non-OVA Publisher

The unattended kernel updates are turned on by default for AMI, VHD and VHDX. Updates to the kernel are installed automatically on these image instances. A standard Publisher OS reboot will bring the instance’s kernel up-to-date.

Publisher Filtering and Exporting Options

To use these features, go to Settings > Security Cloud Platform > Publishers.

Filters

These filtering options are available in the Netskope UI.

• Private App Tags
• Publisher
• Reachability
• Browser Access
• Use Publisher DNS
• Host
• In Steering
• In Policy

Export

The results displayed can be exported by clicking Export.