EMS installation with standalone remote database without Docker

The following uses PostgreSQL (Postgres) for the remote database. EMS and the Postgres database are hosted on two Ubuntu machines.

To configure the Postgres server:

1. Install Postgres 15 on the Postgres Ubuntu machine:

   sudo apt install -y --no-install-recommends curl ca-certificates
   sudo install -d /usr/share/postgresql-common/pgdg
   sudo curl -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc
   sudo sh -c 'echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
   sudo apt update
   sudo apt install -y postgresql-15

2. Install EMS custom extensions. The following commands require the ems_pg_extensions.tar.gz file, which you can download from the Fortinet Support site:

   sudo tar zxvf ems_pg_extensions.tar.gz -C /
   sh -c 'head -c 20 /dev/urandom | md5sum | head -c 20;' |sudo tee /var/lib/postgresql/15/symmetric_key.txt > /dev/null
   sudo systemctl restart postgresql

3. You can tune Postgres based on the host server specs by applying the recommended configuration. While there are various tools you can use to find the recommended configuration, these instructions use PGTune. Generate and copy the recommended configuration:
   1. Go to PGTune and enter the following information:

      Field	Value
      DB version	15
      OS Type	Linux
      DB Type	Online transaction processing system
      Total Memory (RAM)	Enter the total memory for your Postgres server. In this example, it is 4 GB.
      Number of CPUs	Enter the total number of CPUs for your Postgres server. In this example, it is 4.
      Number of Connections	1092
      Data Storage	Enter the data storage type as per your device. In this example, it is SSD storage.

   2. Click Generate.
   3. Click Copy configuration.

      

4. Update /etc/postgresql/15/main/postgresql.conf:

   1. Add or update the configuration in /etc/postgresql/15/main/postgresql.conf with the content that you copied in step 3.

      

   2. Uncomment and change wal_level to minimal, e.g. wal_level = minimal. This removes all logging except the information required to recover from a crash or immediate shutdown.

      

   3. Uncomment and change max_wal_senders to 0, e.g. max_wal_senders = 0. This disables replication.
   4. Uncomment and change listen_addresses to ‘*’, e.g. 'localhost' >> listen_addresses = '*'.
5. Give passwordless permission to the Postgres user on the same machine by changing /etc/postgresql/15/main/pg_hba.conf running:

   sed -i 's/# Database administrative login by Unix domain socket/\nhost all postgres 127.0.0.1\/32 trust\nhost all postgres ::1\/128 trust/' /etc/postgresql/15/main/pg_hba.conf

6. Allow connection from the remote machine by updating the following in pg_hba.conf:

   # IPv4 local connections:
   host all all 127.0.0.1/32 scram-sha-256 >> host all all 0.0.0.0/0 scram-sha-256

7. Restart the postgreSQL service:

   systemctl restart postgresql

8. Change the postgres user password:

   sudo -u postgres psql

   ALTER USER postgres PASSWORD 'Fortinet123#';

To install EMS:

1. On the second Ubuntu machine, download the forticlientems_7.4.0.XXXX.bin file from https://support.fortinet.com.
2. Set umask to 022 if the existing umask setting is more restrictive.
3. Install EMS. db_host is the remote Postgres server:

   sudo chmod +x forticlientems_7.4.0.XXXX.bin

   sudo ./forticlientems_7.4.0.XXXX.bin -- --db_host "172.16.1.26" --db_user postgres --db_pass Fortinet123# --skip_db_install --allowed_hosts '*' --enable-remote-https

   Run the installer to/from any directory other than /tmp. Running the installer to/from /tmp causes issues.

4. After installation completes, check that all EMS services are running by entering the following command:

   systemctl --all --type=service | grep -E 'fcems|apache|redis|postgres'

   

   The output shows that postgresql.service status displays as exited. This is the expected status. EMS does not create this service, which only exists to pass commands to version-specific Postgres services. It displays as part of the output as the command filters for all services that contain "postgres" in the name.

5. If after initially installing EMS 7.4.0 you need to upgrade to a newer build, repeat steps 1-3 with the new installation file.