Attention : support for WAPT 1.8.2 ended on June the 30th 2022.

There are known vulnerabilities in WAPT dependencies in WAPT 1.8.2 branch. Please upgrade to the latest supported version. CVE listing (non exhaustive) :
  • * python engine : python 2.7 (CVE-2020-10735, CVE-2015-20107, CVE-2022-0391, CVE-2021-23336, CVE-2021-3177, CVE-2020-27619, CVE-2020-26116, CVE-2019-20907, CVE-2020-8492, etc.)
  • * cryptography : openssl : CVE-2022-2068, CVE-2022-1292, CVE-2022-0778, CVE-2021-4160, CVE-2021-3712, CVE-2021-23841, CVE-2021-23840, CVE-2021-23839, CVE-2020-1971, CVE-2020-1968, CVE-2019-1551
  • * python dependencies : cryptography (CVE-2020-36242, CVE-2020-25659), eventlet (CVE-2021-21419), jinja2 (CVE-2020-28493), psutil (CVE-2019-18874), waitress (CVE-2022-31015), lxml (CVE-2021-4381, CVE-2021-28957, CVE-2020-27783, CVE-2018-19787), ujson (CVE-2022-31117, CVE-2022-31116, CVE-2021-45958), python-ldap (CVE-2021-46823)

Installing the WAPT Server on CentOS / RedHat

Attention

The upgrade procedure is different from installation. For upgrade, please refer to Upgrading the WAPT Server.

Installing the WAPT Server runs a few steps:

  • configuring the repositories;

  • installing additional Linux packages;

  • installing and provisioning the PostgreSQL database;

  • post-configuring the WAPT Server;

Configuring RPM repositories and installing WAPT and PostgreSQL packages

The configuration of repositories for WAPT Enterprise and WAPT Community Edition differs. Make sure to choose the right one!

During installation, you may be asked for the Kerberos realm. Just press Enter to skip this step.

Important

Follow this procedure for getting the right packages for the WAPT Enterprise Edition. For WAPT Community Edition please refer to the next block.

To access WAPT Enterprise ressources, you must use the username and password provided by our sales department.

Replace user and password in the baseurl parameter to access WAPT Enterprise repository.

cat > /etc/yum.repos.d/wapt.repo <<EOF
[wapt]
name=WAPT Server Repo
baseurl=https://user:password@srvwapt-pro.tranquil.it/entreprise/centos7/wapt-1.8/
enabled=1
gpgcheck=1
EOF

Important

Follow this procedure for getting the right packages for the WAPT Community Edition. For WAPT Enterprise Edition please refer to the previous block.

cat > /etc/yum.repos.d/wapt.repo <<EOF
[wapt]
name=WAPT Server Repo
baseurl=https://wapt.tranquil.it/centos7/wapt-1.8/
enabled=1
gpgcheck=1
EOF

Installing the WAPT Server packages

wget -q -O /tmp/tranquil_it.gpg "https://wapt.tranquil.it/centos7/RPM-GPG-KEY-TISWAPT-7"; rpm --import /tmp/tranquil_it.gpg
yum install epel-release
yum install postgresql96-server postgresql96-contrib tis-waptserver tis-waptsetup cabextract

Post-configuring

  • initialize the PostgreSQL database and activate the services:

    sudo /usr/pgsql-9.6/bin/postgresql96-setup initdb
    sudo systemctl enable postgresql-9.6 waptserver nginx
    sudo systemctl start postgresql-9.6 nginx
    

Attention

For post-configuration to work properly, you must first have properly configured the hostname of the WAPT server. To check, use the command echo $(hostname) which must return the DNS address that will be used by WAPT agents on client computers.

Hint

This post-configuration script must be run as root.

  • run the script:

    /opt/wapt/waptserver/scripts/postconf.sh
    
  • click on Yes to run the postconf script:

    do you want to launch post configuration tool?
    
           < yes >          < no >
    
  • choose a password for the SuperAdmin account of the WAPT server (minimum length is 10 characters);

    Please enter the wapt server password (min. 10 characters)
    
    *****************
    
            < OK >          < Cancel >
    
  • confirm the password;

    Please enter the server password again:
    
    *****************
    
            < OK >          < Cancel >
    
  • choose the authentication mode for the initial registering of the WAPT agents;

    • choice #1 allows to register computers without authentication (same method as WAPT 1.3). The WAPT server registers all computers that ask;

    • choice #2 activates the initial registration based on Kerberos. (you can activate it later);

    • choice #3 does not activate the kerberos authentication mechanism for the initial registering of machines equipped with WAPT. The WAPT server will require a login and password for each machine registering with it;

    WaptAgent Authentication type?
    
    -------------------------------------------------------------------------------------------------------------------------------------
    (*) 1 Allow unauthenticated registration, same behavior as wapt 1.3
    ( ) 2 Enable kerberos authentication required for machines registration. Registration will ask for password if kerberos not available
    ( ) 3 Disable Kerberos but registration require strong authentication
    -------------------------------------------------------------------------------------------------------------------------------------
                                                       < OK >          < Cancel >
    
  • select OK to start WAPT Server;

    Press OK to start waptserver
    
           < OK >
    
  • select Yes to configure Nginx;

    Do you want to configure nginx?
    
       < Yes >        < No >
    
  • fill in the FQDN of the WAPT server;

    FQDN for the WAPT server (eg. wapt.acme.com)
    
    ---------------------------------------------
    wapt.mydomain.lan
    ---------------------------------------------
    
          < OK >          < Cancel >
    
  • select OK and a self-signed certificate will be generated, this step may take a long time …

    Generating DH parameters, 2048 bit long safe prime, generator 2
    This is going to take a long time
    .......................................+...............................+...
    

Nginx is now configured, select OK to restart Nginx:

The Nginx config is done.
We need to restart Nginx?

      < OK >

The post-configuration is now finished.

Postconfiguration completed.
Please connect to https://wapt.mydomain.lan/ to access the server.

                 < OK >

Listing of post-configuration script options:

Flag

Description

--force-https

Configures Nginx so that port 80 is permanently redirected to 443

The WAPT Server is now ready.

You may go to the documentation on installing the WAPT console!!