Air-gapped

Info

Requires PostgreSQL version 16.9 or later.

Info

To install PostgreSQL in an air-gapped environment, download the required packages on a preparation machine and then transfer them to the air-gapped server. The preparation machine should have internet access and run the same operating system version as the target server.

Prerequisites

Before installing the PostgreSQL service, ensure the following requirements are met.

Requirement	Description
Operating System	Debian 12+, Ubuntu 22.04+, Rocky Linux 9+, or RHEL 9+.
Privileges	`root` or `sudo` privileges on both the preparation machine and the air-gapped server.
Hardware	Minimum 8 vCPU and 16 GB RAM.
Disk space	At least 1 TB of available storage on SSD or NVMe for optimal performance. Approximately 4 GB of storage is required per 1 million scanned objects for a deployment with 5 MD Core instances running 8 AV engines each.
Network access	Required port is open (default port: 5432). A minimum network bandwidth of 1 Gbps is required. A bandwidth of 5 Gbps or higher is strongly recommended for production deployments.
Offline Package Transfer	A USB drive or other secure transfer medium is required to move the packages to the air-gapped server.

Debian, Ubuntu

Prepare packages

On the preparation machine, create file prepare_postgresql.sh with content:

#!/usr/bin/env bash

# Build an offline PostgreSQL install bundle for an air-gapped host.

# Dependency resolution: apt resolves the FULL closure as if nothing were

# installed (Dir::State::status -> an empty file), so the bundle is complete

# regardless of what's on this build host - the apt equivalent of dnf's

# --alldeps. The real system is never touched (download-only + a throwaway

# status file).

set -euo pipefail

# ---- configuration ---------------------------------------------------------

PG_VERSION="${PG_VERSION:-16}" # PostgreSQL major version

INCLUDE_RECOMMENDS="${INCLUDE_RECOMMENDS:-yes}" # yes = bundle Recommends too

PACKAGES=("postgresql-${PG_VERSION}" "postgresql-contrib")

ARCH="$(dpkg --print-architecture)"

. /etc/os-release

CODENAME="${VERSION_CODENAME:?cannot detect release codename}"

Run commands.

chmod +x prepare_postgresql.sh

./prepare_postgresql.sh

Copy the postgresql-offline folder to a USB drive or secure transfer medium.
Move it to the air-gapped server.

Install PostgreSQL

On the target server, insert the USB drive or secure transfer medium.
Copy postgresql-offline folder to /opt/postgresql-offline . E.g:

sudo cp -r postgresql-offline /opt/postgresql-offline

Run the commands below.

# Verify integrity:

cd /opt/postgresql-offline && sha256sum -c SHA256SUMS

# Register it as a local apt repo:

echo "deb [trusted=yes] file:/opt/postgresql-offline ./" \

| sudo tee /etc/apt/sources.list.d/pg-offline.list

# Update using ONLY this source

sudo apt-get -o Dir::Etc::sourcelist="sources.list.d/pg-offline.list" \

-o Dir::Etc::sourceparts="/dev/null" update

# Install

sudo apt-get install -y postgresql-16

# Configures PostgreSQL to start automatically whenever the system boots

sudo systemctl enable --now postgresql

# Setup login password

sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD '<your_password>';"

Open connection

Locate the PostgreSQL data directory on your server.

/etc/postgresql/16/main/

To allow remote connections, open the postgresql.conf file and configure the following setting:

listen_addresses = '*'

To allow MetaDefender Cluster services to access the database, open the p g_hba.conf file and add the following rule.

hostssl all all 0.0.0.0/0 scram-sha-256

Restart the PostgreSQL service to apply the changes.

sudo systemctl restart postgresql

Rocky, RHEL

Prepare packages

On the preparation machine, create file prepare_postgresql.sh with content:

#!/usr/bin/env bash

# Build an offline PostgreSQL install bundle for an air-gapped Rocky/RHEL host.

# `dnf download --resolve --alldeps` pulls the FULL dependency closure

# regardless of what's installed on this build host, so a clean machine is NOT

# required for completeness. The cost is a larger bundle (it grabs base libs

# too). The local-repo install step keeps that safe: on the target you

# `dnf install <name>` and dnf installs only what's missing - it will NOT

# force-downgrade your base system.

set -euo pipefail

# ---- configuration ---------------------------------------------------------

PG_VERSION="${PG_VERSION:-16}" # PostgreSQL major version

PACKAGES=("postgresql${PG_VERSION}-server" "postgresql${PG_VERSION}-contrib")

ARCH="$(uname -m)"

EL_VERSION="$(rpm -E %{rhel})"

Run commands.

chmod +x prepare_postgresql.sh

./prepare_postgresql.sh

Copy the postgresql-offline folder to a USB drive or secure transfer medium.
Move it to the air-gapped server.

Install PostgreSQL

On the target server, insert the USB drive or secure transfer medium.
Copy postgresql-offline folder to /opt/postgresql-offline . E.g:

sudo cp -r postgresql-offline /opt/postgresql-offline

Run the commands below.

# Verify integrity:

cd /opt/postgresql-offline && sha256sum -c SHA256SUMS

# Disable the built-in module here too (it conflicts with PGDG)

sudo dnf -qy module disable postgresql

# Install

sudo dnf install -y \

--disablerepo='*' \

--repofrompath=pgoffline,/opt/postgresql-offline \

--setopt=pgoffline.gpgcheck=0 \

postgresql16-server postgresql16-contrib

# Configures PostgreSQL to start automatically whenever the system boots

sudo /usr/pgsql-16/bin/postgresql-16-setup initdb

# Configures PostgreSQL to start automatically whenever the system boots

sudo systemctl enable --now postgresql-16

# Setup login password

sudo -u postgres psql -c "ALTER USER postgres WITH PASSWORD '<your_password>';"

Open connection

Locate the PostgreSQL data directory on your server.

/var/lib/pgsql/16/data

To allow remote connections, open the postgresql.conf file and configure the following setting:

listen_addresses = '*'

To allow MetaDefender Cluster services to access the database, open the pg_hba.conf file and add the following rule.

host all all 0.0.0.0/0 scram-sha-256

Restart the PostgreSQL service to apply the changes.

sudo systemctl restart postgresql-16

Last updated on

Was this page helpful?