[Q&A] How to upgrade the agent and update conf in one install ?

[keguira]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Hello,

I'm trying to prepare the update to agent 1.5.
Previously, we installed the agent 1.4 using GPO and the vbs script.

Now, the IT team in charge of the update does not want to use the vbs script but prefer to use a package for sccm.

We are able to update the agent using a command line like this one

msiexec ... /quiet RUNNOW=1 SERVER='https://my-server.example.com/marketplace/glpiinventory/' ADDLOCAL=feat_COLLECT EXEC_MODE=1 TAG=my-tag

The issue is that with this update we want to also clean some registry keys : we want to remove the ssl-fingerprint and change the server URL.
With this command, the server value is not updated. We did not try, yet, to update the SSL Fingerprint but i suppose we will have the same issue.

Can we upgrade the agent and update the conf at the same time or do i need to also run the installer with REINSTALL=feat_agent after upgrading ?

[kintaro1981]

I think that REINSTALL is going to do the trick.

REINSTALL=feat_AGENT
Use this option only in the case you need to change the agent configuration using the same installer. (Not used by default)

https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html#command-line-parameters

Test it in some clients.

Otherways you have to deploy directly registry changes of the value SERVER

[g-bougard]

Hi @keguira

did you try to set SSL_FINGERPRINT= to set it empty or SSL_FINGERPRINT='' ?

About REINSTALL=feat_AGENT it can only be used when the agent is installed and you're using the same MSI installer.

[keguira]

Hello,

Well, i've tried some things.

Starting point : glpi-agent 1.4 installed with a server to https://foo.example.com and a ssl-fingerprint by using the vbs
Each use-case had this starting point.

I run a powershell from a folder named C:\blabalblab\glpi-agent will all needed MSI.

Use-case 1 : update to 1.5. Trying to change server for https://bar.example.com and clear ssl-fingerprint by passing a "no value"

MsiExec.exe /quiet /i GLPI-Agent-1.5-x64.msi ADDLOCAL=feat_COLLECT TAG=my-tag EXEC_MODE=1 SERVER='https://bar.example.com' SSL_FINGERPRINT=  

Result :

• Agent in 1.5
• server : 'https://bar.example.com'
• ssl-fingerprint : CURRENTDIRECTORY="C:\blabalblab\glpi-agent"

Issues :

1. ssl-fingerprint is not emptied but gain the value of the current folder

Use-case 2 : update to 1.5. Trying to change server for https://bar.example.com and clear ssl-fingerprint by passing empty value

MsiExec.exe /quiet /i GLPI-Agent-1.5-x64.msi ADDLOCAL=feat_COLLECT TAG=my-tag EXEC_MODE=1 SERVER='https://bar.example.com'  SSL_FINGERPRINT=''

Result :

• Agent in 1.5
• server : 'https://bar.example.com'
• ssl-fingerprint : CURRENTDIRECTORY="C:\blabalblab\glpi-agent"

Issues :

1. ssl-fingerprint is not emptied but gain the value of the current folder

Use-case 3 : update to 1.5. Trying to change server for https://bar.example.com and clear ssl-fingerprint by using feature REINSTALL=feat_AGENT and specify no ssl-fingerprint as the empty/no value is not usable

MsiExec.exe /quiet /i GLPI-Agent-1.5-x64.msi ADDLOCAL=feat_COLLECT TAG=my-tag EXEC_MODE=1 SERVER='https://bar.example.com'  REINSTALL=feat_AGENT

Result :

• Agent in 1.5
• server : 'https://bar.example.com'
• ssl-fingerprint : sha:....

Issues :

1. ssl-fingerprint is not emptied but keep old value.

---

Edit: bad copy/past in used command for UC1

[keguira]

I also retried all of these use-case with the vbs script and I have the same result.

I use a laptop with WIN 10 Pro x64 and a powershell with admin privileges

[keguira]

What i see :

• in command line, I cannot specify / force an empty value for ssl-fingerprint (or I miss something in powershell)
• during the upgrade process, the configuration is backed before uninstall of previous version and merged with the command line values.
• the REINSTALL flag is taken into account by the installer but it doesn't check the current version such as it allows the upgrade
• the REINSTALL flag is taken into account by the installer but it doesn't block the configuration backup or, at least, does not block the config merging

From what i've tested the REINSTALL flag does nothing. I'm sure it does other things but not for this kind of configuration

[keguira]

Finally, i did an other test before "let it go" and update the registry key manually or uninstall agent before installing the 1.5 (i have a deadline for next week but i'll still be available if more tests are needed before i raise an issue) :

Use-Case 4 : update to 1.5. Trying to change server for https://bar.example.com by using a SCCM package (so with a script).

The install command in the script looks like this :

Execute-MSI -Action 'Install' -Path "$dirFiles\GLPI-Agent-1.5-$ARCH.msi" -Parameters "/quiet RUNNOW=1 SERVER='https://bar.example.com' ADDLOCAL=feat_COLLECT EXEC_MODE=1 TAG=my-tag NO_SSL_CHECK=0"

Result :

• Agent in 1.5
• server : 'https://foo.example.com'

With this use-case the server is not updated.

---

Edit : removed glpi-inventory plugin path for clarity (i use the plugin but it is not revelant here)

[g-bougard]

Can you also run some tests not from a PS console but from a CMD console ? I still saw confusing installer comportment when run from a PS console.

[keguira]

I'll redo some tests on another computer but it seems I have the same results

[g-bougard]

Can you try to set a space (aka SSL_FINGERPRINT=" " or SSL_FINGERPRINT=' ') or even a comma (aka SSL_FINGERPRINT=,) ? This will not really reset this config to an empty one, but should set to something not used.

[keguira]

i've tried to put some dumb value and it's working (it updates the value).
If i try to put a simple space, it raise a MsiExec error saying that I have to put a valid value

[keguira]

correction : under cmd.exe, i can update the ssl-fingerprint to a single space using SSL_FINGERPRINT=" " but I have a certificate validation error (same issue with a comma)

[keguira]

I think I have 2 choices (and i'm gonna raise an issue with all current infos) to upgrade my assets :

1. uninstall 1.4 on computer (if present) and install 1.5 if no agent present
2. use a Setregistry-Key to update server and fingerprint (if presents) and then install 1.5

Both of these solutions will cover new assets and the ones with 1.4

[keguira]

Created the issue : #493

This discussion can be closed or kept to iterate over the current behavior and find workarounds.