Frequently asked questions about TuxCare Endless Lifecycle Support

Download the install script:

wget https://repo.els.tuxcare.com/centos6-els/install-centos6-els-repo.sh

Run the install script with your license key:

sh install-centos6-els-repo.sh --license-key XXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

yum info els-define

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard yum upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/centos-6-els/

Download the install script:

wget https://repo.els.tuxcare.com/oraclelinux6-els/install-oraclelinux6-els-repo.sh

Run the install script with your license key:

sh install-oraclelinux6-els-repo.sh --license-key XXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

yum info els-define

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard yum upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/oracle-linux-6-els/

You do not need ELS for CentOS 6 subscription if you are already using CloudLinux OS 6. You can find more information here

Download the install script:

wget https://repo.tuxcare.com/centos7-els/install-centos7-els-repo.sh

Run the install script with your license key:

sh install-centos7-els-repo.sh --license-key XXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

yum info els-os-release

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard yum upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/centos-7-els/

Download the install script:

For CentOS 8.4:

wget https://repo.els.tuxcare.com/centos8.4-els/install-centos8.4-els-repo.sh

For CentOS 8.5:

wget https://repo.els.tuxcare.com/centos8.5-els/install-centos8.5-els-repo.sh

Run the install script with your license key:

For CentOS 8.4:

sh install-centos8.4-els-repo.sh --license-key XXXXXXXXXXX

For CentOS 8.5:

sh install-centos8.5-els-repo.sh --license-key XXXXXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

yum info els-define

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard yum upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/centos-8-els/

Download the install script:

wget https://repo.tuxcare.com/centos8stream-els/install-centos8stream-els-repo.sh

Run the install script with your license key:

sh install-centos8stream-els-repo.sh --license-key XXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

yum info els-define

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard yum upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/centos-stream-8-els/

You do not need an ELS for CentOS 7 subscription if you are already using CloudLinux OS 7. You can find more information in the CLN billing documentation.

There is nothing to install and no separate repository to add. When CloudLinux OS 7 reached its end of life, existing servers moved to CloudLinux 7 ELS automatically and keep receiving updates from the repositories they already use.

Full instructions: https://docs.tuxcare.com/els-for-os/cloudlinux-7-els/

Download the install script:

wget https://repo.tuxcare.com/oraclelinux7-els/install-oraclelinux7-els-repo.sh

Run the install script with your license key:

sh install-oraclelinux7-els-repo.sh --license-key XXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

yum info els-define

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard yum upgrade command.

Note: the installation script does not automatically add the TuxCare UEKR6 repository. If you plan to use the kernel-uek package, enable that repository manually as described in the documentation.

Full instructions: https://docs.tuxcare.com/els-for-os/oracle-linux-7-els/

Download the install script:

wget https://repo.tuxcare.com/rhel7-els/install-rhel7-els-repo.sh

Run the install script with your license key:

sh install-rhel7-els-repo.sh --license-key XXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

yum info els-define

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard yum upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/red-hat-enterprise-linux-7-els/

Download the install script:

wget https://repo.tuxcare.com/debian10-els/install-debian10-els-repo.sh

Run the install script with your license key:

bash install-debian10-els-repo.sh --license-key XXXXXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

apt-cache show els-os-release

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard apt upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/debian-10-els/

Download the install script:

wget https://repo.tuxcare.com/debian11-els/install-debian11-els-repo.sh

Run the install script with your license key:

bash install-debian11-els-repo.sh --license-key XXXXXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

apt-cache show els-os-release

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard apt upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/debian-11-els/

Download the install script:

wget https://repo.els.tuxcare.com/ubuntu16_04-els/install-ubuntu16.04-els-repo.sh

Run the install script with your license key:

bash install-ubuntu16.04-els-repo.sh --license-key XXX-XXXXXXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

apt-cache show els-os-release

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard apt upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/ubuntu-16-04-els/

Download the install script:

wget https://repo.els.tuxcare.com/ubuntu18_04-els/install-ubuntu18.04-els-repo.sh

Run the install script with your license key:

bash install-ubuntu18.04-els-repo.sh --license-key XXXXXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

apt-cache show els-os-release

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard apt upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/ubuntu-18-04-els/

Download the install script:

wget https://repo.tuxcare.com/ubuntu20_04-els/install-ubuntu20.04-els-repo.sh

Run the install script with your license key:

bash install-ubuntu20.04-els-repo.sh --license-key XXXXXXXXXXX

The script registers the server in the CLN with the key and adds a PGP key to the server.

To verify that the installation was successful, run the following command:

apt-cache show els-os-release

It should return information about the available package. If the package information is displayed, the installation was successful. After that, you can install updates from the repository using a standard apt upgrade command.

Full instructions: https://docs.tuxcare.com/els-for-os/ubuntu-20-04-els/

• cln.cloudlinux.com
• repo.cloudlinux.com
• els-rollout.cloudlinux.com

• cln.cloudlinux.com
• repo.cloudlinux.com

• cln.cloudlinux.com
• repo.tuxcare.com
• els-rollout.tuxcare.com

1. Install the ELS release package and OpenSCAP:

   For RPM-based systems:

   yum install els-define openscap openscap-utils scap-security-guide -y

   For DEB-based systems:

   apt-get install els-define libopenscap8 -y

2. Before running a scan, make sure the system is up to date and running the latest kernel:

   For RPM-based systems:

   yum update -y

   For DEB-based systems:

   apt-get update && apt-get upgrade -y

3. Reboot the system.

4. RPM-based systems only: after the reboot, remove older kernel versions:

   For EL 6 and EL 7:

   package-cleanup --oldkernels --count=1 -y

   For EL 8 and EL 9:

   dnf remove --oldinstallonly -y

5. Download the OVAL stream. For example, Ubuntu 18.04:

   wget https://security.tuxcare.com/oval/els_os/ubuntu18.04els/oval.xml

   The streams for the other operating systems are listed in Available TuxCare ELS OVAL Streams.

6. Run the scan:

   oscap oval eval --results results.xml --report report.html oval.xml

7. Examine the scan results report.

   Following the example above, the scan results report will be saved to the report.html file in the current directory. This file can then be downloaded for analysis or published directly with a local web server, for example:

   python3 -m http.server 8000

   or for python2

   python -m SimpleHTTPServer 8000

   Assuming the above command is run from the directory with the report.html file, the webpage with the report can then be accessed on http://<server-ip-address>:8000/report.html through a web browser.

   Note: the OpenSCAP report below is provided as an example. The results will vary depending on the OS and version you are scanning.

   

   The report includes a table with vulnerabilities and their status on the examined system. A line such as the one below reports that the system is vulnerable to CVE-2023-2828:

   update oval:com.tuxcare.clsa:def:1688677755 true patch [CLSA-2023:1688677755], [CVE-2023-2828] Fix CVE(s): CVE-2023-2828

   The table also includes corresponding hyperlinks to advisory pages where the package and the version containing the fix can be found as well as the command to run on the target system in order to install the update.

   Lines like the one below designate that the fix for the corresponding CVE is already installed on the system, and no further action is needed:

   oval:com.tuxcare.clsa:def:1694538670 false patch [CLSA-2023:1694538670], [CVE-2022-40433] Fix CVE(s): CVE-2022-40433

The repository can be removed by running the installation script with the --delete flag. For example, on CentOS 7:

sh install-centos7-els-repo.sh --delete

Run the installation script with the --delete flag:

Debian 10:

bash install-debian10-els-repo.sh --delete

Debian 11:

bash install-debian11-els-repo.sh --delete

Run the installation script with the --delete flag:

bash install-ubuntu20.04-els-repo.sh --delete

1. List the ELS repository file (ending with -els.list) in the repository folder:

   ls -l /etc/apt/sources.list.d/*-els.list

2. Remove the file to disable the ELS repository:

   rm /etc/apt/sources.list.d/ubuntu-els.list

3. Uninstall the els-define package:

   apt remove els-define

Amazon Linux 2 only: before installing alt-php, make sure libvpx 1.3 is installed (alt-php requires it for compatibility with EL 7 systems):

sudo yum install libvpx-1.3.0

1. Download the installer script:

   wget https://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-rpm-repo.sh

2. Run the installer script with your license key. The script registers the server with CLN, adds the PGP key and repository.

   sh install-els-alt-php-rpm-repo.sh --license-key XXX-XXXXXXXXXXXX

   If Imunify360 is installed on the server and has a valid license, you can install alt-php (HardenedPHP) without a separate ELS license key. Run the installer with the -i (--imunify) option instead of --license-key:

   sh install-els-alt-php-rpm-repo.sh --imunify

3. Install a PHP version. Each version can be installed individually, for example alt-php73:

   yum groupinstall alt-php73

   To install all versions at the same time:

   yum groupinstall alt-php

4. Verify the installation. Check that the desired PHP version is installed:

   rpm -qa | grep alt-php

1. Download the installer script:

   wget https://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-deb-repo.sh

2. Run the installer script with your license key. The script registers the server with CLN, adds the PGP key and repository.

   bash install-els-alt-php-deb-repo.sh --license-key XXX-XXXXXXXXXXXX

   If Imunify360 is installed on the server and has a valid license, you can install alt-php (HardenedPHP) without a separate ELS license key. Run the installer with the -i (--imunify) option instead of --license-key:

   bash install-els-alt-php-deb-repo.sh --imunify

3. Install a PHP version. Each version can be installed individually, for example alt-php73:

   apt-get install alt-php73-meta

   To install all versions at the same time:

   apt-get install alt-php

4. Verify the installation. Check that the desired PHP version is installed:

   dpkg -l | grep alt-php

1. Download the installer script:

   wget https://repo.alt.tuxcare.com/alt-php-els/install-els-alt-php-apk-repo.sh

2. Run the installer script with your license key. The script registers the server with CLN, adds the PGP key and repository.

   sh install-els-alt-php-apk-repo.sh --license-key XXX-XXXXXXXXXXXX

   If Imunify360 is installed on the server and has a valid license, you can install alt-php (HardenedPHP) without a separate ELS license key. Run the installer with the -i (--imunify) option instead of --license-key:

   sh install-els-alt-php-apk-repo.sh --imunify

3. Install a PHP version. Each version can be installed individually, for example alt-php73:

   apk add alt-php73

   To install all versions at the same time:

   apk add alt-php

4. Verify the installation. Check that the desired PHP version is installed:

   apk info | grep alt-php