Offline Upgrades (Air Gapped)

Guide for updating Curator on servers without internet access using manual update files.

If you’ve installed Curator on a server that is cut off from internet access, we provide a Manual Update option. This requires enabling the Disable Curator Upgrades setting to be enabled so you can perform a Manual Upgrade.

To enable Allow Manual Curator Upgrades:

1. Login to the backend of your Curator instance (e.g. https://curator.example.com/backend).
2. Navigate to the Settings > Curator > Portal Settings section using the left-hand menu..
3. Click on the “Features” tab at the top of the main page content.
4. If “Disable Curator Upgrades” is set to OFF, click the switch to turn this feature ON
5. Click to switch the “Allow Manual Curator Upgrades” setting ON under the “Functionality” section and click the “Save” button.

Click Here for Documentation on How to Manually Upgrade Curator

​

Updating PHP and Other Dependencies Offline

Security fixes for PHP, Apache, and MariaDB are separate from Curator upgrades. When InterWorks announces a PHP vulnerability, an air-gapped server needs its dependencies patched even if Curator itself is already up to date.

Note: Before updating any dependencies, make sure you have a recent Curator backup available.

​

Windows

The Curator Dependency Update Utility can run without internet access when the files it needs are already on the server. The full steps are in Manual Dependency Updates. In short:

1. On a computer with internet access, download the Curator Dependency Update Utility and these files, saving each one with exactly the name shown:
   • vc_redist.exe: VC Redistributables
   • php.zip: PHP package
   • apache.zip: Apache package
   • mariadb.zip (only if you opt into the Optional MariaDB Upgrade): MariaDB package
2. Copy the utility and all downloaded files into the same folder on your Curator server, such as the Desktop.
3. Double-click the utility. It detects the local files and uses them instead of downloading them.

If a file name does not match exactly, the utility does not recognize the file and tries to download it from the internet instead, which fails on an air-gapped server.

​

Linux

On Linux, PHP, Apache, and MariaDB are installed from package repositories, not from files InterWorks provides. Curator installs PHP from the ondrej/php PPA on Ubuntu and from the Remi repository on RHEL, CentOS, and Oracle Linux (see Network Whitelist Requirements). An air-gapped server therefore gets patched PHP packages from the internal package mirror or repository your organization uses for that distribution.

1. Make sure your internal mirror has synced the patched PHP packages for your distribution, including the ondrej/php PPA or the Remi repository.

2. Update the packages, using either option:

   • Download php_upgrade_util.sh on a computer with internet access, copy it to the server, and run it from the webroot (typically /var/www/html) as a user with full sudo access. The script installs packages through your distribution’s package manager, so the server must be able to reach your internal mirror.
   • Update the installed PHP packages with your distribution’s package manager (apt on Ubuntu, dnf on RHEL, CentOS, and Oracle Linux), the same way you apply other operating system updates from your mirror.

3. Restart Apache and any PHP-FPM services so they load the patched PHP. For example, on Ubuntu with PHP 8.3:

   sudo systemctl restart apache2 php8.3-fpm
   

   On RHEL, CentOS, and Oracle Linux:

   sudo systemctl restart httpd php-fpm
   

​

Confirm the Patch

On the Curator server, run php --version and check that the version shown is the patched release named in the InterWorks alert. Then run php -m and confirm the required PHP extensions are still listed.