Skip to content
Cerberon Docs

Air-gapped install

An air-gapped install uses two machines: the offline target, and a connected workstation that downloads a bundle bound to the target. The target never needs internet access.

1. Offline Target Host install.sh --fingerprint Outputs Machine ID 2. Connected Workstation install.sh --fetch --with-images Downloads Signed Bundle 3. Offline Target Host install.sh --bundle ./bundle Installs Without Internet
Generate the target host fingerprint, fetch the offline bundle on an internet-connected workstation, and install from media.

Install

Section titled “Install”

  1. Get the target’s fingerprint. Copy install.sh to the offline host and run:

    Terminal window
    sh install.sh --fingerprint

    This reads local hardware identifiers and makes no network request. Copy the fingerprint it prints.

  2. Download the bundle. On the connected workstation, run:

    Terminal window
    sh install.sh --fetch ./cerberon-bundle \
      --key "CRB-XXXX-XXXX-XXXX" \
      --instance "<target fingerprint>" \
      --with-images

    The bundle contains the application and scanner images, a vulnerability data snapshot, a licence file bound to the target, and the signatures the installer checks.

  3. Install on the target. Move ./cerberon-bundle across on approved media, then run:

    Terminal window
    sh install.sh --bundle ./cerberon-bundle

    The installer verifies every signature before it uses the bundle.

Update an air-gapped install

Section titled “Update an air-gapped install”

Repeat steps 2 and 3 with a new bundle directory. Findings, users and settings are kept.

Terminal window
# On the connected workstation
sh install.sh --fetch ./cerberon-update --key "CRB-XXXX-XXXX-XXXX" --instance "<target fingerprint>" --with-images


# On the target, after the transfer
sh install.sh --bundle ./cerberon-update

An offline install does not run the daily update check. Its vulnerability data is as current as the last bundle you imported.