Updating IBM MFA server and GUI

If you update to a newer version of IBM® MFA, your existing database and configuration settings are maintained.

Before you begin

Before you update IBM MFA, ensure that your IBM MFA server system meets the minimum system requirements described in IBM MFA requirements.

When you update to a newer version of IBM MFA, your existing database and configuration settings are maintained. However, as a general best practice, you should back up your database before any update, as described in Backing up and restoring the IBM MFA database.

Important: Special considerations for SELinux
If SELinux is enabled in your environment, perform the following steps:
  1. Review the process context and tags associated with the postgresql and pkcsslotd services before enabling mfa.service dependencies on the postgresql and pkcsslotd services.
  2. After you have identified the required SELinux tags, implement the sample scripts in /opt/IBM/MFA/db/db-selinux-rhel.sh and /opt/IBM/MFA/db/db-selinux-sles.sh, respectively, to update the MFA SELinux settings and enable dependencies in mfa.service.

About this task

The IBM MFA server installs the mfa.service, which has dependencies on postgresql and pkcsslotd systemd services. systemd ensures that the dependent services are running before starting IBM MFA server.


  1. Ensure that you are logged in as the root user.
    # whoami
  2. Enter one of the following commands depending on the platform on which you are installing:
    rpm -U mfa-server-2.2.0.latest.rhel8.s390x.rpm
    rpm -U mfa-server-2.2.0.latest.sles15.s390x.rpm
  3. Verify that the IBM MFA server started and remained active:
    systemctl status mfa
    ● mfa.service - AZF MFA Server
       Loaded: loaded (/etc/systemd/system/mfa.service; enabled; vendor preset: disabled)
      Main PID: 46413 (azfd)
        Tasks: 2 (limit: 50303)
       Memory: 3.5M
       CGroup: /system.slice/mfa.service
               ├─46413 /bin/bash /opt/IBM/MFA/bin/azfd
               └─46418 /opt/IBM/MFA/bin/azfServer