topic Re: Cortex Linux Agent Debian Package messed up in Cortex XDR Discussions

Cortex Linux Agent Debian Package messed up

RonaldWeiss — Mon, 30 May 2022 09:33:46 GMT

Hi,

Starting with Version 7.7 the downloadable Package is still named *.deb, in fact it is a tar.gz containing the following:

-config file

-readme

-deb-file

Which means, you cannot just install the so-called "deb package", but you have to create a directory, copy a file and then you are able to install the deb file...

Was working properly before.

PLEASE FIX THIS!

Re: Cortex Linux Agent Debian Package messed up

bbarmanroy — Tue, 31 May 2022 01:48:58 GMT

Hi @RonaldWeiss This seems to be an issue with the backend. Please create a support ticket for this to be addressed.

Re: Cortex Linux Agent Debian Package messed up

RonaldWeiss — Tue, 31 May 2022 05:52:17 GMT

Hi,

I already createt a ticket for this to our MSSP. Nevertheless hoped to speed up, or get Information, here...

i also assume it's backend issue during creation of the installer package.

Re: Cortex Linux Agent Debian Package messed up

bbarmanroy — Tue, 31 May 2022 07:47:55 GMT

Hi @RonaldWeiss I checked internally - please note that this is a desired behavior.
"""
To better secure your Cortex XDR agent installations on Linux machines, installation packages are now signed by Palo Alto Networks. The installation package contains a new configuration file which includes the tenant ID and registration key. When installing the agent installation package, if signature-checking is configured, you will need to install a Cortex XDR public key.

"""

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-release-notes/cortex-xdr-agent-release-information/features-introduced-in-cortex-xdr-agent#features-introduced-in-cortex-xdr-agent-7.3_idede97ad4-2b44-4291-9b4e-472f78227644

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux

Re: Cortex Linux Agent Debian Package messed up

RonaldWeiss — Tue, 31 May 2022 07:54:05 GMT

Hi,

Yeah, i have read that, too. BUT:

In that guide it says:
Ubuntu or Debian apt-get install ./filename.deb or dpkg -i ./filename.deb
But that doesn't work because the package provided is NOT a deb package, but a tar.gz with the wrong file extension!

#file 2022_05_30_Cortex_XDR_Linux_7_7_1_62043.deb

2022_05_30_Cortex_XDR_Linux_7_7_1_62043.deb: gzip compressed data, was "traps_linux-7.7.1.61152_deb.tar", last modified: Mon May 30 08:29:27 2022, max compression, original size 55715840

Why not just include the tennant ID and reg-key into the deb package?
btw: i could do that myself, but thats not my job...

Re: Cortex Linux Agent Debian Package messed up

bbarmanroy — Thu, 02 Jun 2022 01:47:24 GMT

Hi @RonaldWeiss I went through the whole process as specified here and was successfully able to setup XDR agent on an endpoint.

Can you clarify if you were able to successfully execute this step of extracting the contents of the tarball before initiating the installation:

Re: Cortex Linux Agent Debian Package messed up

RonaldWeiss — Thu, 02 Jun 2022 05:51:46 GMT

Hi,

this might work. But if there is a deb package provided, it should work as expected, and not unveil as a renamed tar.gz.

When you follow the part "To deploy using package manager" on your screenshot, this simply doesnt work.

AND: the deb was working since 7.6!

To clarify:

i AM able to install a tar.gz, but there is the fact that the deb installer is not working as expected.
So i think someone messed something up. The Intention of the post is to inform about the failing installer.

PA should either change the manual below "To deploy using package manager" (add "unpack the *.deb using tar -xfz, and copy the config file"), and get the laughts of every linux-admin,

or just fix the creation of the deb file.

Re: Cortex Linux Agent Debian Package messed up

bbarmanroy — Fri, 03 Jun 2022 01:03:15 GMT

Hi @RonaldWeiss I was able to follow the steps in sequence to extract the contents of the tarball. The tarball contained a .deb file, which I installed with dpkg -i ./cortex-7.7.1.61152.deb.

What you're referring to in your last post is a recommendation, and not a break-fix. I will let the documentation team know about your recommendation.

Have a good day ahead!