topic Re: Cortex XDR Agent installation for Redhat Enterprise in Cortex XDR Discussions

Cortex XDR Agent installation for Redhat Enterprise

Balaraju — Thu, 25 Aug 2022 12:29:12 GMT

Greetings

Thanks in advance for help

I was trying to find the list of steps to install a Cortex XDR Agent on Redhat Enterprise Linux and guess there are quite a few things and mentioned in different places . Can somebody correct my understanding as listed below , taken from Palo documentation?

1) Check Pre-req -- Processor 2.3 GHz dual-core processor , 4GB; 8GB recommended RAM , Harddisk 10GB , x86 64-bit , Kernel 2.6.32
2)Check compatibility below ( Linux Distribution , version and Kernel version )
https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/where-can-i-install-the-cortex-xdr-agent

3) Verify you have standard Unix programs installed. ( What this means ? )
4) ca-certificates ( What this means and how to check ? )
5) openssl 1.0.0 or a later release
6 ) check SELinux status ( # getenforce )
7 ) glibc
8 )Allow communication on the TCP port from the Cortex XDR agent to server (the default is port 443).

9)Download the Cortex XDR agent installation script from Cortex XDR.
You can install the Cortex XDR agent on the endpoint manually using the shell installer or using the Linux package manager for .rpm and .deb installers. Copy the installation package to the Linux server on which you want to install the Cortex XDR agent software.
To deploy using the shell installer:
chmod +x linux.sh
./linux.sh --proxy-list ”abc.net:8866”

The script installs the files for the Cortex XDR agent for Linux in the /opt/traps folder with the Cytool utility available at /opt/traps/bin/cytool.
After the agent successfully connects to the server for the first time and retrieves a valid license, the agent begins protecting the Linux server.

Thanks

Re: Cortex XDR Agent installation for Redhat Enterprise

bbucao — Thu, 25 Aug 2022 13:55:38 GMT

Hi Balaraju,

After verifying the basic system requirements follow the steps here to install the agent. Under step 4. "To deploy the shell installer:" you can see the install script makes the necessary prerequisite checks that you mention in your list.

Thanks,

Ben

Re: Cortex XDR Agent installation for Redhat Enterprise

Balaraju — Thu, 25 Aug 2022 14:03:58 GMT

Thanks for your response . I wanted to see if I can manually check pre-requisites just to avoid the failures due to lack of fulfilling any of them .

Re: Cortex XDR Agent installation for Redhat Enterprise

bbucao — Thu, 25 Aug 2022 14:14:58 GMT

This article walks through how to list installed packages on a RHEL system. You should be able to compare the listed packages to what is required by Cortex XDR under "Software Packages".

Re: Cortex XDR Agent installation for Redhat Enterprise

mfakhouri — Thu, 25 Aug 2022 16:27:03 GMT

Hello @Balaraju

Step 3: In the documentation for Cortex XDR Agent for Linux Requirements, the bullet point “Verify you have standard Unix programs installed” refers to the information listed in the Software packages section. For RHEL, this includes:

ca-certificates
openssl 1.0.0 or a later release
Distributions with SELinux in enforcing or permissive mode:

Red Hat Enterprise Linux 6, CentOS 6, and Oracle Linux 6—policycoreutils-python
Red Hat Enterprise Linux 7, CentOS 7, and Oracle Linux 7—policycoreutils-python and selinux-policy-devel
SUSE—policycoreutils-python and selinux-policy-devel
Debian and Ubuntu—policycoreutils and selinux-policy-dev

glibc—Required for exploit protection of containerized processes using the ROP Mitigation and Brute Force Protection modules. If glibc is not installed, the modules are disabled but all other exploit and malware protection functionality work as expected.

The shell installer will check for the required packages prior to agent installation as well. If the pre-requisites are not met, the installation will not succeed as seen in the following attempt:

Step 4: ca-certificates is a Linux package that contains digital certificates authorized by the certificate authority used when browsing the web (further reading: https://www.redhat.com/sysadmin/ca-certificates-cli)

The package ca-certificates is typically installed by default on RHEL distributions. To confirm, enter the command “rpm -qa | grep ca-certificates” into your terminal to search for the package:

If there is no output, then the package is not installed. Ca-certificates can be installed with “sudo yum install ca-certificates” in the terminal.

To properly install the Cortex XDR agent on RHEL distributions, please review the Cortex XDR Linux Requirements and Install the Cortex XDR Agent for Linux documentation prior to installation.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-linux/cortex-xdr-for-linux-requirements

https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-linux/install-the-cortex-xdr-agent-for-linux

Re: Cortex XDR Agent installation for Redhat Enterprise

bbarmanroy — Fri, 26 Aug 2022 02:51:19 GMT

Hi @Balaraju I would recommend you leveraging tools like Puppet/Chef for installing pre-requisites automatically as part of installing Cortex XDR. Alternately, you can also leverage build tools like Packer to create golden images with Cortex XDR and its dependencies already installed.

Re: Cortex XDR Agent installation for Redhat Enterprise

Balaraju — Fri, 26 Aug 2022 07:35:04 GMT

Thanks for reply , this is useful .

Re: Cortex XDR Agent installation for Redhat Enterprise

Balaraju — Fri, 26 Aug 2022 07:41:17 GMT

Thanks for your detailed reply , this was very useful and validated and closed many of my doubts . I think I can attempt one install now . Thanks again and appreciate the help .

Re: Cortex XDR Agent installation for Redhat Enterprise

Balaraju — Fri, 26 Aug 2022 07:42:03 GMT

Thanks for your reply . I will check with my IT team on this .