02-16-2025 06:19 AM
Hi,
i know that Linux Agent Tampering protection is not support yet , however what is the possible why to secure the agent?
02-17-2025 12:49 AM
Hello @A.Alharbi095930
Thanks for reaching out on LiveCommunity!
As you know, the root user has full control over Linux, so there is currently no ETA for Tamper Protection on Linux. You may reach out to your Account Manager for more information.
However, if you have Pro per GB, you can use the Collector to collect logs from the /var/log/traps directory. Additionally, for more extensive or backup log collection, you can configure rsyslog or syslog-ng to forward logs from that directory to another system and collect those events on the remote host. While none of these methods are completely tamper-resistant, any attempts to shut down one of these services will be detected and reported by the others, providing at least some level of visibility into such activity.
If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.
02-17-2025 12:49 AM
Hello @A.Alharbi095930
Thanks for reaching out on LiveCommunity!
As you know, the root user has full control over Linux, so there is currently no ETA for Tamper Protection on Linux. You may reach out to your Account Manager for more information.
However, if you have Pro per GB, you can use the Collector to collect logs from the /var/log/traps directory. Additionally, for more extensive or backup log collection, you can configure rsyslog or syslog-ng to forward logs from that directory to another system and collect those events on the remote host. While none of these methods are completely tamper-resistant, any attempts to shut down one of these services will be detected and reported by the others, providing at least some level of visibility into such activity.
If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
