š Requirements
Choose the Right Sensor
Choosing which sensor to deploy to protect your Linux environment depends on the answers to these questions:
-
Are your Linux endpoints running supported distros and kernels?
-
If YES, then you should deploy the Falcon sensor for Linux (not the Falcon Container sensor for Linux).
-
-
Are you running containerized applications?
-
If YES, then you can deploy the Falcon sensor for Linux as a DaemonSet on your cluster.
-
-
Do you have restricted or no access to the underlying kernel, for example, when using managed cloud services?
-
If YES, then you can deploy the Falcon Container sensor for Linux to protect your container workloads running on Linux nodes.
-
āļø Installing the Falcon Sensor
Obtain an Access Token
To authenticate API requests, first generate an access token using your client ID and secret:
curl -X POST "https://api.us-2.crowdstrike.com/oauth2/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET"
List Available Installers
To view available Falcon sensor installers and their hashes for different operating systems, use:
curl -X GET "https://api.us-2.crowdstrike.com/sensors/queries/installers/v2" \
-H "Authorization: Bearer <token>"
Below are some available hashes for different Linux distributions:
RHEL/CentOS Stream/Oracle
-
Version: 7.21.17405
-
Release Date: Feb. 6, 2025
-
SHA256:
030ed4484bc20f6db5d7ed6ec4728f379bf3f6e0fd06749858b7960136929f02
Ubuntu
-
Version: 7.21.17405 (18/20/22 IBM zLinux)
-
Release Date: Feb. 6, 2025
-
SHA256:
054325b762f1ecbacd8cc5d787c259276381ec150d55acaf00f5592c46f5788c -
Version: 7.21.17405 (16/18/20/22/24)
-
Release Date: Feb. 6, 2025
-
SHA256:
94972a0617e5786de9f74bc68d4a771816dc04281b43b3a7fa91f67ac7ed63a0
Amazon Linux
-
Version: 7.21.17405 (Amazon Linux 2)
-
Release Date: Feb. 6, 2025
-
SHA256:
a20f00921c2759ff40e1222b3bf63caac488f75bbe735a25930f5856c6ca096b
For a complete list, use the API query above.
Download the Falcon Sensor Installer
Once you have identified the correct hash for your system, use the following command to download the installer:
curl -X GET \
'https://api.us-2.crowdstrike.com/sensors/entities/download-installer/v2?id=<SHA256>' \
-H 'Authorization: Bearer <token>'
Replace <SHA256> with the appropriate hash from the list above.
Install the Falcon Sensor
-
Get your Customer ID Checksum (CID).
-
Run the installer, replacing
<installer_filename>with the actual filename:-
Ubuntu:
sudo dpkg -i <installer_filename> -
RHEL, CentOS, Amazon Linux:
sudo yum install <installer_filename> -
SLES:
sudo zypper install <installer_filename>
-
-
Set your CID on the sensor:
sudo /opt/CrowdStrike/falconctl -s --cid=<CID> -
Start the sensor manually:
-
SysVinit Hosts:
sudo service falcon-sensor start -
Systemd Hosts:
sudo systemctl start falcon-sensor
-
š ļø Post-installation Steps
Verify Sensor Installation
To confirm that the Falcon sensor is running, execute:
ps -e | grep falcon-sensor
Expected output:
[root@centos6-installtest ~]# sudo ps -e | grep falcon-sensor
905 ? 00:00:02 falcon-sensor
ā Uninstalling the Falcon Sensor for Linux
If your sensor is offline, first retrieve a maintenance token from UPX and run:
sudo /opt/CrowdStrike/falconctl -s --maintenance-token=<your_maintenance_token>
Then, uninstall the Falcon sensor with the following commands:
-
Ubuntu:
sudo apt-get purge falcon-sensor -
RHEL, CentOS, Amazon Linux:
sudo yum remove falcon-sensor -
SLES:
sudo zypper remove falcon-sensor
ComentƔrios
0 comentƔrio
Por favor, entre para comentar.