Installing a Linux Server Sensor

This article describes how to install a Linux Server Sensor in a supported operating system.

Choosing an Installation Script

Stellar Cyber provides two different installation scripts for the Linux Server Sensor:

• ds_linux_install_all_in_one.sh is an entirely self-contained installation script that includes the images for all supported target environments. Because of this, it does not require access to the Internet and can be used in dark sites. However, it is quite large (on the order of ~700 MB).

• ds_linux_install.sh does not bundle images with the script and instead pulls the correct image from the Stellar Cyber production server at run time. Because of this, it is much smaller than the all-in-one script (on the order of 10 KB, plus the single 200 MB image pulled from Stellar Cyber production servers).

  To support dark site installation, the ds_linux_install.sh script can also point to a local copy of the image with the -p/--package parameter. However, it is generally simpler to use ds_linux_install_all_in_one.sh for dark site installations because it contains everything you need in a single package.

The table below provides you with details on the two scripts:

Supported Operating Systems

The Installation Matrix summarizes the operating systems supported for Linux Server Sensor installation in the 5.3.0 release.

Note that support for Kali Linux 2023.4, Rocky Linux 9, Oracle Linux 8.6, Oracle Linux 8.8, SUSE 12 SP5, and SUSE 15 SP5 is new in the 5.3.0 release.

About the ds_linux_install.sh Script in Previous Releases

The 4.3.7 release included a self-contained installation script called ds_linux_install.sh. The 5.1.1 release (and later) replaced that installer with the ds_linux_install_all_in_one.sh script and reverted the ds_linux_install.sh script back to its pre-4.3.7 behavior, downloading images from Stellar Cyber instead of bundling them with the installer.

Installation Prerequisites

• Click to see the minimum system requirements for installing a Linux agent sensor.

• All the procedures that follow require that you are logged in to an account with sufficient system storage and sudo access.

• Both installation scripts require the curl, ntp, and zip packages on the target machine. The installer checks for the presence of curl before installing and returns an error if it is not found.

Python Requirements

Version 5.3.0 does not require or use Python 2 in any of the supported environments listed in the table above. Python 3 is used in all supported Linux server sensor environments.

CentOS 8 Prerequisite – Update the Base URL

You must update the source link for some CentOS 8 environments to vault.centos.org instead of mirror.centos.org to ensure that dependent packages can be installed.

This issue is present in CentOS 8.5.2111 but may also exist in other CentOS 8 versions. The symptom for this issue is typically a series of No URLs in mirrorlist errors when installing in CentOS 8. 

The following commands make the necessary changes for most environments to ensure that dependent packages can be downloaded from vault.centos.org:

cd /etc/yum.repos.d/
sudo sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
sudo sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
sudo yum update -y

CentOS 7.9.2009 Prerequisite – Enable the EPEL Repository for pip Installation

CentOS 7.9.2009 does not install pip by default because it is not available in the core CentOS 7 repositories. To ensure that pip is installed, you must enable the Extra Packages for Enterprise Linux (EPEL) repository. This repository provides additional packages (including pip) that aren't included in the standard CentOS and Red Hat repositories.

Perform the following the steps to enable the EPEL repository and install pip:

1. Add the EPEL repository with the following command:

   sudo yum install epel-release

2. Install pip with the following command:

   sudo yum install python-pip

3. Verify pip installation with the following command:

   pip --version

Red Hat 7.x AWS Prerequisites

When running Red Hat 7.x in the AWS environment, you must perform the following steps before downloading and installing the Server Sensor:

1. Use the following commands to enable the required repository access:

   sudo yum install –y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
   sudo yum install -y yum-utils
   sudo yum-config-manager --enable epel
   

2. The current libssh library must be manually downloaded from the following URL. A Red Hat login is required.

   https://access.redhat.com/downloads/content/libssh/0.7.1-3.el7/x86_64/fd431d51/package
   

3. The downloaded RPM file can then be installed with the following command:

   sudo rpm -i <downloaded rpm>
   

NUMA Requirements

To prevent configuration errors, Stellar Cyber recommends that you do not install the Linux Server Sensor on target hosts with two NUMA nodes. You can use the following command to check the number of NUMA nodes in your target host:

$ lscpu | grep -i numa

For example, the following example shows the output returned by this command for a system with two NUMA nodes:

$ lscpu | grep -i numa
NUMA node(s):          2
NUMA node0 CPU(s):     0-19,40-59
NUMA node1 CPU(s):     20-39,60-79

Monitoring a Bonded Interface

Linux Server Sensors can monitor bonded interfaces using Mode 1. Keep in mind, however, that a Linux Server Sensor monitoring a bonded interface cannot forward traffic using the VXLAN Forwarding feature.

Installation Summary

Regardless of the Linux version the main steps to perform an installation are as follows:

1. Open ports on your firewall for the sensor.

2. Use the information in Choosing an Installation Script to select which installation script you want to use. Then, download the script from the Stellar Cyber production server.

3. Use the instructions in the sections below to run the installation script and verify the installation.

4. Use the aella_cli command to start the agent CLI. Then, use the set cm command to set the IP address to reach the management interface of the DL master in a DP cluster (or DP in a single DP deployment). Alternatively, if you have a data aggregator deployed, use the set aggregator command to specify the IP address of the destination aggregator.

5. Log on to Stellar Cyber, check the presence of the new sensor, and provide it with authorization. This process is documented in the Sensor Overview topic.

If you are using the small installation script without the -p/--package parameter, the target system must have network access to the Stellar Cyber production servers to download the correct image. You can also install a Linux agent sensor on a system without internet access (a dark site) using either the large or small installation script.

Exclude Server Sensor from AV/EDR Scanning

Stellar Cyber recommends that you prevent potential conflicts by configuring any anti-virus or EDR software installed on the same host as the Server Sensor to exclude the Server Sensor installation directories from scanning. The directories to exclude for a Linux Server Sensor are as follows:

Installing the Linux Server Sensor with the Small Script

The following procedure explains how to use the small installation script (ds_linux_install.sh) to install the Linux Server Sensor.

1. See the Supported Operating Systems for supported versions.

2. Contact Stellar Cyber support (support@stellarcyber.ai) for login credentials.

3. The following command retrieves the installation script:

   curl -k -u login:password -o ds_linux_install.sh https://acps.stellarcyber.ai/release/version/datasensor/ds_linux_install.sh --fail

   Substitute the exact release number for version. For example, if the version is 5.3.0, enter this:

   curl -k -u login:password -o ds_linux_install.sh https://acps.stellarcyber.ai/release/5.3.0/datasensor/ds_linux_install.sh --fail

4. Run the script with the following command:

   sudo bash ds_linux_install.sh -v version
   

   Substitute the exact release number for version. For example, if the version is 5.3.0, enter this:

   sudo bash ds_linux_install.sh -v 5.3.0
   

   Refer to Supported Arguments for Installation Scripts for additional arguments you can use to customize the installation. The only required argument is the -v argument for the sensor software version.

5. When the installation completes, configure the agent sensor.

Installing the Linux Server Sensor with the All-In-One Script

The following procedure explains how to use the all-in-one installation script (ds_linux_install_all_in_one.sh) to install the Linux Server Sensor.

1. See the Supported Operating Systems for supported versions.

2. Contact Stellar Cyber support (support@stellarcyber.ai) for login credentials.

3. The following command retrieves the installation script:

   curl -k -u login:password -o ds_linux_install_all_in_one.sh https://acps.stellarcyber.ai/release/version/datasensor/ds_linux_install_all_in_one.sh --fail

   Substitute the exact release number for version (for example, 5.3.0).

4. Run the script with the following command:

   sudo bash ds_linux_install_all_in_one.sh <arguments>
   

   Refer to Supported Arguments for Installation Scripts for additional arguments you can use to customize the installation.

5. When the installation completes, configure the agent sensor.

Supported Arguments for Installation Scripts

The table below lists and describes the supported arguments for the ds_linux_install.sh and ds_linux_install_all_in_one scripts:

Linux Server Sensor Configuration

Once the services are installed and operating, use the following procedure to configure the Linux Server Sensor:

1. Use the aella_cli command to start the CLI.

2. If the sensor is to be assigned to a tenant, enter the command set tenant_id <tenant-id> where the <tenant-id> is replaced by the tenant ID.

3. If you did not use the --cm argument as part of the sensor installation, use the set cm command as shown in the following examples.

   set cm dataprocessor.samplecompany.com

   or

   set cm 64.71.33.100
   

   This command specifies the IP address to reach the management interface of the Data Processor. For a DP cluster, this is the IP address of the DL-master's management interface. For a single DP deployment, this is simply the DP's management IP address. You can supply either an IP address or a hostname.

4. If you have a data aggregator installed, use that IP address instead of the DP's management interface. For example:

   set aggregator <primary IP address> <secondary IP address>

   Once this is done, the server sensor connects to the data processor and registers its presence.

   If you encounter a situation where the IP address for the aggregator unexpectedly resets to 0.0.0.0, it is possible that the aggregator configuration for the sensor is mismatched between the local CLI configuration and the DP. You can resolve this issue by specifying the correct IP address for the sensor's Primary Aggregator in the System | Sensors | Edit Sensor Parameters dialog box on the DP

5. Exit the CLI with the quit command.

Continue with Authorizing Sensors.

Authorizing Sensors

You must authorize the sensor when it appears in the network.

You can authorize multiple sensors at a time. So if you're installing multiple sensors, install them all, then authorize them all at once.

Debian and Ubuntu Uninstall

To uninstall a sensor on Debian or Ubuntu:

apt-get remove aellads

CentOS, Red Hat 6.7, AWS Linux 2 Uninstall

To uninstall a sensor on CentOS or Red Hat:

yum remove aellads