Install AIX agents for deep visibility and enforcement


Note

On AIX, certain features such as process tree reporting, package (CVE) vulnerability identification, and forensic event logging are not available. Additionally, some aspects of these features may be unavailable on specific minor releases of otherwise supported platforms due to operating system limitations.

AIX agent installation prerequisites

For platform requirements, refer to Supported Platforms and Requirements.

Additional requirements for deep visibility:

Before you install the deep visibility agent, ensure that the host meets these requirements:

  • Root privileges are available to install and run the agent services.

  • At least 500 MB of storage is available for agent and log files.

  • Security exclusions are configured for any security applications that monitor the host. These exclusions help prevent other security applications from blocking agent installation or agent activity. For more information, see Security Exclusions.

Flow capture on AIX

AIX supports flow capture for up to 20 network devices. On AIX 7.1 TL3 SP4 or earlier, AIX supports flow capture for up to 6 network devices.

The deep visibility agent captures flows from a maximum of 16 network devices. The remaining 4 capture sessions are available for system tools, such as tcpdump.

To support flow capture for 20 network devices, the agent uses the following bpf device nodes:

  • The agent creates 16 bpf device nodes under the agent directory: 
    /opt/cisco/tetration/chroot/dev/bpf0 -
              /opt/cisco/tetration/chroot/dev/bpf15
    .

  • tcpdump and other system tools that use bpf scan the system device nodes, /dev/bpf0-/dev/bpf19, until they find an unused node, !EBUSY.

  • The bpf nodes created by the agent and the system bpf nodes share the same major and minor numbers. Each major or minor number is opened by only one instance, either tcpdump or the agent.

  • The agent does not access or create the system device nodes. tcpdump creates system device nodes, such as 
    /dev/bpf0.
              . . /dev/bpf19
    , if they do not exist when tcpdump-D is run.

iptrace and flow capture

In certain scenarios, running iptrace on the system prevents flow capture by tcpdump and the deep visibility agent. This is a known design issue that must be checked with IBM.

Before you install the agent, run tcpdump to check whether iptrace is blocking flow capture.

Expected result: If tcpdump returns tcpdump: BIOCSETIF: en0: File exists, iptrace is blocking flow capture.

To resolve the issue, stop iptrace.

Process visibility and forensics support

Process Visibility and Forensics are supported on AIX 7 and POWER8 or later.

Policy enforcement requirements

Before you install the policy enforcement agent, disable IP Security Filter, such as smitty IPsec4. If IP Security Filter is enabled, the agent installation fails during the precheck.

If IP Security is enabled while the Secure Workload enforcer agent is running, the enforcer agent reports an error and stops enforcing. Contact support to safely disable IP Security Filter when the enforcer agent is running.

Install an AIX agent with the agent script installer

You can only install deep visibility and enforcement AIX agents using the agent script installer method. After installation, the agent provides visibility and enforcement on supported AIX platforms (AIX 7.2, POWER8 and later).

By default, enforcement is disabled. To enable enforcement, refer toCreate an Agent Configuration Profile.

Follow these steps to install an AIX agent with the agent:

Procedure

Step 1

Navigate to Agent Installation Methods:

  • If you are a first-time user, launch the Quick Start wizard and click Install Agents.

  • From the navigation pane, choose Manage > Agents, and select the Installer tab.

Step 2

Click Agent Script Installer.

Step 3

From the Select Platform drop-down menu, choose AIX.

To view the supported AIX platforms, click Show Supported Platforms.

Step 4

Choose the tenant to install the agents.

Note

 

Selecting a tenant is not required for Secure Workload SaaS clusters.

Step 5

If you want to assign labels to the workload, choose the label keys and enter label values.

When the installed agent reports IP addresses on the host, the installer CMDB labels selected here, along with other uploaded CMDB labels that have been assigned to IPs reported by this host, would be automatically assigned to the new IP address. If there are conflicts between uploaded CMDB labels and installer CMDB labels:

  • Labels assigned to an exact IP address take precedence over labels assigned to the subnet.

  • Existing labels assigned to an exact IP address take precedence over installer CMDB labels.

Step 6

If HTTP proxy is required to communicate with Secure Workload, choose Yes, and then enter a valid proxy URL.

Step 7

Under the Installer expiration section, select one from the available options:

  • No expiration: The installer script can be used multiple times.

  • One time: The installer script can be used only once.

  • Time bound: You can set the number of days for which the installer script can be used.

  • Number of deployments: You can set the number of times the installer script can be used.

Step 8

Click Download and save the file to the local disk.

Step 9

Copy the installer shell script to all the AIX hosts for deployment.

Note

 

If you do not specify a agent version in the script, then it will download and install the latest promoted agent package.

Step 10

To grant execute permission to the script, run the command: chmod u+x tetration_installer_default_sensor_aix.sh

Note

 

The script name may differ depending on the agent type and scope.

Step 11

To install the agent, run the following command with root privileges: ./tetration_installer_default_sensor_aix.sh

Note

 

If an agent is already installed on the host, you cannot proceed with the installation. If you wish to re-install the agent, use the --new option, as explained later in this chapter.

We recommend running the pre-check, as specified in the script usage details.

AIX installer script usage details: 

ksh tetration_installer_default_enforcer_aix.sh [--pre-check] [--pre-check-user] [--skip-pre-check=<option>] [--no-install] [--logfile=<filename>] [--proxy=<proxy_string>] [--no-proxy] [--help] [--version] [--sensor-version=<version_info>] [--ls] [--file=<filename>] [--osversion=<osversion>] [--save=<filename>] [--new] [--reinstall] [--unpriv-user] [--libs=<libs.zip|tar.Z>] [--force-upgrade] [--upgrade-local] [--upgrade-by-uuid=<filename>] [--logbasedir=<logbdir>] [--tmpdir=<tmp_dir>] [--visibility] [--golden-image]
  --pre-check: run pre-check only
  --pre-check-user: provide alternative to nobody user for pre-check su support
  --skip-pre-check=<option>: skip pre-installation check by given option; Valid options include 'all', 'ipv6' and 'enforcement'; e.g.: '--skip-pre-check=all' will skip all pre-installation checks; All pre-checks will be performed by default
  --no-install: will not download and install sensor package onto the system
  --logfile=<filename>: write the log to the file specified by <filename>
  --proxy=<proxy_string>: set the value of HTTPS_PROXY, the string should be formatted as http://<proxy>:<port>
  --no-proxy: bypass system wide proxy; this flag will be ignored if --proxy flag was provided
  --help: print this usage
  --version: print current script's version
  --sensor-version=<version_info>: select sensor's version; e.g.: '--sensor-version=3.4.1.0'; will download the latest version by default if this flag was not provided
  --ls: list all available sensor versions for your system (will not list pre-3.3 packages); will not download any package
  --file=<filename>: provide local zip file to install sensor instead of downloading it from cluster
  --osversion=<osversion>: specify osversion for --save flag;
  --save=<filename>: download and save zip file as <filename>; will download package for osversion given by --osversion flag; e.g.: '--save=myimage.aix72.tar.Z --osversion=7.2'
  --new: remove any previous installed sensor;
  --reinstall: reinstall sensor and retain the same identity with cluster; this flag has higher priority than --new
  --unpriv-user=<username>: use <username> for unpriv processes instead of tet-snsr
  --libs=<libs.zip|tar.Z>: install provided libs to be used by agents
  --force-upgrade: force sensor upgrade to version given by --sensor-version flag; e.g.: '--sensor-version=3.4.1.0 --force-upgrade'; apply the latest version by default if --sensor-version flag was not provided
  --upgrade-local: trigger local sensor upgrade to version given by --sensor-version flag: e.g.: '--sensor-version=3.4.1.0 --upgrade-local'; apply the latest version by default if --sensor-version flag was not provided
  --upgrade-by-uuid=<filename>: trigger sensor whose uuid is listed in <filename> upgrade to version given by --sensor-version flag; e.g.: '--sensor-version=3.4.1.0 --upgrade-by-uuid=/usr/local/tet/sensor_id'; apply the latest version by default if --sensor-version flag was not provided
  --logbasedir=<log_base_dir>: instead of logging to /opt/cisco/tetration/log use <log_base_dir>. The full path will be <log_base_dir>/tetration
  --tmpdir=<tmp_dir>: instead of using /tmp use <tmp_dir> as temp directory
  --visibility: install deep visibility agent only; --reinstall would overwrite this flag if previous installed agent type was enforcer
  --golden-image: install Cisco Secure Workload Agent but do not start the Cisco Secure Workload Services; use to install Cisco Secure Workload Agent on Golden Images in VDI environment or Template VM. On VDI/VM instance created from golden image with different host name, Cisco Secure Workload Services will work normally

Verify AIX agent installation

Procedure

Run these commands to verify that lslpp -c -l tet-sensor.rte has one entry:

Note

 

The specific output may differ depending on the version

$ lslpp -c -l tet-sensor.rte

#Fileset:Level:PTF Id:State:Type:Description:EFIX Locked

/usr/lib/objrepos:tet-sensor.rte:3.9.1.19::COMMITTED:I:Tetration:

$

# lssrc -s csw-agent

Subsystem Group PID Status

csw-agent 8126714 active

#