Deploy SEP Linux agent as part of a cloned drive image

Products

Endpoint Protection Endpoint Security Complete

Issue/Introduction

Symantec Endpoint Protection (SEP) Linux agent needs to be deployed as part of a cloned drive image

Environment

SEP 16
SEP 14.4
SEP 14.3 RU3 and above

Resolution

For Linux SEP 16 (ESA)

To deploy Endpoint Protection Linux when you install the Linux Agent first time, follow these steps on a base machine that will act as the source of the image:

Copy the installation package (agentsetup) to the /tmp directory
Switch to root
```
sudo su
```
Add the executable flag
```
chmod a+x agentsetup
```

Run the installer with the -i flag to indicate this will be an image

./agentsetup --image

The following is an example of the install as image

[root@xxx tmp]$ ./agentsetup --image

Broadcom Endpoint Security Agent 2.7.0

Installing packages:
 Package                                  Version         Source
 ---------------------------------------- --------------- ------
 esa-pkg                                  2.7.0-467       (repo)

Agent installed successfully
Notice: Installation was ran  with --image switch to create a templated image such as Amazon AMI.
Instance is ready for Image creation. Please DO NOT Reboot.
Shutdown the machine at convenience.

Power off the machine and make the image
Note: Do not reboot the machine as that step will register the machine, resulting in duplicated devices when the image is deployed.

Note: If you have previously installed SEP 16, you will need to uninstall the Agent and use the above steps.

1. To remove a previously installed agent, run the following command:
```
./agentsetup -u -f
```

For SEP 14.4 and SEP 14.3 RU3 to 14.3 RU9

To create a base image directly when you install the Linux Agent first time.

Install Linux agent by following command on clean OS.

./LinuxInstaller --image

Following is an example of result of above command:

[root@xxxx Downloads]# ./LinuxInstaller --image

Configuring Repo (ent-shasta-rrs.symantec.com/linuxrepo) ..

Symantec Agent for Linux
Symantec Endpoint Protection (SEPM) 14.3.9537.9000

Installing scripts package:
 Package                                  Version         Source
 ---------------------------------------- --------------- ------
 sdcss-scripts                            2.2.10-45       (repo)

Installing packages:
 Package                                  Version         Source
 ---------------------------------------- --------------- ------
 sdcss-caf                                2.0.9-236       (repo)
 sdcss                                    6.10.0-9537     (repo)
 sdcss-kmod                               10.0.8-2550     (repo)


Notice: Installation was ran  with –image switch to create
a templated image such as Amazon AMI.
Instance is ready for Image creation. Please DO NOT Reboot.
Shutdown the machine at convenience.

Shutdown OS as instructed.

To deploy Endpoint Protection Linux Agent as part of a previously cloned drive image, follow these steps on a base machine that will act as the source of the image:

For SEP Linux 14.3 RU9

Install Linux agent normally.

Run the following command:

./LinuxInstaller -- --image

The following is an example of result of above command:

[root@xxxx Downloads]# ./LinuxInstaller -- --image
Stopping Agent..
Agent Configuration Tool version 6.10.0.9537

IPS Feature not available. Cannot perform this action.
Notice: Installation was ran  with –image switch to create a templated image such as Amazon AMI.Instance is ready for Image creation. Please DO NOT Reboot.
Shutdown the machine at convenience.

For SEP 14.3 RU8 to 14.3 RU3

1. Open /etc/caf/CAFConfig.ini with text editor and delete "source_id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" line
2. Shutdown the OS

Additional Information

For SEP 14.3 MP1 and below, see How to deploy the Symantec Endpoint Protection Linux client as part of a cloned drive image.