cafagent stopped running after installing an offline package.

Products

• Endpoint Security Complete

Issue/Introduction

• After following the instructions in Creating an offline installation package for the Endpoint Protection Linux Agent and installing the package, it is found the CafAgent will not start/is no longer running.
  Daemon status:
    cafagent             not running
    sisamdagent          running
    sisidsagent          running
    sisipsagent          running
• /var/log/sdcss-caflog/cafagent.log will show "Bootstrap Failed" errors: 
  [|] 2022-10-26 18:12:52 | cafservice.CAFSAEPProductService | Notice | 31759 : 139901638756288 : TestBootStrap:2636 | Trying to bootstrap agent to confirm Network Connectivity
  [|] 2022-10-26 18:12:53 | cafservice.CAFSAEPProductService | Information | 31759 : 139901638756288 : TestBootStrap:2650 | While trying to test bootstrap,Server returned status code 404.
  [|] 2022-10-26 18:12:53 | cafservice.CAFSAEPProductService | Error | 31759 : 139901638756288 : VerifyNetworkConnectivity:2715 | Bootstrap failed 

 

Environment

SEP Linux Packager Tool (seplpkg) is used to create an offline installer package as per "Creating an offline installation package for the Endpoint Protection Linux Agent"

 

Cause

When seplpkg is creating the install package, it will hash some entries in the /etc/caf/CAFConfig.ini file that should not be hashed. 
In the case of the example, the x-epmp-customer-id and x-epmp-domain-id should be 22 character long url safe character strings, instead of sha256 hashes. 

Resolution

We are aware of this issue and working on a permanent solution. 

Workaround: 

Review the /etc/caf/CAFConfig.ini file for any entry that may be hashed. 

Incorrect: 

customer_id=[HASH_VALUE]=
domain_id=[HASH_VALUE]=
enrollment_url=https://usea1.r3.securitycloud.symantec.com/r3_epmp_i/v2/bootstrap/configuration
proxy_host=[PROXY_IP]
proxy_port=3128
proxy_httpsport=3128
proxy_user=
proxy_password=[HASH_VALUE]
proxy_type=CUSTOM

Correct  

x-epmp-customer-id=%&22digitcustomerID%%*
x-epmp-domain-id=%%%22digitdomainID%%%*
baseUri=https://usea1.r3.securitycloud.symantec.com/r3_epmp_i
enrollmentUri=/v1/enrollment/agent
Content-Type=application/json
...
[proxy-config]
proxy-mode=Manual
proxy-uri=http://[PROXY_IP]:3128
proxy-username=%UserID%
proxy-password=%Password%
proxy-host=[Proxy_IP]
proxy-port=3128
proxy-https-port=3128

Find and manually correct any hashed data. 

If necessary, find your customer and domain ID in the SES console by selecting your name at the top right corner and selecting "About/Support":

The necessary information will show there: 

Once this information is located it can be corrected with the following script: 

/etc/init.d/cafagent stop
vim /etc/caf/CAFConfig.ini
[enrollment-config]
x-epmp-customer-id=%22digitcustomerID%
x-epmp-domain-id=%22digitdomainID%
/etc/init.d/cafagent start