Endpoint Standard: Sensor does not register on RHEL 6 with proxy in place

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Proxy configured in cfg.ini like ProxyServer=https://server:port
• Proxy server may show an error related to a null value in the request

Environment

• Endpoint Standard Linux Sensor: 2.7 and newer versions
• RHEL 6.x

Cause

The sensor does not support HTTPS proxy communication on RHEL 6.x

Resolution

• If the sensor shows a partial install in the console
  1. Stop the sensor

service cbagentd stop

2. Modify /var/opt/carbonblack/psc/cfg.ini

Change 

ProxyServer=https://domain.com:port

To

ProxyServer=http://domain.com:port

• If the sensor did not register at all
  1. Uninstall the sensor

rpm -e cb-psc-sensor

2. Delete /var/opt/carbonblack if still present
3. Deploy the sensor with the proxy using HTTP before running the install: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Deploy-the-CBC-Sensor-on-Linux/ta-p/74655

Additional Information

• If the company code is included when install.sh is run, the installation will not complete successfully 
• The initial handshake connection with the proxy is in cleartext, however, communication sent to the backend is all encrypted
• Ensure the proxy is configured to allow for TLS tunneling, the sensor will not send data unencrypted