https://docs.google.com/spreadsheets/KROLL
uname -r
cd /usr/local/src
wget http://centosone.binghamton.edu/Upload/KROLL.tar
tar -xvf KROLL.tar
cd KROLL/
./CarbonBlackClientSetup-linux-v7.0.0.14291.sh
cat /var/opt/carbonblack/response/log/install.log
cp -rp /opt/carbonblack/response/modules/cbsensor.ko.3.10.0-957 \
/opt/carbonblack/response/modules/cbsensor.ko.$(uname -r | awk '{split($0,kv,"."); print kv[1] "." kv[2] "." kv[3]}')
/etc/sysconfig/modules/cbresponse.modules
Installing kernel module for 4.1.12-124.43.4.el6uek.x86_64
/etc/init.d/cbdaemon restart
Stopping cbdaemon: [ OK ]
Starting cbdaemon: Starting kernel module.
[ OK ]
cp -rp /opt/carbonblack/response/modules/cbsensor.ko.3.10.0-957 \
/opt/carbonblack/response/modules/cbsensor.ko.$(uname -r | awk '{split($0,kv,"."); print kv[1] "." kv[2] "." kv[3]}')
/etc/sysconfig/modules/cbresponse.modules
Installing kernel module for 4.1.12-124.43.4.el6uek.x86_64
/etc/init.d/cbdaemon restart
systemctl start cbdaemon.service
systemctl status cbdaemon.service
systemctl start cbebpfdaemon.service
systemctl status cbebpfdaemon.service
ps -ef |egrep 'cbd|cb_ebp' |egrep -v grep
OEL7 only:
==========
### may need to change in /etc/firewalld/firewalld.conf
AllowZoneDrifting=yes to no
systemctl status firewalld
=================++++++=====================================
### NOTE: SKIP BELOW IF FIREWALLD IS NOT RUNNING
### And email Jeff with the server it is not running on
=================++++++=====================================
systemctl enable firewalld
systemctl start firewalld
firewall-cmd --zone=public --permanent --add-service=ssh
firewall-cmd --reload
firewall-cmd --list-all
firewall-cmd --get-log-denied
firewall-cmd --set-log-denied=all
systemctl status firewalld
cat <<eof > /etc/logrotate.d/firewalld-custom
/var/log/firewalld-custom.conf {
dailyly
missingok
rotate 5
copytruncate
maxsize 1000M
}
eof
ls -l /etc/logrotate.d/firewalld-custom
cat /etc/logrotate.d/firewalld-custom
cat <<eof > /etc/rsyslog.d/firewalld-custom.conf
:msg,contains,"_DROP" /var/log/firewalld-drop.log
:msg,contains,"_REJECT" /var/log/firewalld-drop.log
& stop
eof
ls -l /etc/rsyslog.d/firewalld-custom.conf
cat /etc/rsyslog.d/firewalld-custom.conf
systemctl restart rsyslog
tail -f /var/log/firewalld-drop.log
==========
????
MISSING: Yum repository information for client updates.