Create Agent with Installer for RHEL

Supported in:

Google secops SOAR

Agent installation prerequisites

Google recommends running the commands one by one to make sure each action is run successfully.

Note: Installation requires superuser privileges. Some dependencies must be accessible to non-root users. As such, we don't recommend changing the root user's umask from the 0022 default value.

1. Configure PATH variable

echo 'export PATH=/usr/local/bin:$PATH' >> ~/.bashrc
source ~/.bashrc

2. Install Linux packages

dnf update -y
dnf groupinstall -y 'Development Tools'
dnf install bzip2-devel -y
dnf install sqlite -y
dnf install libffi-devel -y
dnf install gcc -y
dnf install gcc-c++ -y
dnf install python2-devel -y
dnf install python3-devel -y
dnf install zlib-devel -y
dnf install openssl-devel -y
dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
dnf install epel-release -y
subscription-manager repos --enable codeready-builder-for-rhel-8-x86_64-rpms
dnf install perl-core -y
dnf update -y
dnf install supervisor -y
dnf install at -y
dnf install sharutils -y

3. Start services

systemctl start atd
systemctl enable atd

4. Install Python 2.7.18

cd /usr/src/
yum install wget -y
wget https://www.python.org/ftp/python/2.7.18/Python-2.7.18.tgz
tar -xzf Python-2.7.18.tgz
cd Python-2.7.18
./configure --prefix=/usr/local --enable-unicode=ucs4
make
make altinstall

5. Install OpenSSL 3.0.7

cd /usr/local/src
wget https://www.openssl.org/source/openssl-3.0.7.tar.gz
tar -xf openssl-3.0.7.tar.gz
cd openssl-3.0.7
./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared zlib
make -j$((`nproc`+1))
make install
cd /etc/ld.so.conf.d/
echo /usr/local/ssl/lib64 > openssl-3.0.7.conf
ldconfig -v
echo PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/ssl/bin" > /etc/environment
source /etc/environment
ln -sf  /usr/local/ssl/bin/openssl /usr/bin/openssl
export LDFLAGS="$LDFLAGS -L/usr/local/ssl/lib64"
export LD_LIBRARY_PATH=/usr/local/ssl/lib64

6. Install Python 3.7.4

cd /usr/src
wget https://www.python.org/ftp/python/3.7.4/Python-3.7.4.tgz
tar xzf Python-3.7.4.tgz
cd Python-3.7.4
./configure --prefix=/usr/local --enable-unicode=ucs4 --with-openssl=/usr/local/ssl
make
make altinstall

7. Install Python 3.11.8

cd /usr/src
wget http://www.python.org/ftp/python/3.11.8/Python-3.11.8.tgz
tar xzf Python-3.11.8.tgz
cd Python-3.11.8
make clean
./configure --prefix=/usr/local --enable-unicode=ucs4 --with-openssl=/usr/local/ssl
make
make altinstall

8. Create symlinks to the specific Python files

ln -s /usr/local/bin/python2.7 /usr/local/bin/python2
ln -s /usr/local/bin/python3.7 /usr/local/bin/python3

9. Configure pip

wget -O get-pip.py https://bootstrap.pypa.io/pip/2.7/get-pip.py
/usr/local/bin/python2 get-pip.py
/usr/local/bin/python3 get-pip.py
/usr/local/bin/pip2 install --upgrade pip
/usr/local/bin/pip3 install --upgrade pip
wget -O get-pip-3.11.py https://bootstrap.pypa.io/get-pip.py
/usr/local/bin/python3.11 get-pip-3.11.py
/usr/local/bin/python3.11 -m pip install --upgrade pip

Using Microsoft SQL integration (Optional)

For those using Microsoft SQL Integration, perform the following steps:

MsOdbc Sql Driver utils

dnf -y remove unixODBC unixODBC-devel
curl  https://packages.microsoft.com/config/rhel/8/prod.repo > /etc/yum.repos.d/mssql-release.repo
dnf install -y msodbcsql17 mssql-tools unixODBC-devel
ln -sfn /opt/mssql-tools/bin/bcp /usr/bin/bcp
ln -sfn /opt/mssql-tools/bin/sqlcmd /usr/bin/sqlcmd

To install a Remote Agent:

Make sure you have installed all the prerequisites as detailed above.
In the platform, navigate to Settings > Advanced > Remote Agents.
Click the plus icon on the top right of the screen to open the Installation process.
Click the Manual installation link.
In the first step, add the name of the Agent and choose the environment it will be associated with. Click Next.
In the second step, you can either choose to download the Agent package onto your machine, or you can add in an email address to send it a download link (Make sure you have configured the Email Integration to the correct environment). Alternatively you can click Add environment contact which will automatically add in the email of the Contact Person for that environment. Click Next. The package is either downloaded onto your computer or a link is sent by email depending on what you have chosen.
Clicking on the link downloads the following zipped files to the required machine:
- .env: Siemplify environment variables
- SiemplifyAgent_Centos.sh: Installer script file
Copy over the Installer command that is on the screen and save it for later. Keep the wizard open.
Using WinSCP or a similar tool, copy these files over to the machine you want to install the agent on.
Log in to the machine that you want to install the agent on using SSH.
Enter your username and password.
Set the execution permissions on the file with the following command:
sudo chmod +x SiemplifyAgent_Centos.sh
Install the agent using the saved command from the Agent Installation screen
When the script finishes, it will be clearly marked as finished.
Return to the Wizard in the platform and click “Next”. You will receive a confirmation message that your Agent is connected.

Need more help? Get answers from Community members and Google SecOps professionals.