Trying to Run a Linux sh Script in BigFix

[JoeG]

Hi, I have a what I thought to be a simple task in creating a BigFix task to install an agent. But for some reason, I can’t get it to install. It says completed with exit code 127. This is what’s in my task. Any help\suggestions would be greatly appreciated.

prefetch agents-linuxzip.tmp sha1:d3f9ca82cb8d4b3496576728c903f30d86f8953c size:41378831 http://172.16.0.32:52311/Uploads/d3f9ca82cb8d4b3496576728c903f30d86f8953c/agents-linuxzip.tmp sha256:b01d631312af0e008ad8f3f8196fe48a81a4931ddb0faecad8916f17e64809c9

extract agents-linuxzip.tmp

if {exists folder “/tmp/Rapid7”}
folder delete "/tmp/Rapid7"
endif

folder create “/tmp/Rapid7”

// Extract ZIP file to Rapid7 folder
extract agents-linuxzip.tmp “/tmp/Rapid7”

//Extract ZIP file contents to the /tmp/Rapid7 folder
wait /bin/sh -c “sudo unzip /tmp/Rapid7/agents-linux.zip -d /tmp/Rapid7”

// Modify execute permissions for installer
wait /bin/sh -c “chmod u+x /tmp/Rapid7/agent_installer.sh”

// Install the app
wait /bin/sh -c “tmp/Rapid7/agent_installer.sh install_start)”

[alinder]

Have you confirmed that the files you would expect are at /tmp/Rapid7? I’ll also note that there is seemingly a stray ) as the second to last character of your action. Maybe that’s causing a problem?

[JasonWalker]

The code 127 is what is returned from the shell on the last ‘wait’ command. I think alinder is right with the parenthesis.

Another common issue is that scripts run with ‘sh’ generally aren’t run from a Login Shell, and often don’t have the $PATH you might expect.

Try using fully-qualified paths for binaries like sudo and unzip, or using /bin/sh --login -c “command” to run as a login shell (with a user environmentl.

[JoeG]

The files are there so they do get downloaded. The stray ) was accidental in the copy and paste into this post. I’ve been trying many things for example I tried installing it from the download folder like this.

prefetch 50db47d316b5591b9873d337f23d51e2573b5a13 sha1:50db47d316b5591b9873d337f23d51e2573b5a13 size:41366128 http://172.16.0.32:52311/Uploads/50db47d316b5591b9873d337f23d51e2573b5a13/agents-linux.tmp sha256:cf502952a5b7a641aac0620b157e2cd34e9df736600237770620f0b987f401d1

extract 50db47d316b5591b9873d337f23d51e2573b5a13

//modify execute permissions for installer
wait /bin/sh -c “(cd __Download/agents-linux/ && chmod u+x agent_installer.sh”

//Install from the download folder
wait /bin/sh -c “(cd __Download/agents-linux/ && ./agent_installer.sh install_start)”

[JoeG]

I’m thinking your second sentence is what’s happening here. Although, still not sure. As far as using fully qualified paths for binaries…could you give me an example of what it should look like for my task? Below is what I’m using right now. Sorry if this causes confusion. I still have the task from above, where I used the Mac Software Deployment Wizard to choose the zip file. I’ve tried a variety of things. But for what I have below, I’m using the windows software distribution wizard to pick up these files in this task. Will that work? Or…how would you suggest I upload this files so that I can prefetch them via a task\fixlet? Thanks again!

prefetch 50db47d316b5591b9873d337f23d51e2573b5a13 sha1:50db47d316b5591b9873d337f23d51e2573b5a13 size:41366128 http://172.16.0.32:52311/Uploads/50db47d316b5591b9873d337f23d51e2573b5a13/agents-linux.tmp sha256:cf502952a5b7a641aac0620b157e2cd34e9df736600237770620f0b987f401d1

extract 50db47d316b5591b9873d337f23d51e2573b5a13

//modify execute permissions for installer
wait /bin/sh -c “(cd __Download/agents-linux/ && chmod u+x agent_installer.sh)”

//Install from the download folder
wait /bin/sh -c “(cd __Download/agents-linux/ && ./agent_installer.sh install_start)”

[JasonWalker]

Yeah pathing could be a real problem there, when you start a new ‘sh’ it may not be using the besclient folder as the working directory…try

wait /bin/sh -c “(cd {pathname of download folder}/agents-linux/ && chmod u+x agent_installer.sh)”

[JoeG]

wait /bin/sh -c “(cd {pathname of download folder}/agents-linux/ && chmod u+x agent_installer.sh)”

Hi Jason, just getting back around to this one. Unfortunately I’m still having issues. This is what I tried at your suggestion. Again, I used the windows software distribution wizard to upload the files to the BigFix Server.

prefetch c783f9f7684bbb57218eb33170f13532bd2607b8 sha1:c783f9f7684bbb57218eb33170f13532bd2607b8 size:43732307 http://172.16.0.32:52311/Uploads/c783f9f7684bbb57218eb33170f13532bd2607b8/agents-linux.tmp sha256:7a59a12d3d29962a19eb504beeb48dd988f0da966bbc9abae9eeab0e5808a820
extract c783f9f7684bbb57218eb33170f13532bd2607b8

//change shell script permission to execute
wait /bin/sh -c “(cd {pathname of download folder}/agents-linux/ && chmod u+x agent_installer.sh)”

//wait /bin/sh -c “(cd __Download/agents-linux/ && chmod u+x agent_installer.sh)”

//run the script
wait /bin/sh -c “(cd {pathname of download folder}/agents-linux/ && ./agent_installer.sh install_start)”

These are the instructions for the agent install from the vendor.

"To install the Insight Agent using the certificate package on Mac and Linux assets:

Fully extract the contents of your certificate package ZIP file. Make sure that the .sh installer script and its dependencies are in the same directory.
Run the following command in a terminal to modify the permissions of the installer script to allow execution:
chmod u+x agent_installer.sh
Lastly, run the following command to execute the installer script. The Insight Agent will be installed as a service and appear with the name “ir_agent” in your service manager:
sudo ./agent_installer.sh install_start"

Do you see my mistake, or have any other suggestions?

Thanks!

[JasonWalker]

I don’t have a Linux box handy to test on, and I’m not certain how whether shell handles the multiple commands. I’d try to make it a little simpler by building a script and then running it. Along the lines of the following (after the extraction)

createfile until EOF_EOF
unzip /tmp/Rapid7/agents-linux.zip -d /tmp/Rapid7
chmod u+x /tmp/Rapid7/agent_installer.sh

/tmp/Rapid7/agent_installer.sh install_start
EOF_EOF
move __createfile installit.sh
waithidden /bin/sh --login -c installit.sh

But then, as I was copy/pasta editing, I saw your last ‘waithidden’ was missing the slash in front of /tmp so you might try that too.

Edit: removed ‘sudo’ as well. You shouldn’t need sudo, besclient is already running as root.

[JoeG]

atefile until EOF_EOF
unzip /tmp/Rapid7/agents-linux.zip -d /tmp/Ra

Yeah, in my original post, I was browsing out to the agents-linux.zip file as creating the task using the extracted agents-linux folder wasn’t working and giving me the 127 exit code. That’s why I was unzipping it. We got that same exit code for MAC’s. So browsing out to the zipped folder worked when we created this agent installer for MAC’s using the the MAC software distribution wizard.

I’ll give this suggestion a try tomorrow.

Thank you!

[JoeG]

Jason\guys, this is what finally ran successfully.

if {exists folder “/tmp/rapid7”}
folder delete "/tmp/rapid7"
endif

if {exists folder “/tmp/Rapid7”}
folder delete "/tmp/Rapid7"
endif

//create rapid7 folder
folder create /tmp/rapid7

//move from download folder to newly created folder
move __Download/agents-linux.zip /tmp/rapid7/agents-linux.zip

//install unzip
wait sudo yum install unzip -y

//unzip agents-linux.zip to the rapid7 directory
wait /bin/sh -c “unzip /tmp/rapid7/agents-linux.zip -d /tmp/rapid7”

//modify execute permissions for installer
wait chmod u+x /tmp/rapid7/agent_installer.sh

//install the app
wait /bin/sh -c “/tmp/rapid7/agent_installer.sh install_start”

Thanks for all your help!
Jose

[seacros]

What if you need to become root to do the install? Is there a way to sudo in the long command?

I am trying to install cloudamize

sh <(curl --proxy proxy-corp.xxxx.net:8080 ‘https://am.cloudamize.com/cxf/downloadFileV3?custkey=KeyName&filename=installCloudamizeAgentV2.sh’ -L) proxy-corp.xxxx.net 8080

I can run the above when logged into the server (after I sudo -i) i am just trying to make a fixlet to do the same

Thanks

[JasonWalker]

sh <(curl --proxy proxy-corp.xxxx.net:8080 ‘https://am.cloudamize.com/cxf/downloadFileV3?custkey=KeyName&filename=installCloudamizeAgentV2.sh’ -L) proxy-corp.xxxx.net 8080

The agent is already running as root, so there’s usually not a need to ‘su’ or ‘sudo’ unless you need the script to run in some other user context.

I obviously can’t test this command, but I expect the actionscript would be something like

wait /bin/sh -c "<(curl --proxy proxy-corp.xxxx.net:8080 'https://am.cloudamize.com/cxf/downloadFileV3?custkey=KeyName&filename=installCloudamizeAgentV2.sh1' -L) proxy-corp.xxxx.net 8080"

I’m not entirely sure I understand the input redirection you’re using here though or why the proxy is listed twice.

[seacros]

Thanks for your reply. I found out from the vendor that the install has to run as root

“—The Linux agent/agentless approach requires a user with root permissions to get PID-to-network mapping, certain hardware details, and data on logical/physical disk volumes. Become root user either through “sudo -s” or “su”, most systems use sudo.”

[JasonWalker]

Sure, but running as BESClient, it’s already root.

[seacros]

I have tried again with your suggestions and it still is not working. The installation instructions as per their site does not have BigFix as an option to do the install and was hoping to try to make it work.

Installation Instructions