Install Uptycs Protect (AIX) without process blocking

Install Uptycs Protect (AIX) without process blocking

Currently, in AIX with Uptycs-protect installation process blocking and dns blocking are not supported. Thus after the installation below steps need to be followed to install the uptycs-protect sensor.

The below method of procedure describes the step by step process to install Uptycs Protect with remediation enabled and process blocking disabled on AIX endpoints.

======================================================================

Important Note: The correct flag value MUST be in the flags file before starting osqueryd service

================================================================


Method of Procedure:

Follow the below steps to install the Uptycs Protect on AIX endpoints:


  1. Before installing Uptycs Protect package on any AIX endpoints, check process blocking flag is set to false by executing the below command:


bash-5.1# grep process_blocking /opt/uptycs/osquery/etc/osquery.flags

--enable_process_blocking=false

​

Action: If the output shows true — Don't install Uptycs Protect. Keep using Standard build and assign the correct flag profile so that the asset gets process_blocking=false on disk.


  1. If the process blocking flag is set to false, then proceed to the next step.


  1. If the AIX endpoints are installed with existing Protect, then use the below command to force install the new version of the Protect osquery.


rpm -Uvh --nopost --force uptycs-protect-5.9.2.28-Uptycs-202312071624.aix7.2.ppc.rpm


  • Upgrading osquery will overwrite an old version. When upgrading from Standard to Protect we don't have to worry about uninstalling the KEXT first.

  • Make sure the asset is assigned the correct flag profile before downloading (Best option is to assign a non-blocking flag profile and then use the base osquery protect package with no flags+secret. After verifying that the asset has the correct flag value, only then install Uptycs Protect build.)


  1. Verify if process_blocking is set to FALSE:


# grep process_blocking /opt/uptycs/osquery/etc/osquery.flags

--enable_process_blocking=false


  1. Verify if remediation is enabled:


# grep process_blocking /opt/uptycs/osquery/etc/osquery.flags

--enable_remediation=true


  1. Then start osqueryd:


# /etc/rc.d/init.d/osqueryd start


This should start the osqueryd service with remediation enabled and process blocking disabled. 


Should you need any help, please free to contact support@uptycs.com


    • Related Articles

    • Installing Uptycs Protect using Jamf Pro

      Overview This document outlines the procedure on how to install the Uptycs Protect agent on macOS using Jamf. If you are already familiar with Jamf, please use the attached UptycsProtect.plist and UptycsProtect.mobileconfig files to setup Uptycs ...

    • Install Uptycs Protect on MacOS by MDMDeployment

      Install Uptycs Protect on MacOS by MDMDeployment This article focuses on the deployment of configuration profiles to install Uptycs Protect using anMDM provider on macOS. Notably, it does not explore the distribution of installation packages.For ...

    • Install Uptycs agent with Chef

      Overview This document outlines the steps / procedure to install Uptycs osquery agent using Chef Pre-requisite(s) yum repo containing Uptycs - Creating a custom Yum Repo that contains Uptycs Details Following chef recipe can be used to install the ...

    • Manual Uninstall of Uptycs Protect on MAC

      Uninstallation of Uptycs Protect on MAC: 1. First, unload the osquery daemon from the terminal by executing the commands below: sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist sudo rm -rf private/var/osquery ...

    • Provisioning roles through Uptycs portal

      Overview Starting with Uptycs portal release 46025, Uptycs provides entity level granular user permissions through roles. Roles can be provisioned / modified by navigating to Roles GUI / API. This document outlines the process to create roles using ...