CrowdStrike / falcon-scripts

Scripts to streamline the deployment and use of the CrowdStrike Falcon sensor
The Unlicense
142 stars 81 forks source link

Script does not appear to work on Linux Ubuntu 24.04 #335

Open MattWeatherford opened 1 month ago

MattWeatherford commented 1 month ago
root@hgis:~# ./falcon-crowdstrike-agent-install 
Check if Falcon Sensor is running ... [ Not present ]
Falcon Sensor Install  ... Fatal error: No sensor found for with OS Name: Ubuntu

root@hgis:~# uname -a
Linux hgis 6.8.0-38-generic #38-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun  7 15:25:01 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
root@hgis:~# more /etc/issue
Ubuntu 24.04 LTS \n \l
redhatrises commented 1 month ago

@MattWeatherford this is because 24.04 is currently unsupported. See https://falcon.crowdstrike.com/documentation/page/edd7717e/falcon-sensor-for-linux-system-requirements

rjchwcc commented 1 month ago

Obviously the statement from a couple of years ago that "we strive for day of support for major OS refreshes" was hot air then. 24.04 was released three MONTHS ago.

Any news on when it WILL be supported?

carlosmmatos commented 1 month ago

@rjchwcc | @MattWeatherford - Believe me, we understand the frustration and apologize for the inconvenience. Unfortunately, our team does not control the project timelines or have influence over them. In fact we face the same limitations from the API side, as we cannot query for information that is not yet available.

Unofficially, we might have a temporary workaround that could help. It may be possible to run the latest Ubuntu sensor in user-mode (bpf) on 24.04, although this is not officially supported. While it's not a perfect solution, it might offer some level of protection until the distribution receives official support.