CrowdStrike / falcon-scripts

Scripts to streamline the deployment and use of the CrowdStrike Falcon sensor
The Unlicense
145 stars 85 forks source link

Falcon-Senor-Linux-Install script not working on Rocky Linux Version 9 #352

Closed chris000001 closed 1 month ago

chris000001 commented 1 month ago

I get this error message: Falcon Sensor Install ... Fatal error: Unable to locate matching sensor: RHEL/CentOS/Oracle, version: 9 Wen trying to run: curl -L https://raw.githubusercontent.com/crowdstrike/falcon-linux-install-bash/main/falcon-linux-deploy.sh | bash

OS details cat /etc/os-release NAME="Rocky Linux" VERSION="9.4 (Blue Onyx)" ID="rocky" ID_LIKE="rhel centos fedora" VERSION_ID="9.4" PLATFORM_ID="platform:el9" PRETTY_NAME="Rocky Linux 9.4 (Blue Onyx)"

carlosmmatos commented 1 month ago

@chris000001 where did you get that URL from?

It should be: https://raw.githubusercontent.com/CrowdStrike/falcon-scripts/main/bash/install/falcon-linux-install.sh

As per the docs, you probably want to run it like this - using a version instead:

curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.5.3/bash/install/falcon-linux-install.sh | bash
chris000001 commented 1 month ago

Ok So it looks like I got it from here https://github.com/CrowdStrike/falcon-linux-install-bash, which appears to have been archived. I've been using this script for a long time and up until today it has worked perfectly, but this is my first time using it on Rocky so maybe that's where the difference was.

I tried with the URL you provided and it works.

Question about having the version in the URL. If the version number changes does that break the URL? I am using this as part of an automation script so having to keep up with the URL changing defeats the purpose.

carlosmmatos commented 1 month ago

Oh yeah, it's been archived for like 2 years! Surprised it was still working for you.

To answer your question wrt to why you want to use a version is because it allows you to pin and or revert to a previous version in the event a bug is introduced in newer versions. If you want bleeding edge you can replace the version with main instead. It's up to you.