search

elastic / security-docs

Elastic Security Documentation
Other
67 stars 181 forks source link

Document ways to provide multiple tamper protection `--uninstall-token` values #5865

Open ferullo opened 1 month ago

ferullo commented 1 month ago

Users with many tamper protected Agent policies want a way to provide many uninstall tokens to Agent. That has been supported since tamper protection was first released, we just missed documenting it.

There are two ways to provide multiple uninstall tokens.

1. A comma separated list --uninstall-token can receive multiple tokens that are separated by a comma (no spaces).

A Linux example is sudo /opt/Elastic/Agent/elastic-agent uninstall -f --uninstall-token 7b3d364db8e0deb1cda696ae85e42644,a7336b71e243e7c92d9504b04a774266

1. A file with one token per line --uninstall-token's argument can also be a path to a file with one uninstall token per line. It's important to note that the full path to the file should be used or the file may not be found.

A Linux example command is sudo /opt/Elastic/Agent/elastic-agent uninstall -f --uninstall-token /tmp/tokens.txt where tokens.txt contains

7b3d364db8e0deb1cda696ae85e42644
a7336b71e243e7c92d9504b04a774266

cc @caitlinbetz @nfritts @cmacknz for visibility

joepeeples commented 1 month ago

Thanks for the ticket @ferullo! It looks like we first documented tamper protection starting in 8.11 so we'll try to backport to that version for completeness.

We'll also update the same content in serverless docs since this seems to apply to both ESS and serverless Security environments — please correct me if I'm wrong about that.