---
- name: Vne task
  hosts: all 
  become: yes
  become_user: root
  tasks:
    - name: Uninstalling Agent
      command: "[ENTER PATH TO AGENT]/agent-linux64.sh -r"
      register: cmd_op

    - debug:
            var: cmd_op.stdout_lines

Command to Check Agent Status

---
- name: Vne task
  hosts: all 
  become: yes
  become_user: root
  tasks:
    - name: Checking Agent Service Status
      command: "systemctl status agentcored"
      register: cmd_op

    - debug:
            var: cmd_op.stdout_lines

Deploying Agents using RPM Packages on RHEL 6/7/8/9

You can find the Linux RPM package for RHEL 6/7/8/9 at the bottom of the page.

Prerequisites

Copy the following files to a Linux directory.

• AD_Linux_RPM_Public.pgp – GPG Public Key
• agent_linux-7.7.0-*.x86_64.rpm – Redhat Agent

• ss_ca.crt – Public Certificate from your Site Server or Enterprise

Installation

1. Open Terminal as Root/Sudo.
2. Import the provided GPG Public key by entering the following command:

$ sudo rpm –import AD_Linux_RPM_Public.pgp

Check if the RPM repository contains the imported GPG Key

1. Open Terminal as Root/Sudo.
2. Check the status of the repositories GPG key by entering the following commands:

$ rpm -q gpg-pubkey --qf '%{name}-%{version}-%{release} --> %{summary}\n'

$ rpm --checksig  [agent installer rpm file]

Configuring and Installing the Agent

The agent must be configured before deployment to suit your needs. These changes can be made to agent.config.

1. Ensure /usr/AccessData/agent/tmp path has been created/or present.
2. Create agent.config or use the provided config file attached.
3. Open agent.config in a text editor.
4. Use the table below to configure your agent and save any changes.

5. Move the agent.config file to the /usr/AccessData/agent/tmp path by entering the following command:

$ mv agent.config /usr/AccessData/agent/tmp

The net-tools can be installed using the below command:

yum install net-tools.x86

6. Install the agent by entering the following command:

$ sudo rpm -iv [rpm file name]

For RHEL 9, if the installation fails (for the FOLDER_STORAGE=1 configuration) and the /etc/rc.d/init.d/functions: No such file or directory error is displayed, execute the below command and reinstall the RPM:

yum install -y initscripts

Agent Modules

Once an agent has been installed and a agent job has been initiated, the agent modules will automatically be installed.

If you face any issues please follow the steps below to ensure successful module installation.

1. Open FTK Enterprise and login using an administrator account.
2. Open a case.
3. Click Tools > Configure Agent Push.
4. Select the Path to agent modules.

Ensure the path selected points to the correct agent modules. This is required.

5. Click OK.
6. Select the Path to trust modules certificate.

Ensure the correct .p7b has been selected. This is required.

7. Click OK.

Pushing Agent Modules Manually

1. Open FTK Enterprise and login using an administrator account.
2. Open a case.
3. Click Evidence > Add Remote Data.
4. Select an Agent. 

If this agent is not configured to check-in with a site server then add the agent manually. Select Load agents from manual entry list.

5. Select Install or Update Agent Modules.
6. Select Modules only.
7. Select a job such as Process Info to allow for the update to proceed.
8. Click OK.

Uninstalling the Agent

When using the following command, please note that both the agent as well as the AccessData agent directory will be deleted.

$ sudo rpm --erase agent_linux

Accessing the Linux files from Windows (Optional)

The below steps should be followed to create a network-shared folder in Red Hat-based distribution and access it from Windows using Samba

Step 1: Installing Samba

• Execute the below command to install Samba:

sudo yum install samba

Step 2: Configuring SELinux (Optional)

If SELinux is enabled in the CentOS system, it should be configured to allow access to Samba.

• Run the following command to allow Samba to share files:

sudo setsebool -P samba_export_all_rw 1

Step 3: Adding a user to the Share path

• Execute the below commands to add a user to the share path: 

sudo useradd <username>

sudo passwd <username>

Step 4: Configuring Samba

• Open the Samba configuration file (smb.conf) using a text editor with root privileges using the below command:

sudo vi /etc/samba/smb.conf

• In the [global] section of the configuration file, set the workgroup and other Samba options as provided below:

[global]

workgroup = WORKGROUP # Replace "WORKGROUP" with your Windows

workgroup name

#server string = Samba Server %v

#netbios name = myserver

#security = user

#map to guest = bad user

#dns proxy = no

• Below the [global] section, create a new section for your shared folder.

For example, if you want to share the folder located at /path/to/shared_folder, add the following information to the smb.conf file:

[shared_folder]

path = /path/to/shared_folder

browsable = yes

#writable = yes

#guest ok = yes

#guest only = yes

#read only = no

#create mask = 0777

#directory mask = 0777

#force user = your_linux_username

Step 5: Creating Folders or Files on the share path 

• Create folders or files in the share path mentioned in Step 4 to collect the data.

Step 6: Creating a user file for Samba user

• Create a user file for the Samba user using the below command:

sudo vi /etc/samba/users.map

• In the users.map file, add the samba user created in Step 3

<username> = <domain>/<username>

Step 7: Creating a Samba User

• Create a Samba user and set a password for it:

sudo smbpasswd -a your_samba_username

Step 8: Restarting Samba

• After making changes to the smb.conf file, restart the Samba service using the below command:

sudo systemctl restart smb

Step 9: Ensuring the Samba service is added to the firewall

• Check if the Samba service is added to the firewall by executing the below command: 

firewall-cmd --list-all

• If Samba is not present in services list [services: cockpit dhcpv6-client samba ssh], add it using the below command:

firewall-cmd --permanent --add-service=samba

firewall-cmd --reload

Step 10: Confirming if the folder has been made shareable

• Ensure the folder has been made shareable by accessing it from Windows.

Configuring Samba in Debian

1. Installing Samba:

• Open a terminal and run the following command to install the Samba package:

sudo apt install samba

sudo mkdir /shared_folder

sudo /etc/samba/smb.conf

[SharedFolder]

path = /shared_folder

valid users = <username>

writable = yes

guest ok = yes

guest only = yes

force create mode = 777

force directory mode = 777

smbpasswd -a <username>

sudo service smbd restart

sudo firewall-cmd --list-all

firewall-cmd --permanent --add-service=samba

firewall-cmd --reload

\\<debian machine hostname or IP address>\SharedFolder