A guide for installing the ZeroLock™ Agent using curl or wget.The ZeroLock™ Agent (ZA) can be installed three (3) ways:
- COPY/PASTE – curl or wget (instructions below)
- DOWNLOAD – Self-Extracting bash or Tar Installer
- CONTAINER – Docker or AWS ECS
Regardless of the installation method, the following settings must be done. These settings are for the Collector that the endpoint will be connecting to. The Collector is the ZeroLock™ Management Console (ZMC) service that collects endpoint connection and threat information. It also authenticates and communicates with the ZeroLock™ Agents.
These settings should only have to be done once when configuring the ZMC, as the values rarely change after that point.
Navigate to Deploy on the left side menu which opens the screen below.
- Click on Advanced Settings.
- On the screen that appears, select the Agent Version to deploy. The default is the latest release.
- The Endpoint Profile may remain as default unless you wish to use another profile from the drop-down list.
- If desired, additional Endpoint Groups may be added by selecting from the drop-down list.
- Enter the collector IP address(s) or the FQN for one or more collector server(s).
- Click the Save as Default button to save the information and return to the Deploy home screen.
Once back on the Deploy home screen, under the Use Curl tab, click Copy Curl Installer to save the command to the clipboard.
To download and install the agent (Tyr), open a terminal session to the endpoint, then paste the copied script from step 3, into the terminal. You will want to run the installer with root privileges. This may take a few minutes.
If you prefer to use the wget command, the steps are the same as with curl, except this step replaced step 2. The wget installer is pasted into the terminal during step 3 after you open a terminal session to the endpoint.
Validating Agent Installation
To validate the installation process, select the Endpoints tab on the main menu. The new endpoint will be listed; the green dot in the status column indicates a successfully installed agent on the endpoint system.
View ZeroLock™ Agent Logs
Locate the ZeroLock™ Agent logs.
cd /opt/zerolock/zerolock-tyr To go to the Tyr directory.
/opt/zerolock/zerolock-tyr$ ls -la To list the contents of the directory.
To see the ZeroLock™ Agent log in detail, open a terminal session to the new Endpoint.
cat Tyr.log To read the log
An air-gapped computer or network is physically segregated and incapable of connecting wirelessly or physically with other network devices outside its own network. Air-gaps protect critical computer systems or data from potential attacks ranging from malware and ransomware to keyloggers or other attacks from malicious actors.
For instructions on installing the ZeroLock Agent on an air-gapped system please see the article Agent Installation to an Air-gapped Environment.
For more information, please see the Vali Cyber Support page.