Skip to main content
KarlH
KarlH
Explorer II
March 10, 2025
Question

Using SIEM 7.1.3, the RHEL 9.4 endpoint is using SELinux, it is failing to install Linux Agent

  • March 10, 2025
  • 2 replies
  • 869 views

Hello,

 

Would appreciate any insightful details on why the installs might be failing

 

SELinux is enabled, these  following

packages are also installed:

policycoreutils-python

libselinux-utils

setools-console

 

I don't have the logs yet but any insights as to why the agents are failing install. Also what is the absolute highest version to safely install on RHEL 9.4? ARe Fortinet haveing issue with this latest version?

 

Agent Versions Attempted(Supervisor version 7.1.3):

  • Version 7.1.3: FSM Linux Agent not updated with the latest certificate.
  • Version 7.1.7: installed require Packages to enable SELinux still issue not resolved research done by vendor engineerand suggested attempt v7.2.4

Version 7.2.4: Vendor engineering team updated parts of the script related to SELinux  hence attempted this version

 

 

Can anyone please verify if they have a functioning Lunx agent on RHEL 9.4 SELinux? We are stuck.

Are we missing packages? what about these ?

 

libcap

audit

rsyslog

logrotate

at

perl

bind-utils

audispd-plugins

 

Thank you as always in advance!

 

Karl

2 replies

AEK
SuperUser
AEK
SuperUser
March 11, 2025

Hi Karl

I'm old Unix/Linux school and when they introduced SELinux I couldn't find the time to master it as I should do. So when SELinux prevents me to install something, the solution for me was simple: Disable it, install what I need to install, then enable it again.

setenforce 0
--> install FSM agent
setenforce 1

Hope it helps.

AEK
KarlH
KarlHAuthor
Explorer II
March 12, 2025

NEW TITLE:  

7.2.4 Agent on RHEL 9.4 using SELinux, via Proxy on 7.2.2 Collector is not seen by SIEM 7.1.3 (shows Disconnected)

 

 

Thanks AEK! , yep I am a long time OpenSUSE  guy as well.   

Well it turns out

Problem: The Agent does install, The SIEM does not see the Agent, it is showing disconnected

 

Given:

 

1.) customer is not willing to turn off SELinux in 9.4 RHE. Probably for legal/compliance and contractual obligations. 

2.) Linux Agent is 7.2.4 ( That agent DOES install.) While SELinux is enforced.

3.) Collector is 7.2.2

4.) Siem is 7.1.3 

5.) All TLS handshakes have been verified.

We are stuck with what we got. Other knowns.

 

Fortinet has already spent at least 3 or 4 hours troubleshooting. 

 

I need a link to a detailed doc or a crash course in how deep do these Linux agents go,  the kernel level? Communication to the SIEM is not happening all TLS and other standard trouble shooting have been completed and verified so we know its at the SELinux end point.

 

I really feel that Red Hat should get involved with helping to identify the logs that SELinux provides there must be clues somewhere. I really appreciate everyone insights.

Question. Where are all the logs for SELinux?

 

What about Audit Logs. Has Fortinet run into this issue with RHE 9.4 SELinux in the past for this or is this issue stand alone? 

 

Thank you!

 

Karl

 

 

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.