From 180cad0aa3ace97c1986a531f3557429f52cb456 Mon Sep 17 00:00:00 2001 From: MatiG Date: Mon, 4 Jan 2021 19:00:20 +0200 Subject: [PATCH] clean linter warnings --- .../linux-support-install.md | 27 ++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md b/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md index 9a2bf09a0d..0f1f9c1af8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-support-install.md @@ -24,7 +24,6 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender for Endpoint for Linux](microsoft-defender-atp-linux.md) @@ -36,9 +35,11 @@ An error in installation may or may not result in a meaningful error message by ```bash sudo journalctl | grep 'microsoft-mdatp' > installation.log ``` + ```bash grep 'postinstall end' installation.log ``` + ```Output microsoft-mdatp-installer[102243]: postinstall end [2020-03-26 07:04:43OURCE +0000] 102216 ``` @@ -54,6 +55,7 @@ Check if the mdatp service is running: ```bash systemctl status mdatp ``` + ```Output ● mdatp.service - Microsoft Defender for Endpoint Loaded: loaded (/lib/systemd/system/mdatp.service; enabled; vendor preset: enabled) @@ -69,47 +71,59 @@ systemctl status mdatp ## Steps to troubleshoot if mdatp service isn't running 1. Check if "mdatp" user exists: + ```bash id "mdatp" ``` + If there’s no output, run + ```bash sudo useradd --system --no-create-home --user-group --shell /usr/sbin/nologin mdatp ``` 2. Try enabling and restarting the service using: + ```bash sudo systemctl enable mdatp ``` + ```bash sudo systemctl restart mdatp ``` 3. If mdatp.service isn't found upon running the previous command, run: + ```bash sudo cp /opt/microsoft/mdatp/conf/mdatp.service ``` + where `````` is ```/lib/systemd/system``` for Ubuntu and Debian distributions and - ```/usr/lib/systemd/system``` for Rhel, CentOS, Oracle and SLES. + ```/usr/lib/systemd/system``` for Rhel, CentOS, Oracle and SLES. Then rerun step 2. 4. If the above steps don’t work, check if SELinux is installed and in enforcing mode. If so, try setting it to permissive (preferably) or disabled mode. It can be done by setting the parameter `SELINUX` to "permissive" or "disabled" in `/etc/selinux/config` file, followed by reboot. Check the man-page of selinux for more details. Now try restarting the mdatp service using step 2. Revert the configuration change immediately though for security reasons after trying it and reboot. -5. If `/opt` directory is a symbolic link, create a bind mount for `/opt/microsoft`. +5. If `/opt` directory is a symbolic link, create a bind mount for `/opt/microsoft`. 6. Ensure that the daemon has executable permission. + ```bash ls -l /opt/microsoft/mdatp/sbin/wdavdaemon ``` + ```Output -rwxr-xr-x 2 root root 15502160 Mar 3 04:47 /opt/microsoft/mdatp/sbin/wdavdaemon ``` + If the daemon doesn't have executable permissions, make it executable using: + ```bash sudo chmod 0755 /opt/microsoft/mdatp/sbin/wdavdaemon ``` + and retry running step 2. 7. Ensure that the file system containing wdavdaemon isn't mounted with "noexec". @@ -117,24 +131,31 @@ Now try restarting the mdatp service using step 2. Revert the configuration chan ## If mdatp service is running, but EICAR text file detection doesn't work 1. Check the file system type using: + ```bash findmnt -T ``` + Currently supported file systems for on-access activity are listed [here](microsoft-defender-atp-linux.md#system-requirements). Any files outside these file systems won't be scanned. ## Command-line tool “mdatp” isn't working 1. If running the command-line tool `mdatp` gives an error `command not found`, run the following command: + ```bash sudo ln -sf /opt/microsoft/mdatp/sbin/wdavdaemonclient /usr/bin/mdatp ``` + and try again. If none of the above steps help, collect the diagnostic logs: + ```bash sudo mdatp diagnostic create ``` + ```Output Diagnostic file created: ``` + Path to a zip file that contains the logs will be displayed as an output. Reach out to our customer support with these logs.