Red Hat Installation Instructions

How to install the client on Red Hat.

Before installing the client on Red Hat Enterprise Linux™ 7, 8 or 9, ensure that you have disabled the SELinux process or, if you want to keep SELinux enabled, that the following settings are configured:

selinux = enforcing, policy = targeted.

Then, ensure that you have:
  • Installed the Athena library (libXaw package) that is used by the user interface component of the client.
  • Installed the initscripts package before installing the client on Red Hat Enterprise Linux™ 9.
Note: For customers planning to implement fapolicyd in their Red Hat Enterprise Linux™ environments, the BigFix Client is supported on Red Hat Enterprise Linux™ 8 and 9 with fapolicyd enabled and operating in enforcing mode. Certification has been performed using fapolicyd-1.3.2 with a "deny all permit by exception" policy in compliance with Red Hat Enterprise Security Technical Implementation Guide. Although the BigFix client is installed via an RPM package and fapolicyd trusts files in the RPM database, additional configuration of fapolicyd is required to ensure the full functionality of the BigFix Client. See Configuring fapolicyd to allow BigFix Client operations.

To install the client perform the following steps:

  1. Download the corresponding BigFix client RPM file to the Red Hat computer.
  2. Install the RPM by running the command 
    rpm -ivh client_RPM_path
    Note:

    Starting from BigFix Version 9.5.9, if you are installing the signed packages and you have not imported the public key for that signature, you receive the following warning: 

    BESAgent-9.5.9.xx-rhe6.x86_64.rpm: Header V4 RSA/SHA256 
Signature, key ID 3e83b424: NOKEY
  3. Copy your actionsite masthead to the client computer (the masthead contains configuration, license, and security information). The action site masthead (actionsite.afxm) can be found in your BES Installation folders (by default they are placed under C:\Program Files (x86)\BigFix Enterprise\BES Installers\Client on Windows™ and /var/opt/BESInstallers/Client/ on Linux™). If the masthead is not named actionsite.afxm, rename it to actionsite.afxm and place it on the computer at the following location: /etc/opt/BESClient/actionsite.afxm.
    Note: The directory /etc/opt/BESClient/ is not automatically created by the installer. If it does not exist, create it manually.
    The masthead file for each BigFix Server can be downloaded at http://servername:port/masthead/masthead.afxm (example: http://bes.BigFix.com:52311/masthead/masthead.afxm).
  4. Start the BigFix client by running the command: 
    systemctl start besclient
    Up to BigFix Version 11.0.1, for backward compatibility reasons, you can also run the command:
    /etc/init.d/besclient start
    Note: When upgrading to BigFix Version 11.0.2 or later, the /etc/init.d/besclient file, if present, is removed by the upgrade process and the /etc/init.d/besclient start|stop|status|restart commands are no longer available.
Note: On Red Hat Enterprise Linux™ 9, the user interface component of the client is displayed only if you log in choosing GNOME on Xorg.

Signed Client Red Hat RPM packages

Starting from BigFix Version 9.5.9, the Red Hat RPM packages are signed with a PGP key.

Starting from BigFix Version 10.0.8, the signature of the Red Hat RPM package for BigFix Agent contains the SHA256 digest and header, thus you can install the BigFix Agent on Red Hat systems with FIPS mode enabled.

The RPM packages available for download are stored, divided by product version and platform, in the following repository: http://support.bigfix.com/bes/release/.

Run the following command to check if the package file is signed:
rpm -qpi <package>.rpm
In the command output the content of the Signature field shows if the package is signed or not:
  • The package is signed if the Signature field is not empty.
  • The package is not signed if the Signature field does not contain any value.
This is a sample output that you can get if the package is signed:
 Name : BESAgent
Version     : 10.0.0.133
Release     : rhe6
Architecture: x86_64
Install Date: (not installed)
Group       : Applications/Security
Size        : 54525522
License     : (c) Copyright HCL Technologies Limited 2001-2020 ALL RIGHTS RESERV                                          ED
Signature   : RSA/SHA256, Sun 29 Mar 2020 11:01:24 PM CEST, Key ID f103a7e216055                                          553
Source RPM  : BESAgent-10.0.0.133-rhe6.src.rpm
Build Date  : Sun 29 Mar 2020 08:52:46 PM CEST
Build Host  : platbuild-rhel-6-x86-64-2.platform.bes.prod.hclpnp.com
Relocations : (not relocatable)
Packager    : HCL Technologies Limited
Vendor      : HCL Technologies Limited
URL         : http://www.bigfix.com/
Summary     : BigFix Agent
Description :
BigFix Agent for Linux.

If the package is signed, you can download and import the public key for that signature by running the BES Support Fixlet named Import BigFix public GPG key for RedHat RPMs.

If you download the key, then import it into your local machine keystore by using the command: 
rpm --import <keyfile>
where the key file can be a URL or a local file.

The BigFix public key available for download is stored in the following repository: http://support.bigfix.com/bes/release/

At this point, you can proceed to install the RPM package on the client system by running the command:
'rpm -i <package name>'
or an equivalent command.

If you did not import the public key, during the client installation you might see a warning message saying that the signature cannot be verified. This message does not prevent your RPM package from being installed successfully on the client system.