About the Linux Plugin
The Linux Plugin manages endpoints running Linux operating systems.
The plugin is a component of the Forescout Core Extensions Module, one of several modules (formerly Forescout Platform or CounterAct).
The Linux Plugin manages endpoints running Linux operating systems. It supports properties, actions, and other management functionality for Linux endpoints. This plugin parallels the features of the HPS Inspection Engine, which manages Windows endpoints, and the OS X Plugin, which manages OS X endpoints.
Each Linux Plugin version provides the latest regularly updated version of SecureConnector™ that is native to Linux.
Accessing and Managing Endpoints
Endpoint Module plugins access endpoints to learn detailed information about the endpoint, such as file metadata and operating system information. In addition, the plugins run scripts on endpoints and perform other remediation actions.
- The HPS Inspection Engine interacts with Windows endpoints.
- The Linux Plugin interacts with Linux endpoints.
- The OS X Plugin interacts with OS X endpoints.
When you configure these plugins, you determine the methods used to access and manage endpoints. When these access methods are successful, the endpoint is resolved as "Manageable".
The following methods for accessing endpoints can be deployed together in a single network environment.
Remote Inspection
Remote Inspection uses the SSH communications protocol to query the endpoint, and to run scripts and implement remediation actions on the endpoint.
Agentless
Remote Inspection is agentless - does not install any applications on the endpoint to query it. This makes Remote Inspection useful when administrators or end users do not want to install utilities or other executables on the endpoint.
Specify Remote Inspection settings in the Remote Inspection tab of each plugin during plugin configuration.
The following properties indicate whether Remote Inspection is used to access and manage an endpoint:
- For Windows endpoints (supported by the HPS Inspection Engine):
- Windows Manageable Domain
- Windows Manageable Domain (Current)
- Windows Manageable Local
- For Linux endpoints (supported by the Linux Plugin):
- Linux Manageable (SSH Direct Access)
- For OS X endpoints (supported by the OS X Plugin):
- Macintosh Manageable (SSH Direct Access)
SecureConnector™
SecureConnector is a small-footprint executable that runs on the endpoint. It reports endpoint information back to , and implements Forescout actions on the endpoint. The Start SecureConnector action initiates SecureConnector installation on endpoints.
Agent-Based
The SecureConnector executable file must be installed and maintained on the endpoint. This may not be acceptable in certain network environments, or for some endpoints or users.
SecureConnector can be installed in several ways:
| Windows Endpoints | Linux Endpoints | OS X Endpoints | |
|---|---|---|---|
| SecureConnector installer package provided by: | HPS Inspection Engine | Linux Plugin | OS X Plugin |
| Can install SecureConnector as a dissolvable utility | Y | Y | Y |
| Can install SecureConnector as a permanent application | Y | X | X |
| Can install SecureConnector as a permanent service / system daemon | Y | Y | Y |
The following properties indicate whether SecureConnector is used to access and manage an endpoint:
- For Windows endpoints (supported by the HPS Inspection Engine):
- Windows Manageable SecureConnector
- Windows Manageable SecureConnector (via any interface)
- For Linux endpoints (supported by the Linux Plugin):
- Linux Manageable (SecureConnector)
- For OS X endpoints (supported by the OS X Plugin):
- Macintosh Manageable (SecureConnector)
Networking Requirements
- SecureConnector creates an encrypted tunnel from the endpoint to the Appliance through TCP port 10006. This port must be open on enterprise firewalls to support communication between SecureConnector and the Appliance.
- Remote Inspection requires ICMP (ping) access. The Linux Plugin attempts to ping the host before trying SSH for Remote Inspection. If the ping fails, the plugin does not attempt SSH. See also Manage Linux Endpoints Using Remote Inspection.