Deployment script and command reference for the backup agent

Updated

Overview

When you create a deployment policy in the Code42 console, the process generates user-detection scripts and agent install command arguments. This article provides details about the scripts for Windows, Mac, and Linux devices.

Use the correct scripts!
Use the scripts for the agents in your Code42 environment. If you use the wrong script, agent deployment will fail.

This article applies to devices where both the insider risk and backup agents are being deployed. If you are only deploying the insider risk agent, see Deployment script and command reference for the insider risk agent.

Need help?
For assistance, contact your Customer Success Manager (CSM) to engage the Code42 Professional Services team. If you don't know who your CSM is, contact our Technical Support Engineers.

Considerations

This article assumes you understand the introduction to deployment provided by the article Deploy Code42 agents.

  • To use these deployment tools, you need to sign in to your Code42 console as a user with the Security Administrator role. 
  • In the Code42 federal environment, app installations must be deployed with a deployment policy to ensure the use of FIPS encryption in the Code42 agent. Users cannot download the installation package from the Code42 console.

Deployment is a secure process:

  • During installation, device-server communications are encrypted.
  • Devices can use a proxy to reach the Code42 cloud. See the PROXY_URL parameter.
  • Deployment can run silently, with no intervention from users at devices.

About user detection scripts

Code42 relies on usernames having an email format, for instance, firstname.lastname@example.com. A user detection script detects the usernames in another system, such as a directory service, and transforms them to a username format that Code42 can use. When you create a user detection script, you must customize it for the system where you need to detect usernames.

To make it easier to create a user detection script that's right for your situation, we provide example scripts for Windows and Mac systems. You can use these examples as a starting place when creating your own user detection script.

Requirements for multiple agents

Deploying both the insider risk and backup agents to a single device requires:

  • Two code42.deployment.properties files (the deployment policy contains separate properties for each agent type).
  • A single user detection script. Only use the user detection script for the backup agent; it also detects the user for the insider risk agent. If you use the detection script for the insider risk agent, the backup agent will not be able to register.

Windows

 

Mac

 

Linux

Example Ubuntu user detection script

The following script detects which user last logged in using the last -p now command for logins, then appends the domain of the company to make an email address. A single user needs to be logged into the device to pass the user check. This script requires the device is owned and used by a single user. The script does not support multi-user workstations.

#!/bin/sh
#ubuntu_am_username_append_domain_user_detection_script.sh
#for Incydr and Backup Agents
#last updated 2024-04-11
function main () {
    writeLog "---"
    writeLog "-----------------------------------User Detection Run Start-----------------------------------"
    writeLog "---"
    writeLog "Running user detection script: ubuntu_am_username_append_domain_user_detection_script.sh"
    writeLog "Starting user detection...version 2024-04-11"
    writeLog "Date: $(date)"
    local companydomain="domain.com"
    local userent=$(eval getent passwd {$(awk '/^UID_MIN/ {print $2}' /etc/login.defs)..$(awk '/^UID_MAX/ {print $2}' /etc/login.defs)} | cut -d: -f1)
    local userwho=$(whoami)
    local userwholist=$(who)
    local userlastlist=$(last -p now | grep -i "logged in")
    local userlastshort=$(last -p now | grep -i "logged in" | cut -d " " -f 1-1)
    local userlastlong=$(who | grep -m 1 -i $userlastshort | cut -d " " -f 1-1)
    local userhostname=$(hostname)
    #Update all lines to use the variable required for the enviorment: Default is $userlastlong
    writeLog "Hostname found via hostname ($userhostname)"
    writeLog "Username found via getent ($userent)"
    writeLog "Usernames found via userwholist ($userwholist)"
    writeLog "Username found via userwho ($userwho)"
    writeLog "Usernames currently logged in ($userlastlist)"
    #Grabs the first currently logged in user
    writeLog "Username found via lastshort -p now ($userlastshort)"
    writeLog "Username found via lastlong -p now ($userlastlong)"
    #Leave as is if changing variable
    if [[ "$userlastlong" =~ ^(root|admin|reboot|shutdown|local|user1)$ ]] || [[ -z "$userlastlong" ]]; then
        writeLog "Excluded or null username detected ($userlast). Will retry user detection in few minutes, or when servie reboot occurs."
        exit
    elif [[ "$userlastshort" =~ $'\n' ]] || [[ -z "$userlastlist" ]]; then
        writeLog "Mulitple Logged on Users found: $userlastlist. Will retry user detection in few minutes, or when service reboot occurs."
        exit
    else
        writeLog "Username ($userlastlong) passed Excluded Username Check"
        local userlasthome=$(getent passwd | grep -i $userlastlong | cut -d : -f 6)
        writeLog "userlasthome ($userlasthome)"
        local C42_USER_HOME=$userlasthome
        writeLog "Home directory read from dscl ($C42_USER_HOME)"
        userlastlong="$(echo $userlastlong | sed -e 's/[[:space:]]//g' | tr '[:upper:]' '[:lower:]')"
        local C42_USERNAME="$userlastlong@$companydomain"
        writeLog "Username assembled by appending domain ($C42_USERNAME)"
        writeLog "Returning C42_USERNAME=$C42_USERNAME"
        writeLog "Returning C42_USER_HOME=$C42_USER_HOME"
        echo "C42_USERNAME=$C42_USERNAME"
        echo "C42_USER_HOME=$C42_USER_HOME"
    fi
}
SCRIPT_PATH=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
logPath="/usr/local/crashplan/log/preservation_user_detection_result.log"
if [[ "$SCRIPT_PATH" == "/opt/code42-aat" ]]; then
    logPath="/var/opt/code42-aat/logs/incydr_user_detection_result.log"
fi
function writeLog () {
    echo "$(date) - $@" >> $logPath
}
main "$@"

Related topics

Was this article helpful?
0 out of 0 found this helpful

Comments

0 comments

Please sign in to leave a comment.