Skip to content

Commit c90fa94

Browse files
denisebmsftdenisebmsft
committed
Update linux-install-with-ansible.md
1 parent 72114b2 commit c90fa94

File tree

1 file changed

+170
-171
lines changed

1 file changed

+170
-171
lines changed

‎defender-endpoint/linux-install-with-ansible.md‎

Lines changed: 170 additions & 171 deletions
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ ansible-playbook -i /etc/ansible/hosts /etc/ansible/playbooks/install_mdatp.yml
223223
224224
### How to uninstall Microsoft Defender for Endpoint on Linux Servers
225225
226-
Create uninstallation YAML file (for example: /etc/ansible/playbooks/uninstall_mdatp.yml) which uses mde_installer.sh. You can also download the file directly from [GitHub](/defender-endpoint/linux-support-events)
226+
First, create an uninstallation YAML file (for example: /etc/ansible/playbooks/uninstall_mdatp.yml) which uses `mde_installer.sh`. You can also download the file directly from [GitHub](/defender-endpoint/linux-support-events)
227227
228228
```bash
229229
@@ -261,188 +261,191 @@ Follow the steps in this section after downloading the onboarding package and me
261261
262262
Create a subtask or role files that contribute to a playbook or task.
263263
264-
- Create the onboarding task, `onboarding_setup.yml`:
264+
1. Create the onboarding task, `onboarding_setup.yml`:
265265
266-
```bash
267-
- name: Create MDATP directories
268-
file:
269-
path: /etc/opt/microsoft/mdatp/
270-
recurse: true
271-
state: directory
272-
mode: 0755
273-
owner: root
274-
group: root
275-
276-
- name: Register mdatp_onboard.json
277-
stat:
278-
path: /etc/opt/microsoft/mdatp/mdatp_onboard.json
279-
register: mdatp_onboard
280-
281-
- name: Extract WindowsDefenderATPOnboardingPackage.zip into /etc/opt/microsoft/mdatp
282-
unarchive:
283-
src: WindowsDefenderATPOnboardingPackage.zip
284-
dest: /etc/opt/microsoft/mdatp
285-
mode: 0600
286-
owner: root
287-
group: root
288-
when: not mdatp_onboard.stat.exists
289-
```
266+
```bash
267+
- name: Create MDATP directories
268+
file:
269+
path: /etc/opt/microsoft/mdatp/
270+
recurse: true
271+
state: directory
272+
mode: 0755
273+
owner: root
274+
group: root
275+
276+
- name: Register mdatp_onboard.json
277+
stat:
278+
path: /etc/opt/microsoft/mdatp/mdatp_onboard.json
279+
register: mdatp_onboard
280+
281+
- name: Extract WindowsDefenderATPOnboardingPackage.zip into /etc/opt/microsoft/mdatp
282+
unarchive:
283+
src: WindowsDefenderATPOnboardingPackage.zip
284+
dest: /etc/opt/microsoft/mdatp
285+
mode: 0600
286+
owner: root
287+
group: root
288+
when: not mdatp_onboard.stat.exists
289+
```
290+
291+
2. Add the Defender for Endpoint repository and the key, `add_apt_repo.yml`. Defender for Endpoint on Linux can be deployed from one of the following channels:
292+
293+
- *insiders-fast*, denoted as `[channel]`
294+
*insiders-slow*, denoted as `[channel]`
295+
- *prod*, denoted as `[channel]` using the version name (see [Linux Software Repository for Microsoft Products](/linux/packages))
296+
297+
Each channel corresponds to a Linux software repository.
290298
291-
- Add the Defender for Endpoint repository and key, `add_apt_repo.yml`:
292-
293-
Defender for Endpoint on Linux can be deployed from one of the following channels:
294-
- *insiders-fast*, denoted as `[channel]`
295-
- *insiders-slow*, denoted as `[channel]`
296-
- *prod*, denoted as `[channel]` using the version name (see [Linux Software Repository for Microsoft Products](/linux/packages))
297-
298-
Each channel corresponds to a Linux software repository.
299-
300-
The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow*, and lastly by *prod*.
301-
302-
303-
In order to preview new features and provide early feedback, it's recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
304-
305-
> [!WARNING]
306-
> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
307-
308-
Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/[distro]/`.
309-
310-
In the following commands, replace *[distro]* and *[version]* with the information you've identified.
311-
312-
> [!NOTE]
313-
> In case of Oracle Linux and Amazon Linux 2, replace *[distro]* with "rhel". For Amazon Linux 2, replace *[version]* with "7". For Oracle Linux, replace *[version]* with the version of Oracle Linux.
314-
315-
```bash
316-
- name: Add Microsoft APT key
317-
apt_key:
318-
url: https://packages.microsoft.com/keys/microsoft.asc
319-
state: present
320-
when: ansible_os_family == "Debian"
321-
322-
- name: Add Microsoft apt repository for MDATP
323-
apt_repository:
324-
repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [codename] main
325-
update_cache: yes
326-
state: present
327-
filename: microsoft-[channel]
328-
when: ansible_os_family == "Debian"
329-
330-
- name: Add Microsoft DNF/YUM key
331-
rpm_key:
332-
state: present
333-
key: https://packages.microsoft.com/keys/microsoft.asc
334-
when: ansible_os_family == "RedHat"
335-
336-
- name: Add Microsoft yum repository for MDATP
337-
yum_repository:
338-
name: packages-microsoft-[channel]
339-
description: Microsoft Defender for Endpoint
340-
file: microsoft-[channel]
341-
baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
342-
gpgcheck: yes
343-
enabled: Yes
344-
when: ansible_os_family == "RedHat"
345-
```
346-
347-
- Create the Ansible install and uninstall YAML files.
348-
349-
- For apt-based distributions, use the following YAML file:
350-
351-
```bash
352-
cat install_mdatp.yml
353-
```
354-
```Output
355-
- hosts: servers
356-
tasks:
357-
- name: include onboarding tasks
358-
import_tasks:
359-
file: ../roles/onboarding_setup.yml
360-
- name: add apt repository
361-
import_tasks:
362-
file: ../roles/add_apt_repo.yml
363-
- name: Install MDATP
364-
apt:
365-
name: mdatp
366-
state: latest
367-
update_cache: yes
368-
```
369-
370-
```bash
371-
cat uninstall_mdatp.yml
372-
```
373-
```Output
374-
- hosts: servers
375-
tasks:
376-
- name: Uninstall MDATP
377-
apt:
378-
name: mdatp
379-
state: absent
380-
```
381-
382-
- For dnf-based distributions, use the following YAML file:
383-
384-
```bash
385-
cat install_mdatp_dnf.yml
386-
```
387-
```Output
388-
- hosts: servers
389-
tasks:
390-
- name: include onboarding tasks
391-
import_tasks:
392-
file: ../roles/onboarding_setup.yml
393-
- name: add apt repository
394-
import_tasks:
395-
file: ../roles/add_yum_repo.yml
396-
- name: Install MDATP
397-
dnf:
398-
name: mdatp
399-
state: latest
400-
enablerepo: packages-microsoft-[channel]
401-
```
402-
403-
```bash
404-
cat uninstall_mdatp_dnf.yml
405-
```
406-
```Output
407-
- hosts: servers
408-
tasks:
409-
- name: Uninstall MDATP
410-
dnf:
411-
name: mdatp
412-
state: absent
413-
```
299+
The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insiders-fast* are the first ones to receive updates and new features, followed later by *insiders-slow*, and lastly by *prod*.
300+
301+
In order to preview new features and provide early feedback, it's recommended that you configure some devices in your enterprise to use either *insiders-fast* or *insiders-slow*.
302+
303+
> [!WARNING]
304+
> Switching the channel after the initial installation requires the product to be reinstalled. To switch the product channel: uninstall the existing package, re-configure your device to use the new channel, and follow the steps in this document to install the package from the new location.
305+
306+
3. Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/[distro]/`.
307+
308+
4. In the following commands, replace *[distro]* and *[version]* with the information you've identified.
309+
310+
> [!NOTE]
311+
> In case of Oracle Linux and Amazon Linux 2, replace *[distro]* with "rhel". For Amazon Linux 2, replace *[version]* with "7". For Oracle Linux, replace *[version]* with the version of Oracle Linux.
312+
313+
```bash
314+
- name: Add Microsoft APT key
315+
apt_key:
316+
url: https://packages.microsoft.com/keys/microsoft.asc
317+
state: present
318+
when: ansible_os_family == "Debian"
319+
320+
- name: Add Microsoft apt repository for MDATP
321+
apt_repository:
322+
repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [codename] main
323+
update_cache: yes
324+
state: present
325+
filename: microsoft-[channel]
326+
when: ansible_os_family == "Debian"
327+
328+
- name: Add Microsoft DNF/YUM key
329+
rpm_key:
330+
state: present
331+
key: https://packages.microsoft.com/keys/microsoft.asc
332+
when: ansible_os_family == "RedHat"
333+
334+
- name: Add Microsoft yum repository for MDATP
335+
yum_repository:
336+
name: packages-microsoft-[channel]
337+
description: Microsoft Defender for Endpoint
338+
file: microsoft-[channel]
339+
baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
340+
gpgcheck: yes
341+
enabled: Yes
342+
when: ansible_os_family == "RedHat"
343+
```
344+
345+
5. Create the Ansible install and uninstall YAML files.
346+
347+
- For apt-based distributions, use the following YAML file:
348+
349+
```bash
350+
cat install_mdatp.yml
351+
```
352+
353+
```Output
354+
- hosts: servers
355+
tasks:
356+
- name: include onboarding tasks
357+
import_tasks:
358+
file: ../roles/onboarding_setup.yml
359+
- name: add apt repository
360+
import_tasks:
361+
file: ../roles/add_apt_repo.yml
362+
- name: Install MDATP
363+
apt:
364+
name: mdatp
365+
state: latest
366+
update_cache: yes
367+
```
368+
369+
```bash
370+
cat uninstall_mdatp.yml
371+
```
372+
373+
```Output
374+
- hosts: servers
375+
tasks:
376+
- name: Uninstall MDATP
377+
apt:
378+
name: mdatp
379+
state: absent
380+
```
381+
382+
- For dnf-based distributions, use the following YAML file:
383+
384+
```bash
385+
cat install_mdatp_dnf.yml
386+
```
387+
388+
```Output
389+
- hosts: servers
390+
tasks:
391+
- name: include onboarding tasks
392+
import_tasks:
393+
file: ../roles/onboarding_setup.yml
394+
- name: add apt repository
395+
import_tasks:
396+
file: ../roles/add_yum_repo.yml
397+
- name: Install MDATP
398+
dnf:
399+
name: mdatp
400+
state: latest
401+
enablerepo: packages-microsoft-[channel]
402+
```
403+
404+
```bash
405+
cat uninstall_mdatp_dnf.yml
406+
```
407+
408+
```Output
409+
- hosts: servers
410+
tasks:
411+
- name: Uninstall MDATP
412+
dnf:
413+
name: mdatp
414+
state: absent
415+
```
414416
415417
## Apply the playbook
416418
417419
In this step, you apply the playbook. Run the tasks files under `/etc/ansible/playbooks/` or relevant directory.
418420
419-
- Installation:
421+
1. Installation:
420422
421-
```bash
422-
ansible-playbook /etc/ansible/playbooks/install_mdatp.yml -i /etc/ansible/hosts
423-
```
423+
```bash
424+
ansible-playbook /etc/ansible/playbooks/install_mdatp.yml -i /etc/ansible/hosts
425+
```
424426
425-
> [!IMPORTANT]
426-
> When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes.
427+
> [!IMPORTANT]
428+
> When the product starts for the first time, it downloads the latest antimalware definitions. Depending on your Internet connection, this can take up to a few minutes.
427429
428-
- Validation/configuration:
430+
2. Validation/configuration:
429431
430-
```bash
431-
ansible -m shell -a 'mdatp connectivity test' all
432-
```
433-
```bash
434-
ansible -m shell -a 'mdatp health' all
435-
```
432+
```bash
433+
ansible -m shell -a 'mdatp connectivity test' all
434+
```
435+
436+
```bash
437+
ansible -m shell -a 'mdatp health' all
438+
```
436439
437-
- Uninstallation:
440+
3. Uninstallation:
438441
439-
```bash
440-
ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts
441-
```
442+
```bash
443+
ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts
444+
```
442445
443446
## Troubleshoot installation issues
444447
445-
For self-troubleshooting, do the following
448+
For self-troubleshooting, follow these steps:
446449
447450
1. For information on how to find the log that's generated automatically when an installation error occurs, see [Log installation issues](linux-resources.md#log-installation-issues).
448451
@@ -470,13 +473,9 @@ When upgrading your operating system to a new major version, you must first unin
470473
## See also
471474
472475
- [Add or remove YUM repositories](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/yum_repository_module.html)
473-
474476
- [Manage packages with the dnf package manager](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf_module.html)
475-
476477
- [Add and remove APT repositories](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_repository_module.html)
477-
478478
- [Manage apt-packages](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html)
479-
480479
- [Missing event issues](/defender-endpoint/linux-support-events)
481480
482481
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

0 commit comments

Comments
 (0)