Skip to content

install

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

install

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
falcon-linux-install.sh
falcon-linux-install.sh
 
 
falcon-linux-uninstall.sh
falcon-linux-uninstall.sh
 
 

README.md

Falcon Linux Bash Installation Scripts

Bash script to install Falcon Sensor through the Falcon APIs on a Linux endpoint. By default, this script will install, register the sensor, and start the service. If you would like to simply install the sensor without any additional configurations, configure the FALCON_INSTALL_ONLY environment variable. Consult the Environment Variables for each script for more information.

Security Recommendations

Credential handling

Credentials travel on cURL's configuration input rather than the command line, and every request and redirect is restricted to HTTPS. This works with the cURL that RHEL and CentOS 7 ship, and with current cURL.

Table of Contents

Falcon API Permissions

API clients are granted one or more API scopes. Scopes allow access to specific CrowdStrike APIs and describe the actions that an API client can perform.

Ensure the following API scopes are enabled:

  • Sensor Download [read]

    Required for downloading the Falcon Sensor installation package.

  • Installation Tokens [read]

    Required if your environment enforces installation tokens for Falcon Sensor installation.

  • Sensor update policies [read]

    Required when using the FALCON_SENSOR_UPDATE_POLICY_NAME environment variable to specify a sensor update policy.

  • Sensor update policies [write]

    Required if you want the uninstall script to automatically retrieve a maintenance token from the API. Not needed if you directly provide the maintenance token via the FALCON_MAINTENANCE_TOKEN environment variable. Maintenance tokens are required to uninstall sensors that have uninstall protection enabled.

  • Hosts [write]

    Required when using the FALCON_REMOVE_HOST=true environment variable with the uninstall script.

    ⚠️ It is recommended to use Host Retention Policies in the Falcon console instead.

Configuration

Setting up Authentication

Using Client ID and Client Secret

Export the required environment variables:

export FALCON_CLIENT_ID="XXXXXXX"
export FALCON_CLIENT_SECRET="YYYYYYYYY"

Auto-Discovery of Falcon Cloud Region

Important

Auto-discovery is only available for [us-1, us-2, us-3, eu-1] regions.

The scripts support auto-discovery of the Falcon cloud region. If the FALCON_CLOUD environment variable is not set, the script will attempt to auto-discover it. If you want to set the cloud region manually, or if your region does not support auto-discovery, you can set the FALCON_CLOUD environment variable:

export FALCON_CLOUD="us-gov-1"

Using an Access Token

You can also specify a Falcon access token if doing a batch install across multiple machines to prevent the need to call the token endpoint multiple times. If using an access token to authenticate, you MUST also provide FALCON_CLOUD:

export FALCON_ACCESS_TOKEN="XXXXXXXX"
export FALCON_CLOUD="us-1"

Note

If you need to retrieve an access token, run the script with the GET_ACCESS_TOKEN environment variable set to true. The Falcon sensor will NOT be installed while this variable is set.

export FALCON_CLIENT_ID="XXXXXXX"
export FALCON_CLIENT_SECRET="YYYYYYYYY"
export GET_ACCESS_TOKEN="true"

The script will output the access token to the console.

Using AWS SSM

The installer is AWS SSM aware, if FALCON_CLIENT_ID and FALCON_CLIENT_SECRET are not provided AND the script is running on an AWS instance, the script will try to get API credentials from the SSM store of the region.

Install Script

Usage: falcon-linux-install.sh [-h|--help|--debug]

Installs and configures the CrowdStrike Falcon Sensor for Linux.
Version: 1.14.0

This script recognizes the following environmental variables:

Authentication:
    - FALCON_CLIENT_ID                  (default: unset)
        Your CrowdStrike Falcon API client ID.

    - FALCON_CLIENT_SECRET              (default: unset)
        Your CrowdStrike Falcon API client secret.

    - FALCON_ACCESS_TOKEN               (default: unset)
        Your CrowdStrike Falcon API access token.
        If used, FALCON_CLOUD must also be set.

    - FALCON_CLOUD                      (default: unset)
        The cloud region where your CrowdStrike Falcon instance is hosted.
        Required if using FALCON_ACCESS_TOKEN.
        Accepted values are ['us-1', 'us-2', 'us-3', 'eu-1', 'us-gov-1', 'us-gov-2'].

Other Options
    - FALCON_CID                        (default: auto)
        The customer ID that should be associated with the sensor.
        By default, the CID is automatically determined by your authentication credentials.

    - FALCON_SENSOR_VERSION_DECREMENT   (default: 0 [latest])
        The number of versions prior to the latest release to install.
        For example, 1 would install version N-1.

    - FALCON_PROVISIONING_TOKEN         (default: unset)
        The provisioning token to use for installing the sensor.
        If the provisioning token is unset, the script will attempt to retrieve it from
        the API using your authentication credentials and token requirements.

    - FALCON_SENSOR_UPDATE_POLICY_NAME  (default: unset)
        The name of the sensor update policy to use for installing the sensor.

    - FALCON_TAGS                       (default: unset)
        A comma seperated list of tags for sensor grouping.

    - FALCON_APD                        (default: unset)
        Configures if the proxy should be enabled or disabled.

    - FALCON_APH                        (default: unset)
        The proxy host for the sensor to use when communicating with CrowdStrike.

    - FALCON_APP                        (default: unset)
        The proxy port for the sensor to use when communicating with CrowdStrike.

    - FALCON_BILLING                    (default: default)
        To configure the sensor billing type.
        Accepted values are [default|metered].

    - FALCON_BACKEND                    (default: auto)
        For sensor backend.
        Accepted values are values: [auto|bpf|kernel].

    - FALCON_SENSOR_CLOUD               (default: unset)
        To pin the cloud region for unified sensor installations.
        This allows specifying the cloud region for unified sensors at installation time.
        Accepted values are [us-1|us-2|us-3|eu-1|us-gov-1|us-gov-2].

    - FALCON_UNINSTALL                  (default: false)
        To uninstall the falcon sensor.
        **LEGACY** Please use the falcon-linux-uninstall.sh script instead.

    - FALCON_INSTALL_ONLY               (default: false)
        To install the falcon sensor without registering it with CrowdStrike.

    - FALCON_DOWNLOAD_ONLY              (default: false)
        To download the falcon sensor without installing it.

    - FALCON_DOWNLOAD_PATH              (default: $PWD)
        The path to download the falcon sensor to.

    - ALLOW_LEGACY_CURL                 (default: false)
        Deprecated. Accepted and ignored; no longer needed.

    - GET_ACCESS_TOKEN                  (default: false)
        Prints an access token and exits.
        Requires FALCON_CLIENT_ID and FALCON_CLIENT_SECRET.
        Accepted values are ['true', 'false'].

    - PREP_GOLDEN_IMAGE                 (default: false)
        To prepare the sensor to be used in a golden image.
        Accepted values are ['true', 'false'].

    - USER_AGENT                        (default: unset)
        User agent string to append to the User-Agent header when making
        requests to the CrowdStrike API.

    - FALCON_DEBUG                      (default: unset)
        Print redacted progress markers to stderr: step name, HTTP status,
        cloud/region and curl exit code. Values are dropped unless the key is
        on a fixed allow-list, so secrets cannot appear. Do not use bash -x
        for support; it prints credentials.
        Accepted values are ['1', 'true'].

This script recognizes the following arguments:
    -h, --help
        Print this help message and exit.
    --debug
        Same as FALCON_DEBUG=1.

Usage

To download and run the script directly:

export FALCON_CLIENT_ID="XXXXXXX"
export FALCON_CLIENT_SECRET="YYYYYYYYY"
curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-install.sh | bash

Alternatively, download the script and run it locally:

export FALCON_CLIENT_ID="XXXXXXX"
export FALCON_CLIENT_SECRET="YYYYYYYYY"
curl -O https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-install.sh
bash falcon-linux-install.sh

Or pass the environment variables directly to the script:

FALCON_CLIENT_ID="XXXXXXX" FALCON_CLIENT_SECRET="YYYYYYYYY" bash falcon-linux-install.sh

Examples

Install the latest Falcon Sensor with the default settings

export FALCON_CLIENT_ID="XXXXXXX"
export FALCON_CLIENT_SECRET="YYYYYYYYY"
curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-install.sh | bash

Install the Falcon Sensor with the previous version (n-1)

export FALCON_CLIENT_ID="XXXXXXX"
export FALCON_CLIENT_SECRET="YYYYYYYYY"
export FALCON_SENSOR_VERSION_DECREMENT=1
curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-install.sh | bash

Create a Golden Image

export FALCON_CLIENT_ID="XXXXXXX"
export FALCON_CLIENT_SECRET="YYYYYYYYY"
export PREP_GOLDEN_IMAGE="true"
curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-install.sh | bash

Uninstall Script

Usage: falcon-linux-uninstall.sh [-h|--help|--debug]

Uninstalls the CrowdStrike Falcon Sensor from Linux operating systems.
Version: 1.14.0

This script recognizes the following environmental variables:

Authentication:
    - FALCON_CLIENT_ID                  (default: unset)
        Your CrowdStrike Falcon API client ID.

    - FALCON_CLIENT_SECRET              (default: unset)
        Your CrowdStrike Falcon API client secret.

    - FALCON_ACCESS_TOKEN               (default: unset)
        Your CrowdStrike Falcon API access token.
        If used, FALCON_CLOUD must also be set.

    - FALCON_CLOUD                      (default: unset)
        The cloud region where your CrowdStrike Falcon instance is hosted.
        Required if using FALCON_ACCESS_TOKEN.
        Accepted values are ['us-1', 'us-2', 'us-3', 'eu-1', 'us-gov-1', 'us-gov-2'].

Other Options:
    - FALCON_MAINTENANCE_TOKEN          (default: unset)
        Sensor uninstall maintenance token used to unlock sensor uninstallation.
        If not provided but FALCON_CLIENT_ID and FALCON_CLIENT_SECRET are set,
        the script will try to retrieve the token from the API.

    - FALCON_REMOVE_HOST                (default: unset)
        Determines whether the host should be removed from the Falcon console after uninstalling the sensor.
        Requires API Authentication.
        NOTE: It is recommended to use Host Retention Policies in the Falcon console instead.
        Accepted values are ['true', 'false'].

    - GET_ACCESS_TOKEN                  (default: unset)
        Prints an access token and exits.
        Requires FALCON_CLIENT_ID and FALCON_CLIENT_SECRET.
        Accepted values are ['true', 'false'].

    - FALCON_APH                        (default: unset)
        The proxy host for the sensor to use when communicating with CrowdStrike.

    - FALCON_APP                        (default: unset)
        The proxy port for the sensor to use when communicating with CrowdStrike.

    - USER_AGENT                        (default: unset)
        User agent string to append to the User-Agent header when making
        requests to the CrowdStrike API.

    - FALCON_DEBUG                      (default: unset)
        Print redacted progress markers to stderr: step name, HTTP status,
        cloud/region and curl exit code. Values are dropped unless the key is
        on a fixed allow-list, so secrets cannot appear. Do not use bash -x
        for support; it prints credentials.
        Accepted values are ['1', 'true'].

This script recognizes the following arguments:
    -h, --help
        Print this help message and exit.
    --debug
        Same as FALCON_DEBUG=1.

Usage

To download and run the script directly

curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-uninstall.sh | bash

Alternatively, download the script and run it locally

curl -O https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-uninstall.sh
bash falcon-linux-uninstall.sh

Examples

Uninstall the Falcon Sensor

curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-uninstall.sh | bash

Troubleshooting

Use the redacted debug mode. It prints, to stderr: the detected OS, architecture, kernel and package manager; the exact sensor query filter and how many installers matched; which installer was selected, its size and SHA-256 check; the API route, HTTP status and curl exit code for every call; and the installed sensor version and AID. Values are dropped unless the key is on a fixed allow-list, so credentials cannot appear in the output you send to support.

FALCON_DEBUG=1 ./falcon-linux-install.sh

Sample output from a real install (values from a live run, credentials never appear):

FALCON_DEBUG: start version=1.14.0 cloud=us-2 client_id_set=yes access_token_set=no member_cid_set=no proxy_set=no
FALCON_DEBUG: start step=environment os=Ubuntu os_version=22 os_arch=x86_64 kernel=6.8.0-1066-gcp run_as=root pkg_manager=apt policy_name_set=no decrement=0
FALCON_DEBUG: oauth2_token step=response http_status=201 cloud=us-2
FALCON_DEBUG: cs_sensor_download step=query filter=os:"Ubuntu"+os_version:"*22*"+architectures:"x86_64" sort=version|desc decrement=0
FALCON_DEBUG: curl_command path=/sensors/combined/installers/v3 http_status=200 curl_exit=0
FALCON_DEBUG: cs_sensor_download step=matched count=23
FALCON_DEBUG: cs_sensor_download step=selected index=1 file_type=deb sha=455353061160
FALCON_DEBUG: cs_sensor_download step=downloaded installer=/tmp/tmp.B6yKufQ9Ys/falcon-sensor.deb bytes=71715968
FALCON_DEBUG: cs_sensor_download step=verified sha_verify=ok
FALCON_DEBUG: cs_sensor_register step=configure cid_source=api provisioning_token_set=no tags_count=0 apd=unset proxy_set=no billing=unset backend=unset sensor_cloud=unset
FALCON_DEBUG: main step=installed version=8.10.19402.0 aid=none

aid=none right after an install is normal: registration completes asynchronously once the sensor reaches the cloud. Markers go to stderr, and a progress line can share a line with one, so match them with grep FALCON_DEBUG rather than grep '^FALCON_DEBUG'.

or pass the flag:

./falcon-linux-install.sh --debug

or over a pipe:

curl -L https://raw.githubusercontent.com/crowdstrike/falcon-scripts/v1.14.0/bash/install/falcon-linux-install.sh | FALCON_DEBUG=1 bash

Do not use bash -x for support. It prints every expanded command, including client_secret, access tokens, provisioning tokens and Authorization headers. These scripts turn tracing off at startup and warn when they do, but a trace enabled before that point can still expose credentials.