Trellix Agent is unable to listen for wake-up calls on ports lower than 1024

Technical Articles ID: KB86939
Last Modified: 2023-09-01 04:48:36 Etc/GMT

Environment

Trellix Agent (TA) 5.x
Non-Windows supported operating systems

For environment information, see KB51573 - Supported platforms for Trellix Agent 5.x.

Problem

If the agent wake-up call port is lower than 1024, agents on non-Windows systems fail to receive wake-up calls.

The macmnsvc.log file records errors similar to the one below, when the agent starts:

http_server.Debug: Http server starting
http_server.Debug: Http Server listening on port <591>
http_server.Warning: Error starting http_server - libuv err: ('permission denied' EACCES)

Cause

In TA 5.x, the non-Windows agent runs some processes as a non-root user. Previous versions of the agent ran everything as root.

The range of ports up to 1024 are considered privileged ports. On UNIX or Linux systems, only root can open a privileged port for listening.

Solution

This behavior is expected with TA 5.x. In non-Windows environments running TA 5.x, you must choose a non-privileged port for the agent wake-up call port that's higher than 1024.

Workaround

Agent 5.0.5 and later include a new installer option that installs the agent in a root mode. The option allows all processes to run as root. This action allows the agent to listen on ports below 1024.

To install the agent in root mode, use the -r switch when installing the agent: install.sh -i -r

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Trellix Agent is unable to listen for wake-up calls on ports lower than 1024

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Trellix Agent is unable to listen for wake-up calls on ports lower than 1024

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title