Installing an RCE on a Linux system - User Guide - LiveWire

Starting in LiveWire 26.2.0, you can now install a Remote Capture Engine on Linux systems. The Remote Capture Engine software is supported on all Linux operating systems and is delivered in the form of a docker container.

Important: HTTPS traffic between the control point and the RCE must be allowed, so any firewall rules will need to be adjusted. If you are experiencing issues with the connection, refer to Troubleshooting.

Before you begin

Before you begin, ensure that you have the following:

Downloaded the RCE tarball from MyPeek so that it's available on the Linux host machine. The tarball image will have a file name similar to: livepca-x.x.x-docker.tar.gz
You have the Docker CLI installed on your Linux system.
You have the LiveWire Authentication Group Secret generated and available. This is required for the RCE installation. For more information, refer to Configuring the LiveWire Authentication Group Secret on the LiveWire control point.

To install an RCE using the command line

From the Linux host machine, open a terminal session.
Load the docker image using the following command:
```
docker load -i <path_to_rce_tarball>/livepca-x.x.x-docker.tar.gz
```
The docker load command outputs the image ID in the form of a SHA256 string.
Tag the image with the SHA256 string using the following command:
```
docker tag <sha256_string> omni:latest
```
Run the following docker command to start the docker image:
```
sudo docker run -d --restart always --cap-add=NET_RAW --cap_add=NET_ADMIN --prividelge \
--network host \
-e LIVEWIRE_RCE='true' \
-e LIVEWIRE_LICENSE_SERVER='10.10.10.10' \
-e LIVEWIRE_GROUP_ENGINE_HOST='10.10.10.10' \
-e LIVEWIRE_GROUP_SECRET='groupsecret' \
-e LIVEWIRE_GROUP_ENGINE_GROUP='groupname' \
-e LIVEWIRE_GROUP_ENGINE_NAME='rcename' \
-v /etc/passwd:/etc/passwd \
-v /etc/shadow:/etc/shadow \
-v ./rce/config/:/etc/omni/ \
-v ./rce/log/:/var/log/ \
-v ./rce/data/:/var/lib/omni/data/ \
--name omni-rce \
omni:latest
```
Where the environment variables are as follows:
- -e LIVEWIRE_RCE: Indicates whether the container should be installed as an RCE. An RCE license is required to operate as an RCE.
- -e LIVEWIRE_LICENSE_SERVER: The IP address of the license server where the RCE license is installed. The RCE automatically connects to the license server when you start to retrieve a license.
- -e LIVEWIRE_GROUP_ENGINE_HOST: The IP address of the controlling LiveWire that the RCE will connect to.
- -e LIVEWIRE_GROUP_SECRET: The LiveWire Authentication Group Secret that was generated. For more information, refer to Configuring the LiveWire Authentication Group Secret on the LiveWire control point.
- -e LIVEWIRE_GROUP_ENGINE_GROUP: (Optional) The group that the RCE will be located under in the LiveWire engines view UI.
- -e LIVEWIRE_GROUP_ENGINE_NAME: (Optional) The name that the RCE will be referred to in the LiveWire engines view UI.
The volume variables are as follows:
- -v /etc/passwd:/etc/passwd and -v /etc/shadow:/etc/shadow enable you to use the host Linux machine's credentials.
- -v ./rce/config/:/etc/omni prevents the RCE from appearing multiple times in the LiveWire engines view after restarting. BlueCat recommends always mapping this volume upon running the container.
- -v ./rce/log/:/var/log/ and -v ./rce/data/:/var/lib/omni/data/ maps the RCE directories outside of the container.

The Remote Capture Engine installs the software on the Linux host and runs the docker container. Repeat the previous steps for each Linux host that you would like to install RCE on.

Note: Change in behavior

In LiveWire v26.1 and earlier, if the LiveWire RCE connection to the LiveWire control point was not successful, the LiveWire RCE would attempt to connect to the LiveWire control point every 10 minutes. In LiveWire v26.2 and greater, the LiveWire RCE will attempt to connect to the LiveWire control point approximately every 1 minute.

Installing an RCE on a Linux system - User Guide - LiveWire - 26.2.0

LiveWire User Guide