Linux Agent installation
There are several ways to install the ThreatLocker Agent onto your Linux OS. ThreatLocker recommends using the Stub Installer for your installation.
Stub installer
To install the ThreatLocker Agent using the Stub Installer, please refer to the following steps:
-
Select the ‘Install Computer’ button from anywhere in the portal. This is located in the top right corner of every page.
There is also an ‘Install Computer’ button located in the top left corner of the ‘Devices’ page.
-
Once selected, this will open a popout window titled ‘Download Installer’.
-
Keep ‘Manual Deployment’ selected as your deployment method, then select your Computer Group using the dropdown menu at the bottom of the page.
-
Now that your Computer Group is selected, choose the ‘Stub Installer’ button from the list of available installers.
-
Download the Linux Stub Installer to the machine you are deploying the agent on.
-
Open the Linux Terminal.
-
For correct error handling you need to install curl on your Linux system.
-
Enter the following command into the Terminal to give your Stub Installer permissions to run as a script:
sudo chmod +x ./(Stub Installer Name) - Enter the following command to run the Stub Installer:
sudo ./(updated stub installer name) -
Wait for the installation to be completed.
The following is a screenshot displaying each step as it appears in the terminal:
Manual installation
For Manual Installation on a RHEL based machine, you can run the following command:
sudo dnf install ./1.4.0-583_rhel_8.x86_64.rpm ./threatlocker_1.4.0-583_modules.rpm (changing version number depending on package installing)
Run the following command for Ubuntu based machines:
sudo apt install ./1.4.0-583_ubuntu_24_4.x86_64.deb ./threatlocker_1.4.0-583_modules.deb (changing version number depending on package installing)
Uninstalling the ThreatLocker Linux Agent
To uninstall the ThreatLocker agent, you must first disable Tamper Protection. For questions regarding disabling Tamper Protection, please refer to the following article:
After Tamper Protection has been disabled, run the following command that corresponds with the distro you are using:
Sudo <dnf|yum|apt> remove -y threatlocker