# Installing an explorer

Rumble requires the use of at least one Explorer within your environment to enable network discovery. The explorer should be installed on a system with reliable connectivity to the network you want to discover. For internal networks, Rumble works best when installed on a system with a wired (vs wireless) connection.

For external network discovery, nearly any cloud provider with a reliable connection should do. If the Rumble Explorer is installed in a container or virtualized system, ensure that it has direct access to the network (host networking in Docker, bridged networking in VMware, etc).

## Installation

To install the Rumble Explorer, log in to the Rumble Console and switch to the Organization that should be associated with the explorer. The explorer download link is specific to your active Organization and using the wrong link can result a new explorer being associated with the wrong organization.

Download the correct binary for your system from the explorer download page. For most systems, select the 64-bit (x86_64) architecture. For embedded devices, such as the Raspberry Pi 3+, choose the ARM7 architecture. Windows binaries are signed with a valid Authenticode signature, which should be validated before the executable is launched.

The explorer installation process requires administrative privileges. On Windows, a UAC prompt may be displayed. On Linux and macOS the downloaded binary should be made executable (chmod u+x rumble-explorer.bin) and then executed with root privileges (sudo or from root shell). In either case, the explorer should install itself as a system service and start immediately, displaying a new entry in the explorers page.

## System requirements

### Windows

• Windows Server 2012 R2+ or Windows 10 Build 1604+
• Processor running at 2.0 GHz or faster
• At least 4Gb of memory (1Gb available)
• At least 1Gb of free storage space

Windows Server 2008, Windows Server 2012, Windows 7, and Windows 8 may be able to run the explorer in a pinch, but are not officially supported.

### Linux

• Kernel version 2.6.23 or later
• Processor running at 2.0 GHz or faster
• At least 2Gb of memory (1Gb available)
• At least 1Gb of free storage space

Linux ARM devices with limited processing power and memory, such as the Raspberry Pi, can run the Rumble Explorer, but may have trouble scanning larger networks.

### MacOS

• macOS 10.11 (El Capitan) or newer
• Processor running at 2.0 GHz or faster
• At least 2Gb of memory (1Gb available)
• At least 1Gb of free storage space

macOS systems running Catalina (10.15) or newer need to use the curl download method to avoid issues with the new Notary requirements.

### BSD variants

• Processor running at 2.0 GHz or faster
• At least 2Gb of memory (1Gb available)
• At least 1Gb of free storage space

## Web screenshots

Google Chrome or Chromium should be installed on the Explorer system to enable web screenshots. Please note that “snap”-based Chromium installs (Ubuntu 20.04 and newer) don’t appear to work properly in headless mode and the official Chrome packages should be used instead.

## Network communication

The explorer connects to the console.rumble.run host on TCP port 443 using TLS and two static IPv4 addresses (13.248.161.247, 76.223.34.198). This connection is used for explorer registration, job scheduling, status messages, and submission of completed scan jobs. For completely offline environments, the Rumble Scanner can be used to create scan data files that can be uploaded later via the Inventory Import action. The host console.rumble.run is used for automatic updates of the explorer executable.

Please note that certain web proxies that perform TLS inspection do not handle Websocket communication properly and TLS inspection will need to be disabled for the Rumble Explorer to successfully connect. The most popular product with this problem is the Sophos (previously Cyberoam) security appliance. Websense users may need to add a bypass rule for console.rumble.run.

Proxy support is handled automatically in most cases. On the Windows platform, proxy information is read from the registry keys (used by Chrome, Edge, and IE).

On non-Windows operating systems the proxy can be configured by setting the HTTPS_PROXY environment variable. The value of the HTTPS_PROXY environment variable should be a hostname and port (proxy:8080) or just a hostname (proxy). Environment variables are read from the file /opt/rumble/bin/.env on these platforms and apply to all installed explorers.

## Removing an explorer

The easiest way to remove an explorer is to use the Explorers page Manage menu and select the Uninstall Explorer option. This will remove the service and terminate the current explorer process. If you would like to remove the explorer without using the Rumble Console, there are a couple options.

On the Windows platform, each explorer will be listed in Programs and Features (as the Rumble Agent), and can be uninstalled like any other application.

On all platforms, including Windows, the explorer can uninstall itself if run with the uninstall argument from a root or Administrator shell:

Windows

c:\Program Files\Rumble\rumble-explorer-[oid].exe uninstall


Other Platforms

/opt/rumble/rumble-explorer-[oid] uninstall


## Configuration

The explorer can be configured by setting variables in a .env file located in the same directory as the executable. On Windows this file should be created in C:\Program Files\Rumble\.env, while other platforms should use /opt/rumble/bin/.env. The format of this file is VAR=VAL with one variable per line.

## Log management

The explorer logs to a file and to standard output by default. On Windows the default log file location is the installation directory (C:\Program Files\Rumble) while other platforms log to the files /var/log/rumble.log and /var/log/rumble.err. The default configuration limits log files to 100Mb, creates three backups, and expires logs after 90 days. These defaults can be be changed by setting the following values in the .env file:

• The RUMBLE_AGENT_LOG_MAX_SIZE setting controls the maximum log size in megabytes. The default is 100.
• The RUMBLE_AGENT_LOG_MAX_BACKUPS setting controls the number of backup files created by log rotation. The default is 3.
• The RUMBLE_AGENT_LOG_MAX_AGE setting controls the maximum age in days, this applies to all files, including backups. The default is 90.
• The RUMBLE_AGENT_LOG_COMPRESS setting determines whether to gzip compress the backups. The default is false.
• The RUMBLE_AGENT_LOG_STDOUT setting determines whether to write logs to standard output (and syslog for systemd/upstart). The default is true.

The explorer must be restarted for these settings to take effect.

## Restart an explorer

The quickest way is to force an update from the cloud console, otherwise you can find the service name and restart it by hand.

On Linux systems using systemd, first obtain the name of the explorer service:

$systemctl | grep rumble-explorer  Then restart the service using this name: $ systemctl restart rumble-explorer-[uuid-value]


A kill -9 of the explorer pid should cause a restart as well.

## Certificate Authorities (CAs)

The Rumble Explorer uses the system-installed certificate authorities to validate TLS connections in addition to an internal CA certificate bundle (derived from Debian 10). By default, both the system certificate roots, and the bundled roots are considered for all secure TLS connections. This behavior can be controlled via environment variables (set in the .env file or at the system level):

• The RUMBLE_TLS_IGNORE_SYSTEM_ROOTCA setting can be set to true to ignore the system CA roots.
• The RUMBLE_TLS_IGNORE_EMBEDDED_ROOTCA setting can be set to true to ignore the bundled CA roots.

## Manual mode

If a supported system service manager, such as systemd or upstart, is not detected, the Rumble Explorer will switch to manual mode, running in the foreground, and replacing and re-executing its own binary as new updates become available. For temporary explorer installations or to run the explorer in a container environment, the argument “manual” can be specified:

$sudo ./rumble-explorer.bin manual ## Storage locations The Rumble Explorer installs into %PROGRAMFILES%\Rumble on Windows and /opt/rumble on all other platforms. Temporary files are stored in the default operating system locations. These locations can be overridden using the .env file. Note that the explorer service needs to be restarted (or force updated) for these changes to take effect. On Windows, the temporary file location is chosen from the first non-empty environment value of TMP, TEMP, or USERPROFILE, falling back to the Windows directory. To override this location, set an entry in .env like the following: TMP=D:\Storage\Rumble On all other platforms, the temporary file location is chosen based on the value of TMPDIR, falling back to /tmp otherwise. To override this location, set an entry in .env like the following: TMPDIR=/home/storage/rumble Any scans that fail to upload are stored in the Rumble Explorer installation directory and can be imported into the platform manually or using the Rumble Scanner’s --import and --upload options. ## Container installations The Rumble Explorer can run in standard container environments, but may require additional configuration. To run as a standalone executable, the explorer can be run with the argument manual. For non-persistent containers an explorer identifier needs to be persisted through an environment variable. This can be done by setting the variable RUMBLE_AGENT_HOST_ID to a 32-character hexadecimal string. This identifier is used to uniquely identify the explorer within an organization. To generate a suitable identifier, the openssl tool may be used: $ openssl rand -hex 16
01b0283809b24511929d0b062bd36109


Here is a sample Containerfile you can edit and use:

#
# Sample Containerfile for running the Rumble Explorer in a container, with screenshot support.
#
FROM debian:stable-slim

WORKDIR /opt/rumble

RUN apt update && \
apt install -y chromium   # add wireless-tools if you want WiFi scanning

# the first URL box to copy it to the clipboard.
#

# This ID is used to track the explorer even if the container is rebuilt.
# Set it to a unique 32 character hex ID. You can generate one via:
#
# $openssl rand -hex 16 # ENV RUMBLE_AGENT_HOST_ID=112233445566778899aabbccddeeff # If you need to set environment variables to change the explorer behavior, # you can do so via the ENV directive. Example: # # ENV RUMBLE_AGENT_LOG_DEBUG=true ADD${AGENT_URL} rumble-explorer.bin

RUN chmod +x rumble-explorer.bin

# For full functionality the Rumble scanner needs to send and receive raw
# packets, which requires elevated privileges.
USER root

# The argument manual tells Rumble not to look for SystemD or upstart.
ENTRYPOINT [ "/opt/rumble/rumble-explorer.bin", "manual"]


This containerfile works with podman as well as Docker. Note that because of the requirement for root privileges, you should start the container as root.

## Automated installations

The explorer will automatically install when executed if root or administrative privileges are available.

On Linux and BSD systems, automatic installation depends on the presence of a supported init service like systemd or upstart. If no supported init service is found, the explorer will instead run in manual mode, automatically overwriting and re-executing itself with each update. To automatically deploy an explorer on systems without a supported init service, the explorer should be executed in the background and with the nohup wrapper.

On Windows systems, the explorer will automatically install when run interactively or when the updater parameter is passed to the binary. For environments where MSIs are required, the Explorer MSI wrapper can be used to deploy an explorer from the Rumble Console or a local mirror.

|