Skip to main content

Linux Endpoints

Most Linux servers: add them through the SSH gateway (no agent). See Gateways and Add an Endpoint.

Alternative: onboard with the endpoint agent​

Use the agent only for machines that are not behind a gateway. To onboard and manage privileged access for Linux endpoints with the agent, you must do the following:

  1. Install the Linux endpoint agent
  2. Configure for 1FA or 2FA LDAP authentication against your LDAP server (assume that you want to use LDAP).
  3. If you are only managing local users, grant access to them with a policy - see Policies

Getting the agent and token​

endpoints

  1. In the admin console, open Switch product → PAM and go to Targets → Endpoints.

  2. Click Add endpoint and select your OS. The screen shows the newly generated agent token.

  3. Download the agent binary from agent-binaries (Endpoint Agent v2.0, the latest version).

Installing & Configuring the Endpoint Agent in an Endpoint​

  1. Copy the agent binary to the endpoint. The agent token is shown under Targets → Endpoints → Add endpoint.

  2. The configuration can be found under app.env, copy the app.env file to /home path.

    App.env file can be found within your console.

    Refer to this sample app.env file:

    KEY=KL01 MACHINE_KEY=MACKL01 AGENT_TOKEN=xxxx TENANT_ID=1 USER_ID=1 BUCKET_NAME=guac-session RECORDING_DIR=/anchor_dvr/ FILE_NAME=test.guac BUCKET_NAME_GCS=gto-did-app-dev STORAGE_AWS_FLAG=true

    AGENT_TOKEN is generated by AuthNull. MACHINE_KEY is a unique, constant identifier for the machine.

  3. Please update the below environment variables inside the app.env file

    AGENT_TOKEN= Agent Token to be used for registering agent (token to be fetched from the Authnull platform when registering)

    TENANT_ID= Domain Id

    USER_ID = User Id of the Daemon (Assuming it as 1)

    AWS/GCP Details can be provided for the storage options

  4. Run the agent by the following command

    ./endpointpamagent

Note: The agent will synchronize the guacd server based on the jobs assigned, and the recordings information will be stored as specified under GCS Bucket as per the config file for jump server.

Interacting with the Endpoint from AuthNull Platform​

Follow the instructions given below to interact with an endpoint using the AuthNull admin console:

  1. Open Switch product → PAM and go to Targets → Endpoints.

  2. Click on the gear icon in the "Options" column to interact with an agent, this will allow to active and deactivate an endpoint, assign users to an endpoint, configure authentication flow of an endpoint and customise credential policy for an onboarded endpoint.

Configuring the agent as per the instructions provide the ability to do the following two use cases.​

  1. Local privileged user management along with 2FA authentication
  2. LDAP 2FA authentication