Overview

Elevated Sessions give a user temporary root access after a technician approves a request. JIT Admin Log In lets a technician sign in to a dedicated local account through an approval in the AutoElevate mobile app or the Admin Portal.

For installation and removal, see Linux Agent Installation (Beta).

What Linux Supports

Linux supports Elevated Sessions and JIT Admin Log In. The features marked No below are unavailable on Linux.

The agent does not intercept individual commands or installers. Users request an Elevated Session for administrator access.

Known limitations

• JIT Admin Log In uses a local account. Domain login is unavailable.
• Polkit requires JavaScript rules support, available from version 0.106. Hosts without that support receive only sudo access.
• If the agent or backend is unavailable, new JIT logins cannot complete.

Elevated Sessions on Linux

Request a session

1. Double-click the AutoElevate tray icon, or run aeagentd in a terminal. The tray opens the same terminal screen.
2. Check that the screen shows Backend: connected.
3. Press r. Enter a reason or press Enter to skip it.

The status changes to awaiting approval. Press w to withdraw the request. Press q to close the screen and leave it pending. The agent withdraws an unanswered request after five minutes when it can contact AutoElevate. During an outage, it keeps the request pending until it can reconcile the result.

Hover over the tray icon to see the status. The icon turns red while an Elevated Session is active.

Approve a request

Open the request in the AutoElevate mobile app or under Elevation Requests in the Admin Portal. Check the computer, user, and reason. Choose a duration and approve the request.

The available durations are 1, 2, 3, 4, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55, and 60 minutes. The technician chooses the duration; the user cannot extend an active session.

Use and end the session

The screen shows ELEVATED and the time remaining. AutoElevate adds a rule that lets sudo run any command as any user without a password. On compatible hosts, it also authorizes polkit actions.

Press e to end the session early. At the end, AutoElevate removes its grants and the screen returns to standard privileges. Programs already running as root and changes made as root remain. A denial shows Request denied.

To request more time, end the current session and send a new request. Pressing r during an active session does not send another request.

Review past sessions

In the Admin Portal, open the computer from Computers. Its Elevated Sessions section lists each session's user, who approved it, and how long it lasted.

Check status from a script

aeagentd status

The command reports elevation for the user who runs it, followed by the agent's backend: state. An RMM running as root sees root's elevation state. To check another user, run the command as that user:

sudo -u '<USERNAME>' aeagentd status

Replace <USERNAME> with the user's login name. Running aeagentd without arguments in a pipe also prints status. aeagentd version prints the installed version.

JIT Admin Log In on Linux

JIT Admin Log In creates a local account with a locked password. Each login needs an approval. The account stays expired until approval grants access. The JIT account cannot request an Elevated Session.

Configure the account

1. In Settings, expand Just-in-Time (JIT) Log In and select Just-in-Time (JIT) Log In - Configuration at the level that applies to the computers.
2. Select Enabled. Enter the Username. Use 1–20 ASCII letters, digits, _, ., or -. Start with a letter, digit, or _, and do not use only digits. The names root, daemon, bin, sys, and nobody are refused without regard to case.
3. Use a name that does not belong to an unrelated account on the hosts. AutoElevate leaves such an account alone and cannot provide JIT login under that name. Run sudo aeagentd status or read the service log to find the refusal reason. The portal does not show that refusal. The portal's note that an existing user's password is overridden applies to Windows.
4. Leave Credential Tile Label Override, Delete User After Every Log Off, and Domain Log In Enabled unchanged. Linux ignores them.
5. Select Save.

The agent retrieves the enabled state and account name from AutoElevate. Renaming or disabling the setting revokes the old account's access and expires it. The account, home directory, and existing processes remain.

Authorize the approvers

1. In Settings, select Just-in-Time (JIT) Log In - Authorizations.
2. Expand an authorization, or select Add Authorization.
3. Under Roles or Users, add the technician's role or user.
4. Under Local Groups, type sudo in Add Local Group… and select +. Do the same for wheel, or select that panel's All checkbox.
5. Leave Domains empty.
6. Select Save.

The host offers sudo if that local group exists in /etc/group; otherwise it offers wheel. A host with neither cannot send a JIT login request. An entry listing only Windows Administrators does not authorize Linux.

Check the host

The installer adds PAM blocks to the configured login services and an SSH drop-in at /etc/ssh/sshd_config.d/00-autoelevate-jit-admin.conf. The drop-in enables keyboard-interactive authentication only for the autoelevate-jit group.

For SSH, check that /etc/ssh/sshd_config includes /etc/ssh/sshd_config.d/*.conf and that UsePAM yes is effective. The installer warns if the Include line is missing. Do not enable keyboard-interactive authentication globally for this feature.

Log in

1. Connect over SSH or use a configured console or graphical login service. Enter the managed username.
2. At the AutoElevate prompt, press Enter to send the request.
3. Open the request in the AutoElevate mobile app and tap Approve, or approve it under Elevation Requests in the Admin Portal. The approval grants the host's single authorized local group.

Mobile app: Approving JIT Admin Log In requests on a phone currently needs the beta version of the AutoElevate mobile app. Until it reaches the production app, approve them under Elevation Requests in the Admin Portal.

Over SSH, the approval wait has no visible progress. The default approval timeout is 100 seconds, including time spent at the confirmation prompt. A shorter host timeout can end the login sooner. If the wait ends, log in again to send a new request that needs a new approval. Changes to /etc/pam.d/autoelevate are replaced on upgrade.

Approve only requests you started. Repeated login attempts send repeated approval requests.

Rights apply to the account, including its other processes, while JIT access is active. An unused approval can authorize the account for five minutes, including after desktop unlock without a new session. AutoElevate removes its rules and expires the account when no active session or unused approval remains. An SSH ControlMaster connection can keep the session open after its shell exits.

Programs already running continue. A later approved login gives the account's remaining processes administrator rights again. An agent restart revokes JIT administrator rights for open logins; log in again with a new approval.

Uninstall revokes access and expires the account but keeps its home directory and processes. See Uninstalling in Linux Agent Installation (Beta).

Login failure messages

Offline and backend-rejection messages can include further details in parentheses.

Troubleshooting

Read the logs

Have a host administrator read the service log:

sudo journalctl -u autoelevate-agent -f

For PAM, check the host's authentication log for pam_autoelevate: entries. The distribution's logging configuration determines the file or journal destination.

Requests are refused

Run aeagentd status. If the backend: line does not read connected, follow the connection checks in Linux Agent Installation (Beta). A running service alone does not establish registration or connectivity.

The tray is missing or does not open a terminal

Check that the panel provides StatusNotifierItem support. The tray retries every two seconds while it waits for the panel. Run aeagentd in any terminal to use the request screen directly.

If no supported terminal starts, the tooltip says No terminal found. Run aeagentd in a terminal.

Graphical administrator prompts still refuse

Check that the host's polkit supports JavaScript rules. Without that support, AutoElevate provides only sudo access.

JIT login shows a password prompt

Check that JIT Admin Log In is enabled for this computer. Run sudo aeagentd status and read any JIT Admin: refusal. Check the SSH Include line, effective PAM settings, and the selected login service's AutoElevate block. An unavailable agent causes a managed JIT login to fail; it does not intentionally fall back to password login.

The approver sees Unauthorized

Check the technician's user or role in Just-in-Time (JIT) Log In - Authorizations. The entry must authorize the offered local group, with Domains empty. A login cannot complete unless an authorized technician approves it.

Related Articles

• Linux Agent Installation (Beta)
• macOS Support & Elevated Sessions
• Just-in-Time (JIT Admin Login)