Overview

The AutoElevate Linux agent provides Elevated Sessions and JIT Admin Log In on Linux workstations and servers. An approved elevated session gives the user full root access through password-free sudo and, on compatible hosts, polkit.

For requests, approvals, and JIT Admin Log In setup, see Linux Support, Elevated Sessions & JIT Admin Log In (Beta).

Before You Begin

Check the host requirements

Tested systems: AutoElevate has tested default installs of Ubuntu 26.04, 20.04, 18.04, and 16.04; Debian 11, 10, and 9; Rocky Linux 8; openSUSE Leap 15.3 and 15.2; CentOS 7; Amazon Linux 2; SLES 12 SP5; and Arch Linux. Other distributions with glibc 2.17 or newer may work. Hardened or locked-down setups and Windows Subsystem for Linux (WSL) have not been tested. Report problems to CyberFOX Support.

Get the registration details

In the Admin Portal, select Enroll Computers at the top of Settings or Computers. Copy License Key is on its Installer and RMM Script tabs. Get the company and location names for the computer. Enrollment creates a company or location that does not exist yet.

Allow outbound HTTPS

Allow outbound TCP port 443 to these hosts. The agent requires no inbound network port.

The API base URLs are built into the agent. They cannot be changed in agent.conf.

Installing from the Admin Portal

Open Enroll Computers from the top of Settings or Computers, or from a location's row menu or page. When you open it from a location, that location is already picked.

1. Select Install Command.

2. Select the company and location. Pick one from the list or search for it. Users who can add companies and locations can also type a company and location name; enrollment creates them if they do not exist.

3. Select Linux Agent, then Copy Install Command.

4. Run the command on the host as a user with sudo access.

The license key is masked on screen but included in the copied command. The command downloads the installer to a temporary directory, passes the license key on standard input, installs and registers the agent with that company and location, and removes the temporary directory.

For a manual installation, open the Installer tab. Select Download Installer on the Linux row, which shows the current Linux version, or Copy Link. Save or rename the file as autoelevate-agent.sh. Use Copy License Key to copy the key the installer asks for.

You can also download the installer with:

curl -fL -o autoelevate-agent.sh https://apollo.autoelevate.com/api/agentBuilds/latest/download/linux

The download URL requires no credentials. Save the installer to disk; it cannot run from a pipe. Then follow Run the installer below.

For RMM deployment, the RMM Script tab links to the RMM deployment guides and has Copy License Key.

Installing the Agent

Run the installer

Skip this step if you used the portal's install command. On a new install, the installer also registers the agent. Run it in a terminal; it asks for the company, location, and license key. The key is not displayed.

sudo sh ./autoelevate-agent.sh

To give the names on the command line, use --company and --location. The installer then asks only for the license key:

sudo sh ./autoelevate-agent.sh --company '<COMPANY NAME>' --location '<LOCATION NAME>'

The installer checks all three values before it changes the host. The company and location cannot contain a line break.

The installer checks its payload's SHA-256 checksum, selects the native package for the architecture and package manager, installs it, starts the systemd service, and registers the agent.

On a host that is already registered (/etc/autoelevate/agent.conf is not empty), the installer upgrades the agent and keeps the registration. It ignores --company and --location and says so.

To unpack all six packages without installing, use sh ./autoelevate-agent.sh --extract '<DIRECTORY>'. Replace <DIRECTORY> with the output directory. To display usage, use sh ./autoelevate-agent.sh --help. After --extract, install a package by hand, then register it with aeagentd register.

If the installer stops

Installer check failures use AutoElevate installer:. Invalid arguments print usage instead.

If the package manager reports an error, read that error for the cause. The package requires glibc 2.17 or newer.

Registering the Agent

The installer registers a new install. Use aeagentd register to register a package you installed by hand, such as after --extract, or to change the company or location.

Interactive registration

1. Register the agent with the target company and location:

sudo aeagentd register --company '<COMPANY NAME>' --location '<LOCATION NAME>'

2. At the license-key prompt, paste the key and press Enter. The key is not displayed. A successful registration prints Registered AutoElevate Linux agent as computerId ….

The command restarts the agent service so it loads the registration. If the restart fails, it reports autoelevate-agent.service did not restart; fix it, then run: systemctl restart autoelevate-agent.service.

Unattended registration

For an RMM, use the command from the Install Command tab of Enroll Computers. To register an agent you have already installed, pass the key on stdin:

printf '%s\n' '<KEY>' | sudo aeagentd register --company '<COMPANY NAME>' --location '<LOCATION NAME>'

Replace all three placeholders. The company, location, and license key must be non-empty. Protect commands and scripts that contain the key.

Registration writes /etc/autoelevate/agent.conf, owned by root with mode 0600. The file is kept.

What the Installer Places on the Host

Choose the login services

The installer adds marked blocks to existing PAM files for sshd, login, lightdm, gdm-password, and sddm. To use a different list, pass AE_PAM_SERVICES when you install:

sudo env AE_PAM_SERVICES="sshd login" sh ./autoelevate-agent.sh

The installer saves the list in /etc/autoelevate/pam-services. Upgrades and automatic updates reuse it. To change it, pass a new AE_PAM_SERVICES value when you install a newer version. AutoElevate removes its blocks from services the new list excludes. Uninstall removes all AutoElevate blocks and the saved list.

Confirming the Installation

1. Check the service:

systemctl status autoelevate-agent

2. Check the connection and version:

aeagentd status
aeagentd version

The backend: line reads connected when the agent is registered and signed in. The elevated: line reports the user who runs the command.

3. In the Admin Portal, open Computers and confirm the host appears under the intended company and location.

4. On a desktop, click the tray icon or run aeagentd to test a request. On a server, run aeagentd in a terminal.

Upgrading and Uninstalling

Upgrading

AutoElevate offers updates according to the computer's Agent Update Channel. The agent downloads the offered build, verifies its SHA-256 checksum, and installs it through the host's package manager. You can also run a newer installer manually.

Upgrades keep agent.conf, the computer's registration, the saved PAM service list, and active Elevated Sessions. An upgrade restarts the agent and ends JIT administrator rights for open logins. Technicians must log in again with a new approval.

Uninstalling

Remove the package with the host's package manager:

sudo apt remove autoelevate-agent      # Debian, Ubuntu
sudo dnf remove autoelevate-agent      # RHEL, Fedora
sudo yum remove autoelevate-agent      # yum-based hosts
sudo zypper remove autoelevate-agent   # SUSE
sudo pacman -R autoelevate-agent       # Arch

Uninstalling stops and disables the service, removes AutoElevate's block from every PAM stack that carries it, removes the SSH setting file and the autoelevate-jit group, revokes any rights the agent had granted, and clears the agent's local state.

Troubleshooting

The installer stops

Use the messages under If the installer stops. For a package-manager error, use the error reported by that package manager.

The service stops or cannot connect

Read the service log:

sudo journalctl -u autoelevate-agent -f

If the log reports permissions on agent.conf, correct them:

sudo chown root:root /etc/autoelevate/agent.conf
sudo chmod 600 /etc/autoelevate/agent.conf
sudo systemctl restart autoelevate-agent

Run aeagentd status. If backend: says not configured; run aeagentd register, complete registration. If it says configured, not registered yet or registered, not connected, use the service log to diagnose registration or connectivity before registering again.

Registration rejects the location

Supply a non-empty --location value. The CLI reports register needs a non-empty --location when that flag is empty. A location that does not exist under the company is created during registration.

For tray, request, and login problems, see Troubleshooting in Linux Support, Elevated Sessions & JIT Admin Log In (Beta).

Related Articles

• Linux Support, Elevated Sessions & JIT Admin Log In (Beta)
• System Agent Installation
• macOS Agent Installation
• Just-in-Time (JIT Admin Login)