Skip to Content

Wiki source code of Unix Agent installieren

Last modified by Sabrina V. on 2026/04/16 05:43
Show last authors
1 {{aagon.floatingbox/}}
2
3 (% class="wikigeneratedid" %)
4 The Unix Agent is the completely renewed and technically revised further development of the Linux and Mac agents. The agent can be deployed and installed without Python using a supplied Client Command. The inventory data is transmitted to the acmp Server in full and updated.
5
6 {{aagon.infobox}}
7 If you use Unix clients that are not connected to the network, you can inventory them using the [[Unix Offline Scanner>>doc:ACMP.610.Arbeiten mit der ACMP Console.Clients erfassen.Offline Scanner.WebHome||anchor="“HRunUnixOfflineScanner”"]].
8 {{/aagon.infobox}}
9
10 {{aagon.versionierungsbox}}
11 Please note that the assignment of a maintenance window profile to containers with Unix agents is only supported in its full form starting with aesb version 1.12. Additionally, creating a maintenance window profile is possible starting with acmp version 6.9.
12 {{/aagon.versionierungsbox}}
13
14 = Installation requirements =
15
16 There are several requirements for you and your system for installing the Unix Agent.
17
18 === Requirements for your knowledge of acmp ===
19
20 * You have a basic understanding of how to configure SICS.
21 * You know how to import Client Commands into acmp.
22 * You know how to execute Client Commands.
23
24 === Requirements for your environment ===
25
26 * acmp is installed.
27 * SICS is installed on a server.
28 * The acmp Server is connected to SICS.
29 * SICS users are allowed to access the public API.
30
31 === Requirements for your MacOS and Linux systems ===
32
33 Our [[general system requirements>>https://www.aagon.com/produkte/ueberblick/systemanforderungen-acmp/#c4421]] provide an overview of all tested distributions.
34
35 In addition, certain settings are required on your systems:
36
37 * An installed SSH server that is accessible from outside (important for agent distribution).
38 * Root must be able to log in from outside via ssh or, alternatively, a user who can obtain root rights via sudo (sudo must be installed for the alternative).
39 * Linux and MacOS Clients must be able to reach SICS via Rest (any firewalls must allow port 3950).
40 * Firewall settings for SICS must be customizable if necessary.
41
42 {{aagon.infobox}}
43 Please note that the Unix Agent has been advanced with additional scanners in acmp version 6.10. The System Scanner requires certain packages for this purpose, which must be installed or downloaded on Linux environments.
44
45 The Unix Agent reads the TPM information from the physical devices and then populates certain fields (e.g., “TPM enabled,” “TPM on,” or “TPM manufacturer”) with the corresponding values.
46
47 You will need the following packages:
48 **TPM:**
49
50 „tpm-tools“ for TPM 1.2 Chips
51 -„tpm2-tools“ for TPM 2.0 Chips
52
53 **Login History:**
54
55 „util-linux“
56
57 Execute these packages in the terminal.
58 __Example__: For Ubuntu 24.04, the installation commands would be as follows:
59 „sudo apt install tpm-tools“
60 „sudo apt install tpm2-tools“
61 „sudo apt install util-linux“
62 {{/aagon.infobox}}
63
64 = Installation with the Client Command =
65
66 An existing SICS connection to the acmp server is required to install the Unix Agent. If you have not yet configured a SICS connection, you must do so first. Instructions for configuring the SICS connection can be found in the section [[Configuring the SICS connection>>doc:AESB.111.AESB installieren, konfigurieren und aktualisieren.SICS-Verbindung konfigurieren.WebHome]].
67
68 The Unix Agent is installed using a Client Command in acmp. To do this, the Client Command must first be imported and released.
69
70 {{aagon.warnungsbox}}
71 Installing the Unix Agent stops and removes the Linux Agent.
72
73 The ClientID used by the Linux Agent is retained and reused by the Unix Agent.
74 {{/aagon.warnungsbox}}
75
76 === Import and release Client Command ===
77
78 The file for the required Client Command of the Unix Agent is named as in the following example:
79
80 {{{acmp Unix Agent verteilen & Inventory__{1F5A4238-731B-44B6-84F0-3EFB8F2D3222}.sim}}}
81
82 For information on how to import and release a Client Command in acmp, refer to the section [[Create Client Commands>>doc:ACMP.610.ACMP-Solutions.Desktop Automation.Client Commands.Client Command erstellen.WebHome||anchor="HImport"]].
83
84 {{aagon.warnungsbox}}
85 To ensure that clients are properly detected and can be managed, you must use a version of the Unix Agent that is compatible with your acmp version. Otherwise, your Linux and macOS clients will not be detected as manageable clients.
86 {{/aagon.warnungsbox}}
87
88 === Execute Client Command ===
89
90 After you have released the Client Command, you can execute it.
91
92 In the acmp Console, navigate to Client Commands > Execute. Then double-click to select the Client Command for the Unix Agent.
93
94 In the dialog window that opens, click the //Execute// button. The Client Command interface opens, where you can configure the installation of the Unix Agent.
95
96 [[Configuring the Unix Agent using the Client Command>>image:Unix Agent - Fallback-SICS.png||alt="“Configuring" data-xwiki-image-style-alignment="center" height="600" width="480"]]
97
98 = Configuring the Unix Agent =
99
100 For the configuration of the Unix Agent, there are various areas in the Client Command where you can make specific settings.
101
102 === SSH credentials ===
103
104 The Unix Agent is transferred to the target computers via SSH; valid user data must be entered accordingly. Unlike the Linux Agent, the Unix Agent transfers the scan data directly to the acmp Server.
105
106 {{aagon.warnungsbox}}
107 The user whose user data is specified as SSH credentials for the installation must be created on each of the target computers and have “sudo” rights (superuser do) there.
108 {{/aagon.warnungsbox}}
109
110 === Select Clients ===
111
112 In the upper right corner of the dialog window, you can use the IPv4 address to specify the clients on which the Unix Agent is to be deployed. To do this, you can either specify an IPv4 range or compile a list of IPv4 addresses.
113
114 === Specify SICS credentials ===
115
116 To perform the installation of the Unix Agent on the target computers, you must enter your SICS session data.
117
118 **SICS user**
119
120 For the SICS user, you can create an aesb user with minimal permissions. This user must be created in the aesb console. For more info, see the section [[managing aesb users>>https://doc.aagon.com/bin/view/AESB/111/Workspaces/Benutzer/#HBenutzerverwalten]].
121
122 **SICS server**
123
124 The endpoint must be specified in the format “wss:~/~/server:port”, for example:
125
126 * wss:~/~/ipaddress:port
127 * wss:~/~/hostname:port
128 * wss:~/~/FQHN:port (Fully Qualified Host Name)
129
130 Please note that all target computers require access to this endpoint. You assigned the additional user credentials for the operator during the aesb installation.
131
132 **SICS Fallbacks**
133
134 In the tabs, you can specify multiple fallback SICS connections. If the primary SICS connection fails and cannot be used, the system will attempt to establish a connection to another defined SICS and perform the transfer via one of the fallback connections. The list of fallback SICS connections is used continuously, starting with Fallback SICS #1, until a connection to one of the defined fallback SICS connections has been established or there are no continuing fallback connections remaining in the list.
135
136 {{aagon.infobox}}
137 If the connection to one of the defined fallback SICS could be established successfully, the connection is maintained until the next restart.
138 {{/aagon.infobox}}
139
140 === Options ===
141
142 In the //Options //area, you can configure settings for logging and specify the mode in which the agent should be executed.
143
144 **Enable logging**
145
146 By selecting the //Enable logging// option, you can load the logs to your machine (or the machine with the acmp Console) after installation or execution. Enabling logging is already available at this point in the Client Command and can be useful, as errors may occur during installation or execution as Inventory One-Time-Scan.
147
148 **One-time scan**
149
150 For a one-time inventory of a client, the agent can be executed in //One-time scan// mode. The Unix agent is now transferred to the target computer and started. After the scanner has been executed successfully, the agent is removed from the system again. To ensure that the new results can be assigned accordingly when the //One-time scan// mode is executed again, the ClientID remains on the client. You can find this under the path: ##/etc/aagon/ACMPUnixAgent/agentId##
151
152 **Agent installation**
153
154 To install the Unix Agent as a permanent resource, you can execute the agent in the //Agent Installation// mode. The Unix Agent is now transferred to the target computer and registered as a service. Following installation, the agent starts automatically and obtains its configuration from acmp within 10 minutes. The agent is now entered as a client in acmp and contains the basic client details. The execution file can be found under the path: ##/usr/local/sbin/aagon/ACMPUnixAgent/##
155
156 The agent also uses another directory to store various resources that are relevant to the agent. This directory can be found under the path:## /etc/aagon/ACMPUnixAgent/##
157
158 The Agent Tasks templates are used to execute the scanners. These can be used in exactly the same way as with the acmp Windows Agent (Container). The following jobs are currently taken into account within the Agent Tasks:
159
160 * System scanner
161 * Software scanner
162 * Update settings
163
164 **Uninstall agent**
165
166 To uninstall the Unix agent as a service, you can execute the agent in the //Uninstall agent// mode. The registered Unix agent service is now removed from the target computer together with the execution file.
167
168 === Activated scanners ===
169
170 In the //Activated Scanners// area, you can disable individual scanners. This is useful if you do not need certain information or if problems occur with one or more scanners.
171
172 === Client Command Settings ===
173
174 By clicking the checkbox in the CC Settings area, you can specify that no confidential information (e.g., passwords) is stored in the Client Command.
175
176 === Feedback on execution ===
177
178 After executing the Client Command, a dialog window will appear informing you whether the Client Command was executed successfully. The number of processed Clients is displayed, along with information on whether connection errors (SSH errors) were detected.
179
180 {{figure}}
181 [[image:CC_Erfolgsmeldung.png||alt="“Success" data-xwiki-image-style-alignment="“center”"]]
182
183 {{figureCaption}}
184 Success message about installation of the Unix Agent
185 {{/figureCaption}}
186 {{/figure}}
187
188 = Logging =
189
190 If connection errors occur during the execution of the Unix Agent, these errors are written to the file ##SSH_Errors.log## and to the log of the Client Command. You can find the file either in the default folder ##C:\Logs## or in the directory you specified for logging the Unix Agent.
191
192 {{aagon.infobox}}
193 These connection errors do not cause the Client Command to be terminated. Therefore, these errors are not displayed if you have selected the logging setting //Only on errors //for the console log.
194 {{/aagon.infobox}}
195
196 If you would like to receive immediate feedback about possible connection errors after executing the Client Command, you should either select the //Always //option for the console log settings or check the file ##SSH_Errors.log##.
197
198 = Troubleshooting =
199
200 Below you will find solutions to various problems that may occur during the installation of the Unix Agent.
201
202 ----
203
204 **Symptom:** The Unix Agent could not be deployed on the Clients and no errors are displayed in the log.
205
206 **Cause: **The Unix Agent does not yet exist as a service, so no errors can be written to the log.
207
208 **Action: **Start troubleshooting in your system's journalctl and find entries for the failed installation of the Unix Agent.
209
210 ----
211
212 **Symptom:** After distributing the Unix Agent using the Client Command, the Unix client does not appear in acmp.
213
214 **Cause:** An error occurred during the execution of the Client Command, but was not immediately apparent due to the settings.
215
216 **Action:** In the properties of the Client Command in the plugin //Options //in the Combobox //Show console log// enable the option //Only on errors// and confirm the
217 dialog with //OK//. After executing the Client Command again, a console log should now be displayed in the event of an error, which may provide information about the cause of the problem.
218
219 If the Unix systems still do not appear in acmp, there may be many reasons for this. It is therefore recommended to activate logging for the agent and the SICS. Then go through the chain from start to end.
220
221 ----
222
223 **Symptom:** After distributing the Unix Agent using the Client Command, the Unix client does not appear in acmp. The error “Invalid input detected: endpoint” is displayed in the SmartInspect log.
224
225 **Cause:** An error occurred during the connection to SICS because the protocol may not have been prefixed during the connection. You can see this in the SmartInspect log in the row //Application settings//: ##“SicsEndpoint: <AESB-SICS-NAME_IP>:3950”##
226
227 **Action:** Make sure that the SICS endpoint is set to ##wss:~/~/<AESB-SICS-NAME_IP>:3950## and not just ##<AESB-SICS-NAME_IP>:3950##
228
229 ----
230
231 **Symptom:** The Unix Agent is not located on the target system at the following location: ##/usr/local/sbin/aagon/ACMPUnixAgent.##
232
233 **Cause:** There may be several causes for this problem:
234
235 * The login user is not allowed to obtain root rights via sudo.
236 * The user has root rights, but root is not allowed to log in via SSH.
237 * The user has root rights and root is not allowed to log in via SSH, but the SSH daemon is not running properly.
238
239 **Action:** Make sure that the SSH user is allowed to log in via SSH and can obtain root rights.
240
241 ----
242
243 **Symptom:** The Unix agent starts but does not reach the //running// status.
244
245 **Cause:** The agent does not seem to be able to connect to SICS.
246
247 **Action:** Check whether the network connection to SICS is working. If this does not solve the problem, enable logging in the Client Command and perform the action again. Then look for error messages in the output.
248
249 ----
250
251 **Symptom:** The agent is not started at system start.
252
253 **Cause:** Something went wrong when setting up or starting the service.
254
255 **Action:** Execute the Client Command for installing the Unix Agent again.
256
257 ----
258
259 **Symptom:** The Unix Agent is running, but the corresponding Unix client does not appear in an acmp query.
260
261 **Cause:** The SICS cannot forward the scan data of the Unix Agent to the acmp Server because the connection is not available.
262
263 **Action:** Check in the acmp Console settings whether the SICS connection of the acmp Server is still working (in the acmp Server / SICS connection plugin) and whether the checkbox for SICS users to access the public API is activated. Further information on this problem can be found in the log of the acmp Server or the Unix Agent.
264
265 ----
266
267 **Symptom:** The Unix client appears in an acmp query, but no scan data is available.
268
269 **Cause:** During installation, the system waits between 2 and 10 minutes until the scan settings for this Unix client are retrieved by sending a request to the acmp Server.
270
271 **Action: **If necessary, wait a little longer until the scan data has been loaded. If no scan data appears after significantly more than 10 minutes, you should enable logging for all components involved and check the entire chain from start to end for errors.
272
273 = **Updating the Unix Agent** =
274
275 Updating the Unix Agent is done in the same way as its [[installation via a Client Command.>>||anchor="HInstallationwiththeClientCommand"]]
276
277 In this process, the agent is redistributed and installed on the target systems via the acmp Console. The transfer takes place via SSH using the appropriate permissions. During execution, the existing agent is replaced by the current version and reconfigured as a service.
278
279 The agent then starts automatically and takes over the existing communication with the acmp Server.
280
281 = Administration of Linux and MacOS Clients =
282
283 Previously, clients running Linux or macOS could only be detected and inventoried with the Unix Agent. They could not, however, be administered, and no shell scripts or jobs could be executed on these clients. Now, newly detected Linux and macOS clients can be managed if inventoried using the Unix Agent. This also enables the automated, time-controlled execution of Unix scripts as jobs. For more info, see the section [[Unix Scripts>>doc:ACMP.610.ACMP-Solutions.Desktop Automation.Unix Scripts.WebHome]].
284
285 (% class="box infomessage" %)
286 (((
287 [[image:https://doc.aagon.com/bin/download/XWiki/Aagon Infobox/WebHome/Information.svg||alt="Hinweis" height="32" width="32"]] **Note: **
288
289 All Linux and MacOS clients that are registered with Unix Agent version 1.10 or older cannot be managed. To make your Linux or MacOS clients manageable, register them again via the Unix Agent.
290 )))
© Aagon GmbH 2026
Besuchen Sie unsere aagon-Community