Install & approve the Linux agent

Linux servers are managed by the same Skans agent binary as Windows, wrapped in a native .rpm (RHEL/CentOS/Rocky/Alma) or .deb (Debian/Ubuntu). It checks in over mutual TLS, ships inventory, metrics, journald, and a report-only patch scan. This is the agent lane; cameras and IoT go the agentless route instead.

Windows endpoints: Install & approve the Windows agent.

Note

There is no Linux self-update lane. Upgrade by installing the new package. Patch apply (pinning the appliance as the APT/DNF source) is not the default — the agent reports pending updates; you approve apply separately.

1. Get the package #

From the appliance (or the console’s Linux enroll page) take the current skans-agent-*.rpm or skans-agent_*.deb. Copy it to the box. Do not use a tarball/install.sh into /usr/local/bin — that path is outside sudo secure_path on RHEL.

BASH
# RHEL family
sudo rpm -Uvh skans-agent-<version>-1.el9.x86_64.rpm
# Debian/Ubuntu
sudo dpkg -i skans-agent_<version>-1_amd64.deb

The package installs /usr/bin/skans-agent, the systemd unit (Restart=always), and a daily cert-renew timer. Identity files under /var/lib/skans-agent are not in the package — they survive upgrade and remove.

2. Enroll #

In the console, Devices → Enroll Linux. That mints a one-time, hostname-bound token and shows the appliance FQDN. On the box (as root):

BASH
sudo skans-agent enroll --appliance <appliance-fqdn>

Paste the token when asked (or pass it the way the console one-liner prints). The agent generates its own key, submits a CSR, and receives a clientAuth certificate from the appliance CA. The box appears pending.

/etc/skans-agent/agent.conf must contain SKANS_APPLIANCE=<fqdn> and SKANS_LOOP=120. 300 seconds disables hub failover — do not use it.

3. Approve it #

Approve the device in the console. Until then it receives no commands. After approval it checks in, and you should see it online with inventory and metrics.

4. Operate #

BASH
systemctl status skans-agent
journalctl -u skans-agent -f
sudo skans-agent version          # no side effects
sudo skans-agent renew --force    # rotate the leaf; identity is root-only

Uninstall is an operator verb before removing the package: sudo skans-agent unenrol --purge, then rpm -e / dpkg -r. The package scripts never delete the identity on their own.

Verify #

On the device page: agent online, a valid client certificate, inventory populated. Anything not measured on the box reads not verified — not assumed green.