How to set up Agent Controller on Linux

Aembit provides many different deployment options you can use to deploy Aembit Edge Components in your environment. Each of these options provide similar features and functionality. The steps for each of these options, however, are specific to the deployment option you select.

This page describes the process to deploy Agent Controller to a Linux virtual machine (VM).

Note

Aembit recommends deploying Agent Controller and Agent Proxy on standalone VMs and not collocating them on the same VM.

See About Colocating Aembit Edge Components for more info.

Supported versions

Use the following table to make sure that Aembit supports the operating system and platform you’re deploying to your VM:

Operating system	Edge Component versions
Ubuntu 20.04 LTS	Agent Controller v1.12.878+
Ubuntu 22.04 LTS	Agent Controller v1.12.878+
Red Hat 8.9 *	Agent Controller v1.12.878+

* See How to configure Agent Proxy on SELinux or RHEL for more info.

Install Agent Controller

To install Agent Controller, follow these steps:

1. Download the latest Agent Controller Release.

2. Log on to the remote host with your user:

   ssh -i <path/to/your/ssh/key> <your-username or remote-host>@<hostname>

3. Download Agent Controller using the correct <version_number>:

   wget https://releases.aembit.io/agent_controller/<version_number>/linux/amd64/aembit_agent_controller_linux_amd64_<version_number>.tar.gz

4. Unpack the archive:

   tar xf aembit_agent_controller_linux_amd64.<version_number>.tar.gz

5. Go to the unpacked directory:

   cd aembit_agent_controller_linux_amd64

6. Run the installer to enable Trust Provider-based Agent Controller registration, making sure to replace <TenantID> and <AgentControllerId> with the values from your Aembit Tenant:

   sudo AEMBIT_TENANT_ID=<TenantID> AEMBIT_AGENT_CONTROLLER_ID=<AgentControllerId> ./install

   Optionally, add any other Agent Controller environment variables reference in the format ENV_VAR_NAME=myvalue.

   Trust Providers

   If you don’t already have a Trust Provider, see Add Trust Provider.

   Popular Trust Providers:

   • AWS Metadata Service
   • Azure Metadata Service

   Using Device Codes

   Aembit doesn’t recommend using device codes because they don’t give you the same level of control and flexibility in attestation as Trust Providers. However, Kerberos attestation may sometimes require Agent Controllers using a device code.

   Device codes are a suitable fallback mechanism in environments without a Trust Provider or in non-prod scenarios such as a proof of concept, lab, or demo environment.

   To use a device code, you must generate a device code in the Aembit website UI and replace AEMBIT_AGENT_CONTROLLER_ID with the AEMBIT_DEVICE_CODE environmental variable in the preceding command.

Agent Controller environment variables

For a list of all available environment variables for configuring the Agent Controller installer, see Agent Controller environment variables reference.

Security Best Practice

Make sure the Agent Controller can accept connections on port 5000 from Agent Proxies (update your security groups if needed). Because access to Agent Controller is sensitive, your Agent Controller’s port should not be open to the Internet.

Uninstall Agent Controller

Run the following command to uninstall the previously installed Agent Controller.

sudo ./uninstall