Linux Client - Install / Uninstall

Prerequisites

Admin By Request, version 3.0 supports the following Linux distributions:

• Ubuntu 20.04 LTS

• Ubuntu 22.04 LTS

• Red Hat Enterprise Linux (RHEL9)

You will need the following on every workstation that executes the installation client:

• Administrator privileges (e.g., the ability to run sudo).

• Python 3 installed - the installation client is a Python script. This is not required if Admin By Request is downloaded to the workstation as part of an image

You will also need valid credentials to access to your Admin By Request online portal at Admin By Request Portal.

Your Tenant License

The installer file downloaded from the portal is unique to your tenant. Depending on the target operating system, it can be an executable file, a package or a script and it is signed with a license that applies only  to installers downloaded from the tenant in which you are currently logged-in. The same license file is applied to each of the operating system client installers: Windows, macOS, Linux and Server.

This is true for free plans as well as paid plans.

When installed on an endpoint, once the endpoint connects successfully, you will see in real time the status of the endpoint in your Inventory, which is also unique to your tenant. You will not see other endpoints installed with files downloaded from other tenants - this is simply not possible.

Installing Admin By Request

The following installation procedure is in two parts: the first outlines downloading and installing the Admin By Request package, and the second part describes how to test that installation was successful.

Installation steps are grouped into the following tasks:

1. Download and install the Admin By Request package.

   1. Download the Linux client from https://account.adminbyrequest.com/ABRDownload and store the client file in a suitable temporary location.

   2. If you haven’t already, start a terminal session and make sure the file is executable:

      Copy

      chmod +x 'abr-installer'

   3. Run the installation script:

      Copy

      sudo ./'abr-installer'

   4. When the installation completes, the Admin By Request icon appears in the top right corner of the screen. Click the icon to show details about the client or start an Admin Session.

   Installation is now complete.

2. Test the installation.

   1. At the command line, enter a command that requires elevated privileges
      (e.g., sudo apt update).

      The result should be a line explaining that sudo is not allowed by Admin By Request - an admin session is required.

   2. Log in to the Admin By Request Portal.

   3. From the portal menu at the top, select Endpoint Privilege Management > Settings > Linux Settings

   4. Under AUTHORIZATION, check the current settings and change any that you wish to test. For example, you might set the Access time (minutes) to 5.

   5. Return to the Linux workstation and start an admin session:

      1. Click the Admin By Request icon in the top right corner of the screen and select Request administrator access.

      2. Confirm you want to start a session now (answering any questions that might pop up, such as Reason).

   6. Run the sudo command above again and confirm that it works this time.

   7. You can now finish the admin session or allow it to time out.

   You might also want to check the audit log in the portal, to review the details that were logged as part of this admin session:

   1. From the portal menu at the top, select Auditlog.

   2. Under ADMIN SESSIONS, find the name of the logged-in user and expand the drop-down arrow:

      

   3. Note the activity - in the example shown, no software was installed or uninstalled, and no files were executed using elevated privileges during the session.

Upgrading Admin By Request

To immediately upgrade Admin By Request on a Linux endpoint, simply run the standard :system update / upgrade commands at the command line:

1. Start a terminal session.

2. If you're starting an Admin Session and need Admin By Request approval to run sudo commands, request it.

3. Once approved, execute the system update/upgrade commands:

   Copy

   sudo apt update
   sudo apt upgrade

Deploying new releases

Admin By Request software updates are deployed by our Auto-Update process. However, when we release a new version we do not deploy it right away to all customers via auto-update. This is simply to mitigate any issues that arise after beta testing.

Our rule-of-thumb is to activate auto-update of new releases within 4 - 8 weeks of release, but this is subject to change, depending on feedback and any potential issues that might arise.

Contact us if you wish to receive the latest version right now. You can also raise a support ticket requesting the latest update.

Refer to the Download Archive for previous versions of Admin By Request.

Uninstalling Admin By Request

There are several ways to uninstall Admin By Request on a Linux endpoint, depending on the version currently installed:

1. From GRUB menu (all versions).

   1. Shutdown and reboot the computer.

   2. Try any of the following:

      • If your computer boots using BIOS, press and hold down the Shift key while GRUB is loading.

      • If your computer boots using UEFI, press the Escape key (Esc) while GRUB is loading.

      • As you’re booting the computer, wait for the manufacturer logo to flash from the BIOS. If your computer boots too quickly, you’re going to need to do this immediately after powering it on. Quickly press the Escape key.

      The timing has to be near perfect on some computers, so you may have to press the key repeatedly. If you miss the window, reboot and try again.

   3. At the GRUB boot menu. you’ll see an entry for “Advanced Options ...”. Select it and press Enter.

   4. Choose the most recent recovery mode option and press Enter.

   5. If a menu similar to that shown below appears, choose the option that gets you to a shell prompt:

      

   6. At the Password: prompt, enter the root password..

   7. Now you can uninstall Admin By Request for Linux by executing the following command:

      apt -y purge abr-* && apt -y autoremove

2. Via root user (version 2.2.3 and earlier).

   1. Start a terminal session, then start an Admin Session.

   2. If you haven't already, set the root user password:

      sudo passwd

   3. Switch to the root user:

      su

   4. Execute the following command:

      apt -y purge abr-* && apt -y autoremove

User rights after installation

When a user logs on, the account is downgraded from Admin to Standard User unless:

• You have turned off Revoke Admins Rights in the portal settings (EPM > Settings > Linux Settings > Lockdown > ADMIN RIGHTS).

• Also under Revoke Admins Rights, the user is in the list of Excluded accounts.

• The computer is domain-joined and the user is a domain administrator.

Please refer to Supplementary Technical Information for more information.

Tamper Prevention

When a user initiates an administrator session, the user’s role is not actually changed from user to admin. The user is granted all administrator rights, except the right to add, modify or delete user accounts. Therefore, there is no case where the user can create a new account or change their own role and become a permanent administrator.

The user also cannot uninstall Admin By Request, as the only program, to keep the administrator session open forever. Furthermore, all settings, configuration and program files are monitored during administrator sessions. If the user tries to remove or change any of the Admin By Request files, these are restored straight away and the attempted activity is logged.

Performance after Installation

When users are not using Admin By Request, it does not consume resources, except for a brief daily inventory and settings check.

File Locations

Admin By Request maintains files and logs in the following locations:

• Executable Files: /usr/bin

• Configuration Files: /etc/abr and /usr/share/abr/configuration

• Log Files: /var/log/abr