Linux Client - Install / Uninstall

Prerequisites

Admin By Request, version 3.0 supports the following Linux distributions:

Ubuntu 20.04 LTS
Ubuntu 22.04 LTS
Red Hat Enterprise Linux (RHEL9)

You will need the following on every workstation that executes the installation client:

Administrator privileges (e.g., the ability to run sudo).
Python 3 installed - the installation client is a Python script. This is not required if Admin By Request is downloaded to the workstation as part of an image

NOTE:

The installation script uses standard package management features and may install or update some dependencies if necessary. Once installed, future updates to Admin By Request are handled completely by package management.

You will also need valid credentials to access to your Admin By Request online portal at Admin By Request Portal.

Installing Admin By Request

The following installation procedure is in two parts: the first outlines downloading and installing the Admin By Request package, and the second part describes how to test that installation was successful.

Installation steps are grouped into the following tasks:

Download and install the Admin By Request package.
1. Download the Linux client from https://account.adminbyrequest.com/ABRDownload and store the client file in a suitable temporary location.
2. If you haven’t already, start a terminal session and make sure the file is executable:
  
  Copy
  chmod +x 'abr-installer'
3. Run the installation script:
  
  Copy
  sudo ./'abr-installer'
4. When the installation completes, the Admin By Request icon appears in the top right corner of the screen. Click the icon to show details about the client or start an Admin Session.
Installation is now complete.
Test the installation.
1. At the command line, enter a command that requires elevated privileges
  (e.g., sudo apt update).
  
  The result should be a line explaining that sudo is not allowed by Admin By Request - an admin session is required.
2. Log in to the Admin By Request Portal.
3. From the portal menu at the top, select Settings > Workstation Settings > Linux Settings
4. Under AUTHORIZATION, check the current settings and change any that you wish to test. For example, you might set the Access time (minutes) to 5.
5. Return to the Linux workstation and start an admin session:
  1. Click the Admin By Request icon in the top right corner of the screen and select Request administrator access.
  2. Confirm you want to start a session now (answering any questions that might pop up, such as Reason).
6. Run the sudo command above again and confirm that it works this time.
7. You can now finish the admin session or allow it to time out.
You might also want to check the audit log in the portal, to review the details that were logged as part of this admin session:
1. From the portal menu at the top, select Auditlog.
2. Under ADMIN SESSIONS, find the name of the logged-in user and expand the drop-down arrow:
3. Note the activity - in the example shown, no software was installed or uninstalled, and no files were executed using elevated privileges during the session.

Upgrading Admin By Request

To immediately upgrade Admin By Request on a Linux endpoint, simply run the standard :system update / upgrade commands at the command line:

NOTE:

You can either start an Admin Session or execute each sudo command via Run As Admin.

Start a terminal session.
If you're starting an Admin Session and need Admin By Request approval to run sudo commands, request it.
Once approved, execute the system update/upgrade commands:
Copy
```
sudo apt update
sudo apt upgrade
```

Upgrading Admin By Request typically changes one or more of the following packages:

abr-gui
abr-linux
abr-pam-plugin
abr-polkit-plugin
abr-service
abr-sudo-plugin

Deploying new releases

Admin By Request software updates are deployed by our Auto-Update process. However, when we release a new version we do not deploy it right away to all customers via auto-update. This is simply to mitigate any issues that arise after beta testing.

Our rule-of-thumb is to activate auto-update of new releases within 4 - 8 weeks of release, but this is subject to change, depending on feedback and any potential issues that might arise.

Uninstalling Admin By Request

There are several ways to uninstall Admin By Request on a Linux endpoint, depending on the version currently installed:

From GRUB menu (all versions).
1. Shutdown and reboot the computer.
2. Try any of the following:
  - If your computer boots using BIOS, press and hold down the Shift key while GRUB is loading.
  - If your computer boots using UEFI, press the Escape key (Esc) while GRUB is loading.
  - As you’re booting the computer, wait for the manufacturer logo to flash from the BIOS. If your computer boots too quickly, you’re going to need to do this immediately after powering it on. Quickly press the Escape key.
  The timing has to be near perfect on some computers, so you may have to press the key repeatedly. If you miss the window, reboot and try again.
3. At the GRUB boot menu. you’ll see an entry for “Advanced Options ...”. Select it and press Enter.
4. Choose the most recent recovery mode option and press Enter.
5. If a menu similar to that shown below appears, choose the option that gets you to a shell prompt:
6. At the Password: prompt, enter the root password (or simply press Enter if you haven't yet given the root account any password).
7. Now you can uninstall Admin By Request for Linux by executing the following command:
  
  apt -y purge abr-* && apt -y autoremove
Via root user (version 2.2.3 and earlier).
1. Start a terminal session, then start an Admin Session.
2. If you haven't already, set the root user password:
  
  sudo passwd
3. Switch to the root user:
  
  su
4. Execute the following command:
  
  apt -y purge abr-* && apt -y autoremove

User rights after installation

When a user logs on, the account is downgraded from Admin to Standard User unless:

You have turned off Revoke Admins Rights in the portal settings (Settings Workstation Settings > Linux Settings > Lockdown > ADMIN RIGHTS).
Also under Revoke Admins Rights, the user is in the list of Excluded accounts.
The computer is domain-joined and the user is a domain administrator.

Please refer to Supplementary Technical Information for more information.

Tamper Prevention

When a user initiates an administrator session, the user’s role is not actually changed from user to admin. The user is granted all administrator rights, except the right to add, modify or delete user accounts. Therefore, there is no case where the user can create a new account or change their own role and become a permanent administrator.

The user also cannot uninstall Admin By Request, as the only program, to keep the administrator session open forever. Furthermore, all settings, configuration and program files are monitored during administrator sessions. If the user tries to remove or change any of the Admin By Request files, these are restored straight away and the attempted activity is logged.

Performance after Installation

When users are not using Admin By Request, it does not consume resources, except for a brief daily inventory and settings check.

File Locations

Admin By Request maintains files and logs in the following locations:

Executable Files: /usr/bin
Configuration Files: /etc/abr and /usr/share/abr/configuration
Log Files: /var/log/abr