Overview
Factorial IT uses Fleet as the MDM agent on Linux. It installs from a lightweight package and reports device state, applies policies and runs scripts.
There is no certificate to request and no portal to configure. Enrol the device and it works.
Distribution |
Minimum version |
|---|---|
Ubuntu |
20.04+ |
Debian |
11+ |
Fedora |
38+ |
CentOS |
7.1+ |
Red Hat Enterprise Linux (RHEL) |
7+ |
Amazon Linux |
2+ |
openSUSE |
15.6+ |
Arch Linux |
Supported |
Omarchy |
Supported |
Alpine |
Not supported (APK format) |
How to use
- Check the distribution and version against the table above.
- Encrypt the disk during operating system installation, using LUKS. This cannot be done later without rebuilding the machine.
- Enrol the device. No further setup is needed.
Tips and Best Practices
- Treat encryption as a build-time decision. It is the only Linux setting you cannot fix after the fact, so it belongs in your imaging process rather than your enrolment checklist.
- Do not plan around MDM controls on Linux — they are not supported. Use scripts for anything you would otherwise configure with a control.
- Standardise on one or two distributions if you can. Every extra distribution is another set of package quirks to support.
Troubleshooting and FAQ
Troubleshooting
- An Alpine device will not enrol. Alpine is not supported, because its APK package format is not one the agent ships for. There is no workaround short of changing distribution.
- The device enrolled but reports no encryption. The disk was not encrypted when the operating system was installed. Encryption status can be reported and recovery keys escrowed, but encryption itself cannot be applied afterwards.
- A control is not applying. Controls are not supported on Linux. Use a script instead.
FAQ
-
Can we encrypt a Linux disk after enrolment?
No. Linux has no mechanism to encrypt a disk after installation — the machine has to be rebuilt.
-
Is there a certificate to set up, like on Apple?
No. Linux works out of the box.
-
Can we escrow Linux recovery keys?
Yes. The agent handles escrow so you keep access if a device locks.