Linux Profiles

Profiles are the primary means to manage devices. Configure profiles so that your Linux devices remain secure and configured to your preferred settings.

Think of profiles as the settings and rules that, when combined with compliance policies, help you enforce corporate rules and procedures. Profiles contain the settings, configurations, and restrictions that you want to enforce on devices.

A profile consists of the general profile settings and a specific payload. Profiles work best when they contain only a single payload.

Configure Profiles

In the Workspace ONE UEM console, follow the same navigation path for each profile. The Preview section shows Total Assigned Devices in a list view. The added profiles are on the Summary tab.

1. Navigate to Resources > Profiles & Resources > Profiles > Add > Add Profile > Linux.
2. Enter the Name. Set the name for your profile. Add a description that would be easily recognizable to you.
3. Click Add for the profile and configure the settings. If necessary, use the drop-down and preview profile settings before adding.
4. To configure the general Assignment and Deployment profile settings, click Next.
5. Configure the following settings:

6. Click Save & Publish.

Wi-Fi Profile for Linux

Configuring a Wi-Fi profile lets devices connect to corporate networks, even if they are hidden, encrypted or password protected.

At minimum:

If a device does not meet these requirements, or the access point does not support WPA3, the connection fails rather than silently falling back to WPA2.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.
2. Configure the General Settings for the profile as appropriate.
3. Select the Wi-Fi payload.
4. Configure Wi-Fi settings, including:

5. Select Save and Publish.

Note

• Existing WPA/WPA2 and WPA/WPA2 Enterprise Wi-Fi profiles continue to work unchanged; the new WPA3 security types are additive.
• Transition modes (WPA2/WPA3 Personal and WPA2/WPA3 Enterprise) are intended for networks that must support a mix of WPA2-only and WPA3-capable devices during migration. Once all devices and the access point support WPA3, moving to the non-transition WPA3 option is recommended for the stronger security guarantees (mandatory PMF).
• WPA3 Suite-B 192-bit only supports EAP-TLS (certificate-based) authentication; PEAP and TTLS are not available for this security type.

Credentials and SCEP Profile for Linux

To protect corporate assets and for greater security, implement digital certificates. To implement digital certificates you must define a certificate authority, then configure a Credentials or SCEP payload alongside your Wi-Fi payload. Each payload has settings for associating the certificate authority defined in the Credentials or SCEP payload.

What is the difference between the Credentials and SCEP payloads?

Credential Profile for Linux

To protect corporate assets and for greater security, implement digital certificates. To implement digital certificates you must define a certificate authority, then configure a Credentials payload alongside your Wi-Fi payload. Each payload has settings for associating the certificate authority defined in the Credentials payload.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.
2. Configure the profile's General settings as appropriate.
3. Select the Credentials profile.
4. Select Configure.
5. To select either Upload or Defined Certificate Authority for the Credential Source, use the drop-down menu. The remaining profile options are source-dependent. If you select Upload, then you must enter a Credential Name and upload a new certificate. If you select Defined Certificate Authority, then you must choose a predefined Certificate Authority and a template.
6. Select Save and Publish.

Note:

The tools, certutil (for cer files) and pk12util (for pfx files) are used to install certificates to each user's browser database/profile. By default, these certificates are accessible to all users in Firefox or Chromium-based browsers. During the certificate profile installation, Intelligent Hub first applies the certificate to the default certificate location. Then, the browser sqlite database updates with the same certificate.

All pfx/cer files are included and are a part of the browser. During installation all user certificate databases are included in the installed profile because each user has their own certificate database in the browser, and the Intelligent Hub is not associated with the local user.

Also, during uninstall of a certificate profile (or certificate revocation), the installed certificate is removed from the default certificate locations and from the browser certificate database.

Private keys are encrypted by default in the Intelligent Hub. With Intelligent Hub 24.03, you can disable this encryption with a device side configuration. To use Workspace ONE UEM to push this configuration to enrolled devices, we recommend utilizing a custom configuration profile (puppet manifest). The following is an example manifest that can be used:

$file_path = '/opt/omnissa/ws1-hub/config/CertConfig.yml'

# Ensure the file exists
file { $file_path:
ensure => present,
}

exec { 'update_encrypt_field':
command => "sed -i 's/encryptPrivateKey: true/encryptPrivateKey: false/g' $file_path",
provider => shell,
}

SCEP Profile for Linux

Use the SCEP profile so the Intelligent Hub generates its private key on-device and requests a certificate directly from your SCEP-capable certificate authority, rather than having Workspace ONE UEM generate the key pair on the device's behalf.

Important

SCEP profiles for Linux require Workspace ONE Intelligent Hub for Linux version 26.06 or later.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.
2. Configure the profile's General settings as appropriate.
3. Select the SCEP profile.
4. Select Configure.
5. Use the drop-down menu to select either Defined Certificate Authority or AirWatch CA for the Certificate Source. Then choose the predefined Certificate Authority and template.
6. Select Save and Publish.

Note:

• If the SCEP profile is removed from a device, Workspace ONE UEM revokes the certificate where the Certificate Authority integration supports revocation.
• Certificates are auto-renewed as they approach expiration: For AirWatch CA-issued certificates this always happens automatically; for Third-party CA-issued certificates this happens if the administrator has enabled auto-renewal in the Certificate Authority configuration.
• As with the Credentials profile, the private key generated on-device is encrypted by the Intelligent Hub.

Proxies Profile for Linux

Proxy settings are configured to ensure that all the HTTP and HTTPS network traffic is passed only through it. Data security is ensured because all personal and corporate data will be filtered through the Proxy Settings profile.

Important

• The proxies profile requires devices to be restarted before it will be enabled successfully on an assigned device.

• Only devices running Workspace ONE Intelligent Hub for Linux version 24.08 (or greater) support Proxies Profile.

• For GUI apps to use the proxy configuration pushed from Workspace ONE, the endpoint needs to be running the GNOME Desktop environment. Command Line apps will still respect the proxy configuration if GNOME is not installed, but not GUI apps.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles.
2. Click Add.
3. Click Linux.
4. Configure the following settings for Nework Proxy Scope:

5. Enter Proxy Exceptions as needed.
6. Configure the following setting for Global HTTP Proxy scope:

Passcode Profile for Linux

Device passcode profiles secure Linux devices and their content. Choose strict options for high-profile employees, and more flexible options for other devices or for those part of a BYOD program.

Important

• The most restrictive policy is enforced if multiple profiles enforce separate policies on a single device. If your password policy is being managed by your directory for network users logging into the devices, then Workspace ONE UEM does not recommend a passcode policy.

• Most of these settings can be overcome by a local user utilizing sudo access on the device. If preventing this is required, then consider assigning a Restriction Profile that includes Block sudo access.

• Only devices running Workspace ONE Intelligent Hub for Linux version 24.10 (or later) support passcode profiles.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles.
2. To enforce a Passcode policy on your devices, choose from the following settings:

3. End users are only prompted to change their password if the Workspace ONE Intelligent Hub is installed and the Enforce Passcode box is selected in the Workspace ONE Intelligent Hub settings in the Workspace ONE UEM console.

Restriction Profile for Linux

Restrictions profiles limit how employees can use their Linux devices and give administrators the ability to lock down the native functionality of these devices and can be used as a method of enforcing data-loss prevention.

Important

• Certain options on the Restrictions Profile page have an icon displayed on the right, which indicate the GNOME Desktop Environment is required to enforce that restriction. Although these restrictions can be assigned to devices not running GNOME, they will not be successfully applied.

• Most of these restrictions can be overcome by a local user utilizing sudo access on the device. If preventing this is required, then consider assigning a Restriction Profile that includes Block sudo access.

• Only devices running Workspace ONE Intelligent Hub for Linux version 24.10 (or later) support passcode profiles.

Restriction setting options include the following:

Custom Configuration Profile for Linux

The Custom Configuration payload can be used to configure your Linux devices with features that the Workspace ONE UEM console does not currently support through its native payloads. This payload provides four options for this configuration: open source Puppet, Bash, Python 3 or Ansible. For Puppet,only the free Puppet agent is installed on the device to support this functionality. Use Ansible to apply configuration logic using playbooks that can include tasks, roles, and collections. Ansible roles let you organize reusable sets of tasks, templates, handlers, and variables into structured components, while collections serve as packaged bundles of Ansible content—such as roles, modules, plugins, and playbooks—providing a standardized way to distribute and reuse automation at scale.

Note: Currently, when a device is enterprise wiped or unenrolled, these configuration changes are not removed from the device unless a removal script is defined in the profile.

For more information on Puppet, including sample manifests, see: http://forge.puppet.com.

To validate the syntax of your puppet code, see: https://validate.puppet.com.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the General settings for the profile as appropriate.

3. Select the Custom Configuration profile.

4. Select Configure.

5. Configure the payload including:

   Setting	Description
   Name	Populate a name that distinguishes this payload from others.
   Language	Select the Language you wish to use for your configuration.
   Enforce Script	If selected, UEM will reapply the script at the data transmit interval configured in Settings > Device & Users > Linux > Intelligent Hub Settings. If deselected, then the script executes once when the profile initially pushes to the device.
   Add Collections	This option is only visible if Ansible is selected as the language above. Ansible roles let you organize reusable sets of tasks, templates, handlers, and variables into structured components. For multiple collections, use spaces to separate them.
   Add Roles	This option is only visible if Ansible is selected as the language above. Ansible collections act as packaged bundles of content—such as roles, modules, plugins, and playbooks—providing a standardized way to distribute and reuse automation on a large scale. For multiple Roles, use spaces separate them.
   Add Forge Module Dependency	This option is only visible if Puppet is selected as the language above. If the puppet script has a required dependency, then it can be included here. For example, “puppetlabs/stdlib”.
   Installation Script	Copy and paste the content of your script here. This script implements on the device assigned in the general tab.
   Removal Script	This script executes on the device when this profile is unassigned from a device. If this script is left blank, when a custom configuration profile is removed from a device, the action dictated by the Installation Script remains on the device.

6. Select Save and Publish.

Custom Configuration Examples

Puppet Manifest Examples

Learn and explore Puppet if you are interested in creating custom configuration profiles. To get started, the following are examples of Puppet code that can be used on standard Ubuntu. They do not work on other distributions of Linux.

Install Chrome Browser on Ubuntu:

• Dependency: None
• Installation Manifest:

file { 'google-chrome-stable_current_amd64.deb': source => 'https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb', path => '/tmp/google-chrome-stable_current_amd64.deb', ensure => present, } exec { 'install-chrome': command => '/usr/bin/dpkg -i /tmp/google-chrome-stable_current_amd64.deb', logoutput => true, }

• Removal Manifest:

package { 'google-chrome-stable': ensure => 'absent', }

Deactivating SSH Server on Ubuntu:

• Dependency: puppetlabs-stdlib

• Installation Manifest:

service { 'ssh': name => 'sshd', ensure => false, enable => false,}

Removal Manifest:

service { 'ssh': name => 'sshd', ensure => true, enable => true,}

Date and Time Profile for Linux

Configure the date and time sync settings to ensure devices display the correct time across different regions.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the General settings for the profile as appropriate.

3. Select the Custom Configuration profile.

4. Select Configure.

5. Configure the Date/Time settings including:

   Setting	Description
   Date/Time	Set which data source you would like your device to use to pull the date and time. Select from the options, Automatic or SNTP Server. Automatic: Sets the date and time based on native device settings. SNTP Server: Enter the server address. For example, you could enter time.nist.gov for your use. For SNTP Server, configure the additional settings: Turn on Periodic Sync – Turn on to set the device to sync date/time periodically (in days). Set Time Zone – Specify the time zone from the available options.
   Allow User to change date/time	Turn on to allow users to manually change the date/time from the device.

6. Select Save and Publish.

Firewall Profile for Linux

Configure a firewall profile with the Omnissa Workspace ONE Intelligent Hub v25.06+ for Linux to filter unauthorized connections within your enterprise network to or from Linux based devices. Using the Workspace ONE Intelligent Hub, you can easily configure the native firewall on your managed Linux devices to protect them against probing requests. 

Note: For executing the configuration device side, we prioritize using firewalld on the endpoint. If firewalld is not present, we will use nftables. If nftables is not present, we will use iptables. This ensures backwards compatibility to older systems that may not have firewalld or nftables enabled. 

Firewall settings can be configured in layered rules. To simplify the definition process, rules configured on the left side of the profile window will be pushed and enforced device side in the order they are displayed. For example, you can configure a rule that allows a specific incoming service over one port in the first rule, but then block all incoming traffic in the second rule. The device would allow the first, but then block everything else. 

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the profile’s General Settings as appropriate.

3. Select the Firewall profile.

4. Configure the firewall settings, by first choosing either Basic or Advanced.

   Basic Settings

Advanced Settings

5. To create additional rules, click the Add button on the left side of the profile configuration screen, if required.
6. Select Save & Publish. 

Device Update Profile for Linux

The Device Update Profile for Linux based devices provides an easy mechanism for administrators to ensure that repo-based software updates are configured on their managed devices. Workspace ONE UEM does this through the standard package managers on the two most common Linux Distribution families, Red Hat (dnf) and Ubuntu (apt). Explore the rest of this documentation to learn more about the different ways you can configure device updates to suit your requirements.

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.
2. Configure the profile's General settings.
3. Select the Device Update payload and click Add.

For Debian, Ubuntu and all related distributions, select Debian/Ubuntu from the OS Family drop down, then configure the following settings.

For Red Hat, CentOS and all related distributions, select Red Hat/CentOS/Fedora/Rocky from the OS Family drop-down. Then configure the following settings.

For SUSE and all related distributions, select openSUSE/SLED/SLES from the OS Family drop-down. Then configure the following settings.

Note: This specific functionality is for SUSE devices that use YaST as the native package manager. This is included in SUSE 15 and below. SUSE 16 is not currently supported with this specific feature of the product.

Browser Settings Profile for Linux

The Browser Settings profile helps you to manage settings for both Google’s Chrome-based browsers and Mozilla’s Firefox Browser. Although there are similarities in functionality, there are also some notable differences between what configurations are available for these browsers on Linux-based devices. The next sections will describe all the configuration options available for each browser.

Chrome Browser Settings Matrix

Chrome is Google’s proprietary web browser based on the open-source Chromium project. The configurations in the Chrome browser settings will work on both Chrome and Chromium browsers. You can push this profile in conjunction with a separate VPN or Credentials Wi-Fi payload to ensure end users can authenticate and log in to your internal sites and systems.

This table outlines the configurable options within the Chrome browser profile:

Firefox Browser Settings Matrix

Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. Firefox Browser Settings profile helps you to manage settings for the Firefox Browser application on Linux based devices. You can push this profile in conjunction with a separate VPN or Credentials or Wi-Fi payload to ensure end users can authenticate and log in to your internal sites and systems.

This table outlines the configurable settings in the Firefox browser profile:

For more information, see Mozilla Firefox policy-templates.