Linux Profiles

Profiles are the primary means to manage devices. Configure profiles so that your Linux devices remain secure and configured to your preferred settings.

Think of profiles as the settings and rules that, when combined with compliance policies, help you enforce corporate rules and procedures. Profiles contain the settings, configurations, and restrictions that you want to enforce on devices.

A profile consists of the general profile settings and a specific payload. Profiles work best when they contain only a single payload.

Configure Profiles

In the Workspace ONE UEM console, follow the same navigation path for each profile. The Preview section shows Total Assigned Devices in a list view. The added profiles are on the Summary tab.

1. Navigate to Resources > Profiles & Resources > Profiles > Add > Add Profile > Linux.
2. Enter the Name. Set the name for your profile. Add a description that would be easily recognizable to you.
3. Click Add for the profile and configure the settings. If necessary, use the drop-down and preview profile settings before adding.
4. To configure the general Assignment and Deployment profile settings, click Next.
5. Configure the following settings:

Setting	Description
Smart Group	Enables an admin to select those groups to include in the assignment of the device profile.
Allow Exclusion	Enable to display Exclude Group. With this, you can select the groups to exclude from the assignment of the device profile.
Assignment Type	Determines how the profile is deployed to devices: Auto – The profile is deployed to all devices. Optional – The profile can be deployed to individual devices at the administrator’s discretion. Compliance – (Not currently supported for Linux) The profile is applied to the device by the Compliance Engine when the user fails to take corrective action toward making their device compliant. Will be supported in a future version.
Allow Removal	Select the assignment removal options. Always With Authorization Never
Managed By	The organization group with administrative access to the profile.
Schedule Install Time	Turn on to configure time schedule settings. Turn on Scheduling and install only during selected time periods. Specify a configured time schedule in which devices receive the profile only within that timeframe.

6. Click Save & Publish.

Wi-Fi Profile for Linux

Configuring a Wi-Fi profile lets devices connect to corporate networks, even if they are hidden, encrypted or password protected.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the General Settings for the profile as appropriate.

3. Select the Wi-Fi payload.

4. Configure Wi-Fi settings, including:

   Setting	Description
   Service Set Identifier	Provide the name of the network.
   Hidden Network	Indicate if the Wi-Fi network is hidden.
   Set as Active Network	Indicate if the device connects to the network with no end-user interaction.
   Security Type	Specify the access protocol used and certificate are requirements. Required fields depend on the selected security type. If None or WPA/WPA 2 are selected, then the Password field displays. If WPA/WPA 2 Enterprise is selected, then the Protocols and Authentication fields display. Protocols - Use Two Factor Authentication SFA Type Authentication - Identity Anonymous Identity Username Password Identity Certificate Root Certificate
   Password	To connect to the network, provide the required credentials for the device. The password field displays when WPA/WPA 2 is selected from the Security Type field.
   Proxy Type	To configure the Wi-Fi proxy settings, enable Proxy Type.
   Proxy Server	Enter the hostname or the IP address for the proxy server.
   Proxy Server Port	Enter the port for the proxy server.
   Exclusion List	To exclude from the proxy, enter the hostnames. Hostnames entered here are not routed through the proxy. Use the * as a wildcard for the domain. For example: *.omnissa.com or *omnissa.com.

5. Select Save and Publish.

Credential Profile for Linux

To protect corporate assets and for greater security, implement digital certificates. To implement digital certificates you must define a certificate authority, then configure a Credentials payload alongside your Wi-Fi payload. Each payload has settings for associating the certificate authority defined in the Credentials payload.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.
2. Configure the profile's General settings as appropriate.
3. Select the Credentials profile.
4. Select Configure.
5. To select either Upload or Defined Certificate Authority for the Credential Source, use the drop-down menu. The remaining profile options are source-dependent. If you select Upload, then you must enter a Credential Name and upload a new certificate. If you select Defined Certificate Authority, then you must choose a predefined Certificate Authority and a template.
6. Select Save and Publish.

Notes:

The tools, certutil (for cer files) and pk12util (for pfx files) are used to install certificates to each user’s browser database/profile. By default, these certificates are accessible to all users in Firefox or Chromium-based browsers. During the certificate profile installation, Intelligent Hub first applies the certificate to the default certificate location. Then, the browser sqlite database updates with the same certificate.

All pfx/cer files are included and are a part of the browser. During installation all user certificate databases are included in the installed profile because each user has their own certificate database in the browser, and the Intelligent Hub is not associated with the local user.

Also, during uninstall of a certificate profile (or certificate revocation), the installed certificate is removed from the default certificate locations and from the browser certificate database.

Private keys are encrypted by default in the Intelligent Hub. With Intelligent Hub 24.03, you can disable this encryption with a device side configuration. To use Workspace UEM to push this configuration to enrolled devices, we recommend utilizing a custom configuration profile (puppet manifest). The following is an example manifest that can be used:

$file_path = '/opt/omnissa/ws1-hub/config/CertConfig.yml'

# Ensure the file exists

file { $file_path:

ensure => present,

}

exec { 'update_encrypt_field':

command => "sed -i 's/encryptPrivateKey: true/encryptPrivateKey: false/g' $file_path",

provider => shell,

}

Proxies Profile for Linux

Proxy settings are configured to ensure that all the HTTP and HTTPS network traffic is passed only through it. Data security is ensured because all personal and corporate data will be filtered through the Proxy Settings profile.

Important

• The proxies profile requires devices to be restarted before it will be enabled successfully on an assigned device.

• Only devices running Workspace ONE Intelligent Hub for Linux version 24.08 (or greater) support Proxies Profile.

• For GUI apps to use the proxy configuration pushed from Workspace ONE, the endpoint needs to be running the GNOME Desktop environment. Command Line apps will still respect the proxy configuration if GNOME is not installed, but not GUI apps.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles.
2. Click Add.
3. Click Linux.
4. Configure the following settings for Nework Proxyy Scope:

Setting	Description
Web Proxy (HTTP)	Enable this setting and enter the Host Name. Optional: Enter the Port used to communicate with the proxy. This setting the device to use this proxy for any HTTP traffic.
Secure Web Proxy (HTTPS)	Enable this setting and enter the Host Name. Optional: Enter the Port used to communicate with the proxy. This setting the device to use this proxy for any HTTPS traffic.
FTP Proxy	Enable this setting and enter the Host Name. Optional: Enter the Port used to communicate with the proxy. This setting tells the device to use this proxy for any FTP traffic.
SOCKS Proxy	Eenable this setting and enter the Host Name. Optional: Enter the Port used to communicate with the proxy. This proxy establishes a TCP traffic connection to a device.

5. Enter Proxy Exceptions as needed.
6. Configure the following setting for Global HTTP Proxy scope:

Setting	Description
Gateway Platform	Select Manual or Auto as the proxy type to configure with this proxy.
Auto	Enter the URL of the proxy PAC file. Use the format: file:///path/to/proxy.pac
Manual
- Proxy Server	Enter the URL of the proxy server.
- Proxy Server Port	Enter the port used to communicate with the proxy (the default is port 8080).
- Proxy Username & Password	Enter the username and password to connect to the proxy server, if required.

Passcode Profile for Linux

Device passcode profiles secure Linux devices and their content. Choose strict options for high-profile employees, and more flexible options for other devices or for those part of a BYOD program.

Important

• The most restrictive policy is enforced if multiple profiles enforce separate policies on a single device. If your password policy is being managed by your directory for network users logging into the devices, then Workspace ONE UEM does not recommend a passcode policy.

• Most of these settings can be overcome by a local user utilizing sudo access on the device. If preventing this is required, then consider assigning a Restriction Profile that includes Block sudo access.

• Only devices running Workspace ONE Intelligent Hub for Linux version 24.10 (or later) support passcode profiles.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles.
2. To enforce a Passcode policy on your devices, choose from the following settings:

Setting	Description
Require passcode on device	Enable mandatory passcode protection.
Require password change at next authentication	When enabled a password reset will occur the next time the user tries to authenticate. If this key is set in a device profile, then the setting takes effect for all users. Admin authentications may fail until the admin user password is also reset.
Require Alphanumeric Value	Restrict the end user from using spaces or non-alphanumeric characters in their passcode.
Minimum Passcode Length	Select the minimum number of characters required in the passcode.
Minimum Number of Complex Characters	The minimum number of complex characters that a passcode must contain. A complex character is a character other than a number or a letter, such as & % $ #.
Maximum Passcode Age (days)	Select the maximum number of days the passcode can be active.
Auto-lock (min)	Select the amount of time (in minutes) the device can be idle before the screen is locked automatically.
Maximum Grace Period (days)	The maximum grace period, in days, allowing an expired password to be used for login.
Passcode History	Enter the number of passwords to store to prevent end users from recycling passwords.
Maximum Number of Failed Attempts	Select the number of failed attempts allowed. If the end user enters an incorrect passcode for the set number of times, the device locks.

3. End users are only prompted to change their password if the Workspace ONE Intelligent Hub is installed and the Enforce Passcode box is selected in the Workspace ONE Intelligent Hub settings in the Workspace ONE UEM console.

Restriction Profile for Linux

Restrictions profiles limit how employees can use their Linux devices and give administrators the ability to lock down the native functionality of these devices and can be used as a method of enforcing data-loss prevention.

Important

• Certain options on the Restrictions Profile page have an icon displayed on the right, which indicate the GNOME Desktop Environment is required to enforce that restriction. Although these restrictions can be assigned to devices not running GNOME, they will not be successfully applied.

• Most of these restrictions can be overcome by a local user utilizing sudo access on the device. If preventing this is required, then consider assigning a Restriction Profile that includes Block sudo access.

• Only devices running Workspace ONE Intelligent Hub for Linux version 24.10 (or later) support passcode profiles.

Restriction setting options include the following:

Setting	Description
Block use of built-in camera	If device has a camera installed and recognized by the OS, this restriction will block the user’s ability to activate it.
Block use of removable media (USB)	Blocks user’s ability to mount USB mass storage.
Block bluetooth config changes	Blocks user’s ability to make changes to the device Bluetooth connections.
Block uninstall/unenroll of hub	Blocks the user from being able to uninstall or unenroll the Workspace ONE Intelligent Hub for Linux on their device.
Block sudo access	Blocks user from gaining superuser do (sudo) access on the device.
Disable SSH	Disables Secure Shell (SSH) on the device.
Block screen capture	Blocks GNOME’s inherent screen capture functionality
Lock desktop picture	Utilizes GNOME to provide admin control over the desktop image.
Desktop picture path	Available when lock desktop picture is selected. This is the path (either remote or local) of the file you would like to use for the desktop image. If left blank, then the existing desktop image is used.
Restrict Folder/File Access	Enables the admin to declare files or folders that users cannot access on the device.
Add folder/file paths	Available when Restrict Folder/File Access is selected. Add up to ten folder/file paths that you would like to prevent the user from accessing.

Custom Configuration Profile for Linux

The Custom Configuration payload can be used to configure your Linux devices with features that the Workspace ONE UEM console does not currently support through its native payloads. This payload provides three options for this configuration: open source Puppet, Bash or Python 3. For Puppet,only the free Puppet agent is installed on the device to support this functionality.

Note: Currently, when a device is enterprise wiped or unenrolled, these configuration changes are not removed from the device unless a removal script is defined in the profile.

For more information on Puppet, including sample manifests, see: http://forge.puppet.com.

To validate the syntax of your puppet code, see: https://validate.puppet.com.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the General settings for the profile as appropriate.

3. Select the Custom Configuration profile.

4. Select Configure.

5. Configure the payload including:

   Setting	Description
   Name	Populate a name that distinguishes this payload from others.
   Language	Select the Language you wish to use for your configuration.
   Enforce Script	If selected, UEM will reapply the script at the data transmit interval configured in Settings > Device & Users > Linux > Intelligent Hub Settings. If deselected, then the script executes once when the profile initially pushes to the device.
   Add Forge Module Dependency	This option is only visible if Puppet is selected as the language above. If the puppet script has a required dependency, then it can be included here. For example, “puppetlabs/stdlib”.
   Installation Script	Copy and paste the content of your script here. This script implements on the device assigned in the general tab.
   Removal Script	This script executes on the device when this profile is unassigned from a device. If this script is left blank, when a custom configuration profile is removed from a device, the action dictated by the Installation Script remains on the device.

6. Select Save and Publish.

Custom Configuration Examples

Puppet Manifest Examples

Learn and explore Puppet if you are interested in creating custom configuration profiles. To get started, the following are examples of Puppet code that can be used on standard Ubuntu. They do not work on other distributions of Linux.

Install Chrome Browser on Ubuntu:

• Dependency: None
• Installation Manifest:

file { 'google-chrome-stable_current_amd64.deb': source => 'https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb', path => '/tmp/google-chrome-stable_current_amd64.deb', ensure => present, } exec { 'install-chrome': command => '/usr/bin/dpkg -i /tmp/google-chrome-stable_current_amd64.deb', logoutput => true, }

• Removal Manifest:

package { 'google-chrome-stable': ensure => 'absent', }

Deactivating SSH Server on Ubuntu:

• Dependency: puppetlabs-stdlib

• Installation Manifest:

service { 'ssh': name => 'sshd', ensure => false, enable => false,}

Removal Manifest:

service { 'ssh': name => 'sshd', ensure => true, enable => true,}

Date and Time Profile for Linux

Configure the date and time sync settings to ensure devices display the correct time across different regions.

Procedure

1. Navigate to Resources > Profiles & Baselines > Profiles > Add > Add Profile > Linux.

2. Configure the General settings for the profile as appropriate.

3. Select the Custom Configuration profile.

4. Select Configure.

5. Configure the Date/Time settings including:

   Setting	Description
   Date/Time	Set which data source you would like your device to use to pull the date and time. Select from the options, Automatic or SNTP Server. Automatic: Sets the date and time based on native device settings. SNTP Server: Enter the server address. For example, you could enter time.nist.gov for your use. For SNTP Server, configure the additional settings: Turn on Periodic Sync – Turn on to set the device to sync date/time periodically (in days). Set Time Zone – Specify the time zone from the available options.
   Allow User to change date/time	Turn on to allow users to manually change the date/time from the device.

6. Select Save and Publish.