Hideez Authentication Service (EN)
  • Hideez Authentication Service for Enterprises
    • Release notes
    • Key features of the Hideez Authentication Service in 5 minutes
  • Quick Start Guides
    • Hideez Authenticator Mobile app guide
    • Hideez Key guide
    • Passkey guide
    • FIDO Security Key guide
      • Activation FIDO key and setting PIN code
    • Quick Start Guide for subscriptions
      • Hideez Security Key
      • Hideez Authenticator App
      • Passkeys
    • Guide for Hideez Enterprise Server on Cloud
      • Passkeys
      • Mobile app
      • Hideez Key
  • Use cases
    • Hideez Authenticator Mobile App
      • Passwordless PC login
      • Password-based PC login
      • SSO login to Webservises (FIDO2) via mobile app
        • Using Hideez Authenticator as your passwordless authentication method for SSO
      • Using Hideez Authenticator as your two-factor authentication method for SSO
      • OTP generation by Hideez Authenticator App for 2FA
      • RDP login by Hideez Authenticator App
      • Remote PC lock
    • Hideez Key
      • Proximity Lock
      • Proximity Unlock
        • Unlock PC by Hideez Dongle Touch (Tap-and-Go)
      • Proximity settings (guide for admin)
      • Automatic RDP Launch and Logon
      • Password manager and OTP generator
      • OTP manager for two-factor authentication
    • FIDO Security Key
      • SSO login to Web Servises via Hardware Key (FIDO2)
      • Passwordless PC Login to Entra ID (Azure AD).
      • Using Hideez Key as U2F security key for your two-factor authentication
      • Other vendors' hardware keys
    • Passkey
      • SSO login to Web Services (FIDO2) via Passkey and Hideez Server as Identity Provider
    • Emergency blocking of all computers
    • Employee's account disabling
  • Hideez Enterprise Server
    • Hideez Enterprise Server
    • Glossary
    • Hideez Server Architecture
    • Deployment
      • Database installation
        • MySQL on Windows
        • MySQL on Linux
        • Microsoft SQL Server on Windows
        • Microsoft SQL Server on Linux
      • HES deployment
        • Windows
        • Linux
        • Docker
        • Deployment without Internet access
        • Troubleshooting
      • HES update
        • Windows
        • Linux
        • Docker
      • Publishing on-premises HES for remote users
    • Administration
      • How to change the password for an administrator account?
      • How to recover a forgotten admin password?
      • Adding an admin account
      • Deleting an admin account
      • How to enable two-factor authentication at the Hideez Enterprise Server?
      • Authorization on the HES server via a FIDO key
      • Platform authentication on the HES server
      • Connecting Linux server to Active Directory
      • Setting Hideez Server parameters
      • Configuring DNS server
      • Setting up a Proxy for Mobile App Access to HES
      • How to create and set Hideez Key Access Profiles
      • How to manage companies and departments?
      • How to manage Positions?
      • Enable load balancing
      • Data Protection
    • Dashboard
      • Information about the server
      • Information about employees
      • Information about devices
      • Workstations Information
    • Employees
      • How to add an Employee?
      • Employees management
      • Employee management with Active Directory
    • Workstations
      • How to add and approve Workstations?
      • Workstations management
      • Workstation Profiles
      • Use Proximity Unlock Workstations
    • Hardware Vaults
      • How to add Hideez Key into the Server
      • Assign a key to the user
      • Remove the key from the Employee
      • Set a profile for a Hardware Vault
      • How to see an RFID code on the Employee key?
    • Accounts
      • Creating personal employee accounts
      • Creating shared employee accounts
      • Personal account management
      • Shared account management
      • Accounts backup and restore
      • How to work with the account template?
    • Keys Management
      • Keys Statuses
      • Transition to Reserved status
      • Keys Activation mechanism
      • Cancel issuance of Hideez Key (Reserved -> Ready)
      • Transition to Suspended status
      • Transition to Locked status
      • Transition to Deactivated status
      • Transition to Compromised status
      • Removing the Locked status
      • Wipe procedure
      • Delete key from Hideez Server
    • Audit
      • Workstation events
      • Workstation Sessions
      • Summaries
    • Single Sign On settings
      • How to get employee licenses
      • Enabling Single Sign-On (SSO) for Employees
      • User settings
    • Configuring SAML Protocol
    • Configuration OIDC (OpenID Connect)
  • Hideez Server Integration
    • Microsoft Entra ID
      • Import and Sync Users from Entra ID
        • Administrator-Initiated Manual Password Changes
        • User-Initiated Password Changes
    • Active Directory (On-Premises)
      • Import and Sync Users from Active Directory (On-Premises)
        • Administrator-Initiated Manual Password Changes
        • User-Initiated Password Changes
        • Active Directory (On-Premises) Access and Rights Delegation
    • SAML integration
      • ASA AnyConnect VPN
      • Citrix services
      • Fortinet services
      • GitHub Enterprise
      • GitLab on premises
      • Google Workspace
      • Microsoft Exchange for Authentication via SAML
        • ADFS Installation
      • Okta
      • Oracle Business Intelligence Enterprise Edition (OBIEE)
        • Step 1: Configure the Identity Provider — Hideez Enterprise Server (HES)
        • Step 2: Configure the Service Provider — Oracle Access Manager (OAM)
        • Step 3: Register Oracle Access Manager (OAM) in Hideez Enterprise Server (HES)
        • Step 4: Configure Directory Services and Web Infrastructure
        • Step 5: Configure Oracle Business Intelligence Enterprise Edition (OBIEE) for Single Sign-On (SSO)
    • Open ID Connect integration
      • Hideez Server as an External Authentication Method for Microsoft Entra ID via OIDC
      • OKTA (OIdC)
    • WS-Federation integration
      • Configure Exchange Outlook Web Application and Exchange Admin Center
  • Hideez Client App
    • Hideez Client deployment
      • Installation of the Hideez Client Application
      • Deploying Hideez Client MSI via GPO (Group Policy Object)
      • Configuration app
      • Uninstall Hideez Client app
      • Uninstalling via GPO
      • Upgrade Hideez Client
      • Downgrade Hideez Client
    • Application interface
      • General Settings
      • Logon settings
      • Aditional settings
      • Configuring hotkeys
    • Account management
      • Account creation
      • Editing an Existing Account
      • Deleting your account
    • Shortcuts
    • Remote Vault connection
    • Mobile Authenticator
  • Hideez Authenticator App
    • Quick overview
    • Admin guide
      • Setup for PC login scenario
        • Passwordless PC Login Setup
          • Configuring an Active Directory Certification Authority
          • Hideez Enterprise Server setup for passwordless login
          • Setting Up Passwordless Workstation Login with Entra ID
        • Password-based PC login Setup
      • Setup for SSO login scenario
    • User guide
      • Mobile App Primary Setup
      • App enrollment on Hideez Server
        • Enroll the application on Hideez Server for SSO
          • SSO enrollment (admin account)
          • SSO enrollment (user account)
        • PC Authorization Enrollment
          • Enrollment for Passwordless PC Authorization
            • Passwordless account re-enrollment
          • Enrollment for Password-based PC Authorization
            • Account roaming
      • Login with Hideez Authenticator
        • SSO login
        • PC login
          • Offline passwordless login
          • Login to the remote PC via RDP
      • PC lock
      • OTP generation
      • Software key disabling
        • PC logon disabling
        • SSO logon disabling
      • Service operations
  • Hideez Key (Enterprise Edition)
    • Hideez Key (Enterprise Edition)
    • Technical Specifications
      • Technical specifications Hideez Key 3
      • Technical specifications Hideez Key 4
    • Principles of operation
    • Device Layout
    • Battery maintenance
    • Hideez Key modes
    • How to update the Hideez Key (Enterprise) firmware
    • How to enter credentials with the Hideez Key
    • How to unlock PC
    • Key for Physical doors
  • Product Updates
    • Product updates
    • Hideez Enterprise Server updates
    • Hideez Key firmware updates
    • Hideez Client updates
    • Hideez Authenticator updates
  • API
    • Hideez Enterprise Server web API
  • FAQ
    • How-to's
      • How to add an Employee?
      • How to add personal user account on HES?
      • How to assign Hideez Key to a user?
      • How to activate Hideez Key?
      • How to unlock Hideez Key on HES?
      • How to unlock PC with Hideez Key?
      • How to setup proximity PC unlock?
      • How to use Hideez Key on remote PC?
      • How to enroll the Hideez Authentication app on HES for SSO?
      • How to login on HES with Hideez Authenticator?
      • How to enroll the Hideez Authentication app for PC login?
      • How to login to PC with Hideez Authenticator?
      • Enable QR Code Display for Hideez Authenticator on the Lock Screen of a Windows Remote Workstation
    • Hideez Client App
      • What do I do if I see the message "Connection failed. Trying to re-bond device"?
      • What do I do if the connection with the HES server cannot be established?
      • What should I do if the Password Manager menu item is not displayed?
    • Hideez Enterprise Server
      • How to view logs at Hideez Enterprise Server?
    • Setting Up Gmail with HES
    • Hideez Authenticator
      • QR code is not displayed at the credential provider on my PC
      • I have registered successfully but cannot login
      • What do I do if I changed domain and cannot login now
      • Does the Hideez App collect or transmit data from the phone to third parties or services?
    • Hideez Key
      • What physical conditions are dangerous for the Hideez Key?
      • Is the Hideez Key allowed on planes?
      • How to enable FIDO2 passwordless authentication with Microsoft Azure AD for use with Windows 10-11
  • Documentation portal
Powered by GitBook
On this page
  • Before you start
  • 1. Preparation
  • 1.1. System Update
  • 1.2 Disable SELinux (CentOS only)
  • 1.3 Firewall Configuration (optional)
  • 2. Installing Prerequisites
  • 2.1. Installing additional packages
  • 3. Installing the HES server
  • 3.1. Download HES server
  • 3.2. Extracting files and moving to the /opt directory
  • 3.3. Configuring the HES
  • 3.4. Daemonizing of the HES
  • 4. Configuring Reverse Proxy Server
  • 4.1. Install Nginx
  • 4.2. Copying of self-signed certificates for Nginx
  • 4.3. Updating Nginx config
  • 4.4. Restart nginx
  • 4.5. Check that nginx service is installed and started

Was this helpful?

  1. Hideez Enterprise Server
  2. Deployment
  3. HES deployment

Linux

HES deployment - Linux

PreviousWindowsNextDocker

Last updated 9 months ago

Was this helpful?

  • Option 1: CentOS Linux Stream 9

  • Option 2: Ubuntu Server LTS 20.04

  • Option 3: Ubuntu Server LTS 22.04

  • Option 4: Ubuntu Server LTS 24.04

Before you start

  • You need to know how to create and edit text files in Linux. For example, you can use vim editor. Here you can find a quick start guide on .

1. Preparation

1.1. System Update

CentOS

sudo dnf update -y

Ubuntu

sudo apt update
sudo apt upgrade -y  

Reboot system

sudo reboot

1.2 Disable SELinux (CentOS only)

sudo sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
sudo reboot

To verify that SELinux is disabled, you can type:

sudo sestatus
SELinux status:                 disabled

Note: on production servers, usually after installation and verification, you need to re-enable SELinux and configure it accordingly.

1.3 Firewall Configuration (optional)

To access the server from the network, ports 80 and 443 and port 22 (default port for connection via ssh) should be opened:

CentOS:

sudo firewall-cmd --zone=public --permanent --add-port=22/tcp
sudo firewall-cmd --zone=public --permanent --add-port=80/tcp
sudo firewall-cmd --zone=public --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Ubuntu:

sudo ufw allow 22
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable

2. Installing Prerequisites

2.1. Installing additional packages

CentOS stream 9 :

sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm -y
sudo dnf install libgdiplus libicu jq -y
sudo dnf install compat-openssl11 -y

Ubuntu 20.04:

sudo apt install libgdiplus libicu66 jq gss-ntlmssp-dev -y

Ubuntu 22.04:

sudo apt install libgdiplus libicu70 jq gss-ntlmssp-dev -y

Ubuntu 24.04:

sudo apt install libgdiplus libicu74 jq gss-ntlmssp-dev -y

3. Installing the HES server

3.1. Download HES server

cd ~
curl -O https://update.hideez.com/hes/linux_x64_latest.tar.gz

3.2. Extracting files and moving to the /opt directory

tar -xvf linux_x64_latest.tar.gz
sudo mv HES /opt/

3.3. Configuring the HES

Navigate to the '/opt/HES/' directory and run the HES.Wizard application

cd /opt/HES/
sudo ./HES.Wizard

next, follow the setup tips and configure the server

3.4. Daemonizing of the HES

We already prepared the configuration file to start and manage the HES server in the /opt/HES/Deploy directory. You need to copy the file HES.service to the /lib/systemd/system/:

sudo cp /opt/HES/Deploy/HES.service /lib/systemd/system/HES.service

Enabling autostart:

sudo systemctl enable HES.service
sudo systemctl restart HES.service

You can verify that HES server is running with the command:

sudo systemctl status HES

The output of the command should be something like this:

● HES.service - Hideez Enterprise Server
     Loaded: loaded (/usr/lib/systemd/system/HES.service; enabled; vendor preset: disabled)
     Active: active (running) since Wed 2022-12-21 14:15:03 UTC; 8s ago
   Main PID: 929817 (HES.Web)
      Tasks: 18 (limit: 4405)
     Memory: 103.1M
        CPU: 4.817s
     CGroup: /system.slice/HES.service
             └─929817 /opt/HES/HES.Web

4. Configuring Reverse Proxy Server

To access your server from the local network as well as from the Internet, you have to configure a reverse proxy. We will use the Nginx server for this.

4.1. Install Nginx

CentOS 7:

sudo yum install nginx -y
sudo systemctl enable nginx

Ubuntu:

sudo apt install nginx -y

4.2. Copying of self-signed certificates for Nginx

We have prepared a self-signed certificate for nginx that you can use to test running HES. Just copy it to nginx:

sudo mkdir /etc/nginx/certs
sudo cp /opt/HES/Deploy/certs/*   /etc/nginx/certs

Note :

In the production environment, you should take care of acquiring a certificate from a certificate authority. For a self-signed certificate, the browser will alert you that site has security issues.

4.3. Updating Nginx config

We prepared some Nginx configurations for different versions of Linux and placed them in the /opt/HES/Deploy directory. You may just copy the corresponding file or you can review and edit it for your needs.

CentOS 7:

sudo cp /opt/HES/Deploy/CentOS7/nginx.conf /etc/nginx/nginx.conf

Ubuntu 20:

$ sudo cp /opt/HES/Deploy/Ubuntu20/nginx.conf /etc/nginx/nginx.conf
  • remove default nginx site:

sudo rm  /etc/nginx/sites-enabled/default

Ubuntu 22, Ubuntu 24:

sudo cp /opt/HES/Deploy/Ubuntu22/nginx.conf /etc/nginx/nginx.conf
  • remove default nginx site:

sudo rm  /etc/nginx/sites-enabled/default

After copying the file, it is recommended to verify nginx settings:

$ sudo nginx -t

The output should be something like this:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Otherwise, you should carefully review the settings and correct the errors.

4.4. Restart nginx

sudo systemctl restart nginx

4.5. Check that nginx service is installed and started

sudo systemctl status nginx

The output would be something like this:

* nginx.service - The nginx HTTP and reverse proxy server
   Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
   Active: active (running) since Sat 2020-01-25 08:22:56 UTC; 8min ago
  Process: 1702 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
  Process: 1700 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
  Process: 1699 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
 Main PID: 1704 (nginx)
   CGroup: /system.slice/nginx.service
           +-1704 nginx: master process /usr/sbin/nginx
           +-1705 nginx: worker process

you can find an update guide for Linux.

By default, access to the new server: login - password - admin

how to use the Vim editor
Here
admin@server