Skip to content

Installation on Linux (Client Mode)

XplicitTrust can run on Linux systems in two modes:

  • Client Mode: for regular users to access services (like SSH, HTTPS, remote desktop, etc).

  • Asset Mode: services (like SSH, HTTPS, remote desktop, etc) can be remotely accessed from an XplicitTrust client, or from another system running in asset mode.

On this page are the instructions for Client Mode.

Prerequisites

  1. On the firewall:
    Allow TCP port 443 (“HTTPS”) outgoing (usually already enabled).
    If possible, allow UDP port range 51820 - 60000 outgoing for best experience

  2. Your admin has created an account with XplicitTrust.

Installation

The desktop client xtna-desktop is available for amd64 Debian-based distributions with a graphical desktop session. On other architectures, on RPM-based distributions, and on headless or SSH-only systems, install the terminal client instead.

To install the XplicitTrust client, run: 

[ "$EUID" -ne 0 ] && SUDO=/usr/bin/sudo
$SUDO apt update
wget https://dl.xplicittrust.com/xtna-desktop_amd64.deb
$SUDO apt -y install ./xtna-desktop_amd64.deb

Download xtna-desktop_amd64.deb and open it with your distribution's package installer, for example GNOME Software or GDebi.

The installation adds your user to the xtna-users group, which is what allows the application to reach the background service, and starts the application in your current desktop session. You do not need to log out and back in.

From then on the application starts automatically whenever you log in. You can also start it at any time from your application menu, where it appears as XplicitTrust Network Access.

Note

xtna-desktop and xtna-agent contain the same service, updater and xtna-util, and differ only in the desktop application versus the terminal login tool. The two are mutually exclusive: installing one removes the other, so a machine always has exactly one client and exactly one updater.

Configuration

See the xtna-util reference for a complete list of available flags.

1) The application window opens with the login screen.

2) Enter your email address and click Save.

3) Your browser opens so you can authenticate with your identity provider.

1) Go to the Admin Console settings page

2) Create a new "Client Creation Token", configure it, then download and store it in a secure place.

3) Use the token to register clients 

xtna-util -create-client -user <email> -token <token>

Tray Icons

You can see the status of your XplicitTrust Linux client in the system tray:

Running XplicitTrust tunnels are up and running, click on it to see status information.

Authenticating Agent is authenticating itself, tunnels are not up yet.

Offline Agent is offline.

Right-clicking the tray icon offers Show Window and Quit.

Note

Some desktop environments do not display tray icons on their own. On GNOME, this needs the AppIndicator and KStatusNotifierItem Support extension, which Ubuntu enables by default. Without it the application still runs, and you can reopen its window from the application menu.

Terminal Client

On headless or SSH-only systems, on architectures other than amd64, and on RPM-based distributions, install xtna-agent. It runs the same service without the desktop application, and you log in from the command line.

1) We support both Debian-based and RPM-based Linux distributions.

To install the XplicitTrust agent, run: 

[ "$EUID" -ne 0 ] && SUDO=/usr/bin/sudo
$SUDO apt update
ARCH=$(dpkg --print-architecture)
wget https://dl.xplicittrust.com/xtna-agent_${ARCH}.deb
$SUDO apt -y install ./xtna-agent_${ARCH}.deb
$SUDO usermod <USERNAME> -a -G xtna-users

To install the XplicitTrust agent, run: 

[ "$EUID" -ne 0 ] && SUDO=/usr/bin/sudo
$SUDO dnf check-update
wget https://dl.xplicittrust.com/xtna-agent_amd64.rpm
$SUDO dnf install -y ./xtna-agent_amd64.rpm
$SUDO usermod <USERNAME> -a -G xtna-users

2) Login as the linux user provided in USERNAME. If you are already logged in as this user, you need to relogin, for the group membership to be applied.

3) Run with your company email address:

xtna-agent -u <your_email_address>

Headless Authentication

On headless or SSH-only systems where no browser is available, use one of these flags:

  • -url — prints the authentication URL to the terminal, so you can copy it to a browser on another device
  • -qr — prints the authentication URL and a scannable QR code to the terminal
xtna-agent -u <your_email_address> -url

xtna-agent -u <your_email_address> -qr

Tested Linux Distributions:

Ubuntu 18.04, Ubuntu 20.04, Ubuntu 21.10, Ubuntu 22.04, Ubuntu 23.04, Ubuntu 24.04, Debian Bullseye (11), Debian Bookworm (12), Rocky 8, Rocky 9