This guide explains how to install AegisAdmin from its official APT repository and perform the initial checks on a test machine.
Before you begin
AegisAdmin manages sensitive server components. For an initial trial, use a virtual machine or test server with a restorable backup, and retain independent SSH access.Do not begin on a production server.
Use an account authorised to run sudo.
Keep a recent snapshot or backup of the machine.
Never disable APT signature verification.
Do not install a key whose fingerprint differs from the one published below.
1. Check the machine
The currently published release is intended for Debian or Ubuntu systems using systemd, APT and the amd64 architecture. Apache is optional and is never installed automatically by AegisAdmin.
dpkg --print-architecture
ps -p 1 -o comm=
Expected results:
amd64
systemd
Install the tools required to download and verify the key:
The Signed-By directive limits the trust granted to this key to the AegisAdmin repository alone. Do not use apt-key, trusted=yes, or any option that ignores a signature error.
4. Check the proposed package
Refresh the indexes, then check the origin and candidate version:
APT successively verifies the signature of the InRelease file, the index checksums, and the checksum of the downloaded package. Any signature, validity date, or checksum error must stop the installation.
To download the package without installing it and inspect its information:
cd /tmp
apt download aegisadmin
dpkg-deb --info aegisadmin_*_amd64.deb
The Package field must be aegisadmin, the architecture must be amd64, and the maintainer must be AegisAdmin.
5. Install AegisAdmin
Start the installation from the signed repository:
sudo apt install aegisadmin
The package installs, among other things:the unprivileged Go web server;
the privileged Go system backend;
the corresponding systemd services;
direct Go HTTPS listening on 8443 without Apache, or an Apache proxy to 127.0.0.1:9080 when Apache is present;
a local TLS key pair and an SQLite database;
the migrations and administration tools.
At the end of the installation, a message should indicate that the services have been restarted. If an error occurs, consult the diagnostics section before running the installation again.
6. Initialise the administrator account
This operation is required only for a genuinely new installation:
sudo aegisadmin initialize
The tool asks for the default language (fr or en), first name, last name, email address, password, and password confirmation. This language controls the sign-in screen; each user can subsequently choose their own language under My Account. The password must contain between 12 and 72 characters. Typed characters are represented by # symbols.
The sign-in username is always:
root
The first name, last name, and email address do not replace this username. Do not run the initialisation again if the tool indicates that the root account already exists.
When MySQL or MariaDB is active, the same process configures the dedicated monitoring account. You can resume this step with:
sudo aegisadmin mysql-setup
The SQL administrator password is entered without being displayed and is not stored by AegisAdmin.
7. Check that the system is working
sudo systemctl status
aegisadmin-system.service
aegisadmin-web.service
--no-pager -l
sudo aegisadmin version
With Apache, check apache2.service and the https://127.0.0.1:9080/readyz probe separately. Without Apache, use https://127.0.0.1:8443/readyz. Both AegisAdmin services must be active. The probe must return a response in this form:
With Apache, port 9080 is used by the Go server for local listening and must not be exposed to the Internet. Without Apache, Go listens directly on the dedicated port 8443.
8. Open the interface for the first time
The package provides dedicated HTTPS access, served directly by Go without Apache or through the dedicated VirtualHost when Apache is present:
https://SERVER_IP_ADDRESS:8443/
Check that the server is listening on this port:
sudo ss -ltnp | grep ':8443'
The firewall is not modified automatically. If the port is filtered, allow only the test address or network using the firewall tool already in use on the machine.
The initial certificate is local and is not signed by a public certificate authority. The browser will therefore normally display a warning. Before accepting it, display its fingerprint directly on the server:
