Linux Support in EMA?

[aztlanla]

Hi, a majority of our Intel vPro hosts are running Linux, will EMA support Linux in the future?

Currently there are only Windows agents for EMA, we would like to have CentOS 7 & 8, RHEL 7 & 8 EMA agents that allow us to provision our hosts remotely via PKI into Admin Control Mode.

Thanks

[JoseH_Intel]

Hello aztlanla,

Thank you for joining the community

Currently the supported operating systems are:

As a stand-alone application, the Intel® EMA Agent can be installed on the following operating systems:

• Microsoft Windows* 7 (Intel AMT 11.8 systems only†)
• Microsoft Windows 10

Intel EMA Server can be installed on the following operating systems:

• Microsoft Windows Server* 2012
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019

† Windows 7 is supported on Intel AMT 11.8 systems only and will be no longer be supported after Intel AMT 16 is released

There are plans to develop EMA for Linux environments but there is no ETA yet. An alternate could be to use the older SCS to do a remote provisioning using PKI. It uses the ACUconfig tool that needs to be ran on a Windows environment but the target host could running whichever OS since the provisioning works at a MEBx (firmware) level

Hope it helps

Regards

Jose A.

Intel Customer Support Technician

[aztlanla]

Thanks, so alternatively you are saying we would need to reboot the Linux host into Windows using some king of Windows boot disk and run the ACUconfig tool to remote provision using PKI to get the host in ACM mode?

[hKtadepa]

Jose,

Given the above response is dated nearly by a year now, what is the current expectation on the ETA of Intel EMA for Linux? Remote management is a core requirement for embedded/IoT platforms, which typically run headless with Linux. Cloud centralized remote management is even more appealing. 

Thanks,

Hari Tadepalli

[JoseH_Intel]

Hello aztlanla,

When running EMA the provisioning process is done by a Windows executable file called the EMAagent that needs to be ran on the target system. The process you describe to use a Windows live CD to run the EMAagent only has not been tested but sounds like a clever idea. Technically is should work because after the remote system is added to the EMA group it could be running whichever OS without affecting the remote features. The EMA server though, runs on Windows only so the management host must be Windows.

If using SCS, the ACUconfig tool runs on the management host (so must be Windows) but the remote target systems could be in whichever OS as the provisioning process is done at a firmware level. Once the provisioning is completed you could use the alternate free software Open Software Projects - MeshCommander which is available for Linux and will serve the purpose of accessing the remote systems pretty well.

Regards

Jose A.

Intel Customer Support Technician

[aztlanla]

Hi Jose, can you point me to some documentation on how to use the ACUconfig tool to provision at target host at the firmware level.

I looked over the "Intel Setup and Configuration Software User Guide" and could not locate how to do the process you mention?

Thanks

[JoseH_Intel]

Hello aztlanla,,

The provisioning method is described in section 1.4.2 Remote Configuration using PKI https://www.intel.com/content/dam/support/us/en/documents/software/Intel_SCS_User_Guide.pdf#page=12

This configuration command is send from the RCS server to the target systems, but what is sent is a AMT profile that is stored in the MEBx (Management Engine Bios). It requires a certificate for security reasons.

An alternate option is to use MeshCentral which is compatible with Linux. It won't allow you to use the EMA console though. You can download it from here: Open Software Projects - MeshCentral (meshcommander.com)

Regards

Jose A.

Intel Customer Support Technician

[aztlanla]

Thanks, after re-reading the pdf in section 1.4.2 and following some links. I see this command "ConfigViaRCSOnly" I think this is what you are referring too. I'll see if I can spin up a Intel RCS Windows server to test this.

I am also currently working on getting MeshCentral working for our Linux clients, but they are some issues/bugs getting this to work with Linux/Windows with Wildcard Certs. Hopefully those MeshCentral issues can be resolved soon, if not I will have to use Intel RCS setup.

Thanks

[JoseH_Intel]

Hello aztlanla,,

Good to hear that you are already testing these alternative. I will follow up with you on next week to check the progress.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello aztlanla,,

I am just following up to check if you have accomplished some progress on the issue or the implementation of MeshCentral. I will look forward to your updates.

Regards

Jose A.

Intel Customer Support Technician

[JoseH_Intel]

Hello aztlanla,,

We will proceed to mark this thread as closed. If you have further issues or questions just go ahead and submit a new topic.

Regards

Jose A.

Intel Customer Support Technician

[aztlanla]

I was able to get this to work with MeshCentral.

Thanks

[gomeghi]

Jose, 

Reading this thread there is one question that is still not clear not me. All my vPro devices are using Linux RHEL8 I would like to manage them with Intel EMA. If Activate the AMT in ACM mode using other tools as for example MeshCentral. Is it possible for me to manage those linux devices (with AMT activated in ACM)  with EMA without installing an agent on them? 

Thanks!

Gastón