Skip to content

AA 2601: apply prerequisites review feedback (09/03/2026) #1482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eanandappa99 wants to merge 3 commits into
base: dev
Choose a base branch
from
Open

AA 2601: apply prerequisites review feedback (09/03/2026) #1482

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a7cab79
Apply AA 2601 prerequisites review feedback
eanandappa99 Sep 4, 2026
fa36330
fix(vale): auto-fix style issues (Vale + Dale)
github-actions[bot] Sep 4, 2026
fe090bc
Address editorial review on prerequisites
eanandappa99 Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 34 additions & 6 deletions docs/accessanalyzer/2601/install/prerequisites.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ description: "What to gather and prepare before installing Access Analyzer"
sidebar_position: 1
---

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# Prerequisites

Gather the following before you start the Access Analyzer installer. Everything you need to know for a successful install is on this page.
Expand All @@ -14,7 +17,7 @@ Gather the following before you start the Access Analyzer installer. Everything
- [ ] Account with `sudo` access to the server
- [ ] Outbound HTTPS access to all required domains confirmed
- [ ] Server hostname is a fully qualified domain name (FQDN) that resolves to the server IP
- [ ] TLS certificate option chosen; certificate files prepared if using Bring Your Own
- [ ] TLS certificate option chosen; bring-your-own certificate files prepared
- [ ] First admin name and email address decided (this provisions a local account — no AD/Entra dependency)
- [ ] Netwrix license key ready
- [ ] If using AD or Entra ID sign-in: service account, certificate, or app registration prepared
Expand Down Expand Up @@ -69,11 +72,16 @@ sudo mkdir -p /etc/dspm
| File | What It Is |
| --- | --- |
| `<hostname>.crt` | Server identity certificate in PEM format. The Subject Alternative Name (SAN) list must include the hostname **in lowercase** and the server's IP address. |
| `<hostname>.key` | Private key paired with the certificate (PEM). The OS user running the installer must be able to read it — not just `root`. |
| `<hostname>.key` | Private key paired with the certificate (PEM). |
| `ca-bundle.crt` | CA certificates that trust the server certificate. Required only if an internal or private CA signs the certificate — omit it for a publicly trusted certificate. |

**SAN requirement:** Browsers normalize hostnames to lowercase during TLS validation. If the SAN entry carries any uppercase characters, sign-in fails with an HTTP 401.

These commands set ownership and permissions on the private key. If an internal or private CA signed your certificate, they also install that CA into the operating system trust store so the system can validate the Access Analyzer TLS certificate. Skip the two CA commands for a publicly trusted certificate. Use the tab for your distribution.

<Tabs>
<TabItem value="debian" label="Debian / Ubuntu" default>

```bash
sudo chown $(whoami) /etc/dspm/<hostname>.key
sudo chmod 644 /etc/dspm/<hostname>.key
Expand All @@ -82,8 +90,24 @@ sudo cp /etc/dspm/ca-bundle.crt /usr/local/share/ca-certificates/dspm-ca.crt
sudo update-ca-certificates
```

</TabItem>
<TabItem value="rhel" label="RHEL / CentOS / Fedora">

```bash
sudo chown $(whoami) /etc/dspm/<hostname>.key
sudo chmod 644 /etc/dspm/<hostname>.key

sudo cp /etc/dspm/ca-bundle.crt /etc/pki/ca-trust/source/anchors/dspm-ca.crt
sudo update-ca-trust
```

</TabItem>
</Tabs>

**Verifying certificate files before install:**

These commands confirm the certificate covers the right hostname and IP address, that your CA bundle signed it, and that it matches the correct private key.

```bash
# Check that the SAN includes your hostname (lowercase) and server IP
openssl x509 -noout -text -in /etc/dspm/<hostname>.crt | grep -A5 "Subject Alternative"
Expand All @@ -96,13 +120,11 @@ openssl pkey -pubout -in /etc/dspm/<hostname>.key 2>/dev/null | md5sum
openssl x509 -noout -pubkey -in /etc/dspm/<hostname>.crt | md5sum
```

For the full TLS specification, including multi-CA environments, see the TLS Certificate Requirements page.

## First admin account

Identify the email address and display name of your first administrator. The installer prompts for both values during setup and provisions a **local** account automatically — it doesn't depend on Active Directory, Entra ID, or any other identity provider.

To let users sign in with their Active Directory or Entra ID credentials instead, configure an identity provider after installation. Gather the values for the directory you use before you start, so you have them ready in the installer.
To let users sign in with their Active Directory or Entra ID credentials instead, configure an identity provider after installation. Gather the values for the directory you use before you start the installer.

## Identity provider

Expand Down Expand Up @@ -167,7 +189,9 @@ Ports the Access Analyzer server must reach on your data sources and directory s
- **Outbound** from the Access Analyzer server to the target source/host — **required** for all connectors.
- **Inbound** at the target source/host from the Access Analyzer server — **required** (the target must accept the connection on the listed port).

| Connector | Port | Protocol | Notes |
The table lists default ports. If a source listens on a different port, open that port instead.

| Connector | Default Port | Protocol | Notes |
| --- | --- | --- | --- |
| CIFS / SMB | 445 | TCP | SMB file sharing |
| Active Directory | 389 | TCP | LDAP |
Expand Down Expand Up @@ -201,3 +225,7 @@ All outbound endpoints use HTTPS (port 443). The Access Analyzer server must rea
| `get.k3s.io` | K3s / Rancher | K3s installer download | Installation only |
| `rpm.rancher.io` | K3s / Rancher | K3s package repository | Installation only |
| `storage.googleapis.com` | K3s / Rancher | K3s artifact storage | Installation only |

## Before installation

Work through the [Checklist](#checklist) and confirm every item is complete before you start the installer. The installer runs preflight checks and stops if they fail, so confirming these items first avoids a restart.