Linux Workstation Standards

Managing University of Dayton computers is an important part of UDit's overall "defense-in-depth strategy" (a cybersecurity approach that uses multiple layers of security for holistic protection).  In addition to using Active Directory (AD) on the Microsoft side, we are able to manage Windows and Apple computers through Ivanti and JAMF. While Linux doesn’t have the same numbers across campus, there’s no single preferred distribution. Linux users tend to be our most technical users and in some instances manage our infrastructure. Therefore we want to apply similar standards across all three operating system platforms.

Configuration standards

Registration requirement

Appendix A - CrowdStrike Supported Linux Distributions

Appendix B - Ivanti Supported Linux Distributions
 

Configuration standards

The following configuration standards are for users wanting to use a Linux operating system computer at UD.

Distribution

There are a variety of ways to differentiate Linux distributions - system architecture, kernel, vendor, etc.  We recommend using one that allows use of our CrowdStrike and Ivanti agents.  Supported distributions will be attached as appendices to this document.  In the event an individual wishes to run a distribution that won’t run, use a distribution that is currently supported by the vendor (with updates) and supports the remainder of the requirements.  In those cases where even this isn’t possible, the workstation should not be used on the network.
 

Asset Management

Ivanti clients are available for a number of different Linux distributions. You’ll find a list in Appendix A. Unlike Windows, Ivanti may not be sufficient to maintain the operating system and installed software.  Ivanti will be used for hardware tracking only. Software updates are covered separately.
 

Antivirus (AV) / Endpoint Detection and Response (EDR)

CrowdStrike sensors are available for a number of different Linux distributions. You’ll find a list in Appendix B. In the event a user wishes to run a distribution that does not support CrowdStrike, the user will install ClamAV or an approved alternative, keep its signature databases current and run monthly scans at a minimum.
 

Software Updates

Users are responsible for updating their Linux distributions at least monthly.
 

Encryption / Key Escrow

Users running Linux on laptops will encrypt all disks/volumes with preboot authentication functionality using LUKS or an approved alternative.  An encryption key shall be escrowed with the Linux user’s supervisor.
 

Local Administrator

Privileged accounts such as root will not be used on a day-to-day basis. Use of SU and SUDO is encouraged.
 

Passwords

Passwords for all local accounts shall be strong and will be 8 or more characters. They will not contain common words (whole or part) or parts of the user’s name or University ID (UDID) and will follow the general guidelines outlined at password.udayton.edu.  All passwords, to include root, shall be changed annually.
 

Firewall

Host firewalls shall be enabled and any ports required to be opened will be documented in the Linux Workstation Registration Form.

Registration requirement

Users are expected to maintain Linux workstations to the standards listed above.

Complete the Linux Workstation Registration Form. A workstation record is placed into our asset inventory.

Appendix A - CrowdStrike Supported Linux Distributions

This information is not publicly available on CrowdStrike’s website, but is current as of May 28, 2025.  We will periodically update this appendix to keep it current, but feel free to reach out to the IT Risk Management Office if you have questions or want the very latest.

This section discusses Linux operating systems only. Linux support is highly dependent on the kernels used, support of which is updated frequently with new Sensor releases. Therefore, while we can list here the general distributions we are supporting, you will need to consult the Falcon Sensor for Linux Deployment Guide's section, Appendix A – Supported Kernels, to ensure your kernel is supported; find this guide in your Falcon console at Support → Documentation → Sensor Deployment and Maintenance. A sensor running on a supported Linux distribution but an unsupported kernel will enter Reduced Functionality Mode (RFM); Linux sensors in RFM will only send SensorHeartBeat events at this time.
 

Supported

We support x86_64 and Graviton 64 versions of the Linux OSes listed below, with supported kernels. We also support ARM64 on RHEL/Alma/CentOS/Rocky 8.5-8.6 and on Ubuntu 18.04, 20.04, and 22.04.

Unsupported

All other Linux distributions and versions are unsupported, including but not limited to:

• Amazon 2017.03 – last supported on sensor 5.43.10807 through EOS on May 8, 2021
• Amazon 2017.09 and 2018.03 – last supported on LNX sensor 7.6.16108
• CentOS 8 Stream, all versions
• CentOS 7.1-7.3 – last supported on sensor 5.43.10807 through EOS on May 8, 2021
• CentOS 6.7-6.10 – last supported on LNX sensor 7.6.16108
• CentOS 6.5-6.6 – last supported on sensor 5.43.10807 through EOS on May 8, 2021
• RHEL 7.1-7.3 – last supported on sensor 5.43.10807 through EOS on May 8, 2021
• RHEL 6.7-6.10 – last supported on LNX sensor 7.6.16108
• RHEL 6.5-6.6 – last supported on sensor 5.43.10807 through EOS on May 8, 2021
• SLES 12.1 – last supported on sensor 5.43.10807 through EOS on May 8, 2021
• SLES 12.1 – last supported on LNX sensor 5.43.10807 through EOS on May 8, 2021
• Ubuntu 14.04 LTS – last supported on LNX sensor 7.6.16108
• No other operating systems are currently supported.
• We support Linux servers and desktops running supported long term support (LTS) kernels. Other kernel versions, such as custom or hardware enablement (HWE) are unsupported.
• CrowdStrike does not support community or custom kernels. Only kernels released by the OS vendors, which are currently supported by the OS vendors, are supported.
   

Additional Notes

As noted in the 6.39.13601 release notes, On-Sensor ML does not work for files/executables running in non-init user namespaces when Security-Enhanced Linux is enabled and enforcing. This applies to all supported sensor versions.

On RHEL and SLES hosts that are not licensed, it becomes difficult to install any software (such as Falcon) on the host, or successfully perform upgrades. This can also be the case where the distribution or kernel falls out of support by the vendor.

Appendix B - Ivanti Supported Linux Distributions

For the most current list, click this link:

https://help.ivanti.com/res/help/en_US/IA/2021/GS/46300.htm