Skip to content
Snippets Groups Projects
README.md 3.75 KiB
Newer Older
Recolic Keghart's avatar
Recolic Keghart committed
# Intune for Archlinux

There are two levels of Intune Setup. 

After installing level-1, you can access everything with certificate copied from a level-2 machine.   
Recolic Keghart's avatar
Recolic Keghart committed
After installing level-2, you can actually enroll the machine and get a certificate. 
Recolic Keghart's avatar
Recolic Keghart committed

## Install Level-1

Recolic Keghart's avatar
Recolic Keghart committed
1. Install `libsdbus-c++0 msalsdk-dbusclient msft-identity-broker` packages in this repo. Note that they depends on `jre11-openjdk`. 
Recolic's avatar
Recolic committed
2. Install `microsoft-edge-stable-bin` from AUR. 
3. `[Temporary Fix]` Downgrade `tpm2-tss` to `3.2.0-1`, and add it to `IgnorePkg` in `/etc/pacman.conf`.
Recolic Keghart's avatar
Recolic Keghart committed

## Install Level-2 and enroll

Recolic Keghart's avatar
Recolic Keghart committed
> Installing level-2 components will make your machine managed. You must satisfy password requirements, and disk-encryption requirements. Ref: <https://aka.ms/LinuxPortal>
Recolic Keghart's avatar
Recolic Keghart committed

Recolic's avatar
Recolic committed
Use a Ubuntu **20.04** VM to perform level-2 enroll. ArchLinux level-2 enroll is theoretically supported, but I never tested it. 
Recolic Keghart's avatar
Recolic Keghart committed

1. install intune-portal and its dependencies (pwquality)
2. copy /etc/os-release from ubuntu 2004 to archlinux
3. make sure you followed procedure of official doc

Recolic Keghart's avatar
Recolic Keghart committed
It's suggested to keep the Ubuntu VM powered-on forever, to keep the certificate valid. 

Recolic Keghart's avatar
Recolic Keghart committed
## Move certificates from Level-2 machine to Level-1 machine

Recolic Keghart's avatar
Recolic Keghart committed
> You need to keep your level-2 machine running, or your certificate will invalidate in 1 month. 

Recolic Keghart's avatar
Recolic Keghart committed
Copy the following files from enrolled Level-2 machine to unenrolled Level-1 machine: 

```
/var/lib/msft-identity-device-broker/1000.db
/etc/machine-id
/etc/os-release # Note: this is a symbol-link in ubuntu
/home/YourName/.config/msft-identity-broker/account-data.db
/home/YourName/.config/msft-identity-broker/broker-data.db
/home/YourName/.config/msft-identity-broker/cookies.db
/home/YourName/.local/share/keyrings/login.keyring
```

Recolic Keghart's avatar
Recolic Keghart committed
**Reboot** to make sure gnome-keyring-daemon is using the latest keyring file. 
Recolic Keghart's avatar
Recolic Keghart committed

Recolic Keghart's avatar
Recolic Keghart committed
Then, run `seahorse` to double-confirm your "login" keyring is unlocked and non-empty. It may ask you to enter the previous login password. 

> You could change the password but DO NOT remove the password protection! There is a known bug <https://gitlab.gnome.org/GNOME/gnome-keyring/-/issues/103>
Recolic Keghart's avatar
Recolic Keghart committed

You are all set! 
Recolic Keghart's avatar
Recolic Keghart committed

Recolic Keghart's avatar
Recolic Keghart committed
## FAQ and debug

If your edge browser is not allowing you to login, check the following logs: 

1. Any error message in `journalctl --user -u msft-identity-broker.service`?
2. Any error message in `sudo journalctl -u msft-identity-device-broker.service`? 
Recolic Keghart's avatar
Recolic Keghart committed
3. Run `seahorse` and is there Intune entries in your `login` keyring? Is it `set as default`? 
Recolic Keghart's avatar
Recolic Keghart committed
4. Run `ldd /usr/lib/libmsal_dbus_client.so`. Is there undefined reference? 

Recolic Keghart's avatar
Recolic Keghart committed
### Common errors

- msft-identity-broker.service: Failed at step STATE_DIRECTORY spawning /opt/msft/identitybroker/bin/msft-identity-broker: Operation not permitted

Recolic's avatar
Recolic committed
This is a permission issue. Please run `chmod 777 -R /opt/msft` as root, **and** run `chown -R YourName /home/YourName/.config`, and restart the service. 
Recolic Keghart's avatar
Recolic Keghart committed

Recolic Keghart's avatar
Recolic Keghart committed
- msft-identity-broker.service: Failed to set up special execution directory in /home/YourName/.config: Operation not permitted
Recolic Keghart's avatar
Recolic Keghart committed

Recolic Keghart's avatar
Recolic Keghart committed
This is also a permission issue while overwritting user config with root account manually. Please run `chown -R YourName /home/YourName/.config` and restart the service. 
Recolic Keghart's avatar
Recolic Keghart committed

- Failed to decrypt with key:LinuxBrokerRegularUserSecretKey thumbprint

Run `seahorse` and make sure your **default** keyring is unlocked, and contains **valid** certificates. 
Recolic's avatar
Recolic committed

- Microsoft Edge crashed immediately on startup (SIGSEGV)

Recolic's avatar
Recolic committed
If your Microsoft Edge crashes immediately on startup because of SIGSEGV, and GDB shows `Thread 107 "ThreadPoolForeg" received signal SIGSEGV, Segmentation fault.`
Recolic's avatar
Recolic committed

Recolic's avatar
Recolic committed
Downgrade the `tpm2-tss` package to `3.2.0-1`, and add it into `IgnorePkg` to prevent it from being upgraded again.
Recolic's avatar
Recolic committed

Recolic's avatar
Recolic committed
- Everything seems fine, no error in log, but Edge still says 'Unable to setup sync'

Sign out and sign in again.