Skip to main content

Quick Install

This guide walks through installing Access Analyzer on a fresh Linux VM with Active Directory as the identity provider.

For the CLI-flag reference, see Configure Identity Provider.

Prerequisites Checklist​

Before running the installer, confirm the following.

System requirements​

Absolute installer minimums (enforced by preflight): 6 vCPUs, 24 GB RAM, 20 GB free disk on /. Installation is blocked if the system falls below these thresholds.

Choose a deployment size based on your environment:

SizeCPUMemoryDiskTypical Environment
Small8 cores24 GB1 TB SSDEvaluation, pilots, up to ~1,000 assets
Medium16 cores48 GB1 TB SSDUp to ~5,000 assets
Large32 cores64 GB1 TB SSD5,000+ assets / enterprise

Disk space — the installer validates free space on multiple paths:

PathMinimum Free SpacePurpose
/20 GBRoot filesystem
/var20 GBK3s data, containers, logs
/var/lib20 GBK3s data directory
/var/log5 GBSystem and application logs
/etc1 GBConfiguration files

Network: Outbound HTTPS (port 443) to required endpoints — see Required Domains below.

License: Valid Netwrix license key.

note

Supported OS: Ubuntu 24.04 LTS is the primary tested platform. Red Hat Enterprise Linux (RHEL) 8 and 9, CentOS, Fedora, and Debian stable releases are also compatible. AIX and non-Linux operating systems are not supported.

note

If running on a hypervisor, configure static memory allocation (not dynamic/ballooned memory). See Hardware and System Requirements for hypervisor-specific instructions.

TLS certificates​

See TLS Certificate Requirements for the full specification. At a minimum you need:

  • Application TLS certificate (PEM). The Subject Alternative Name (SAN) list must include DSPM_HOSTNAME in lowercase and the server's IP address.

  • Private key paired with the certificate (PEM). Must be readable by the OS user running the installer, not just root.

  • CA bundle (PEM). Must contain the CA that signed the application certificate. If using AD authentication, it must also contain the CA that signed the domain controller's LDAPS certificate. If these are different CAs, concatenate them:

    cat app-ca.crt ldaps-ca.crt > ca-bundle.crt
warning

DSPM_HOSTNAME must be a DNS hostname, not an IP address. The browser TLS handshake requires a hostname in the certificate's SAN. Avoid the .local and .localhost TLDs — both break in-cluster DNS resolution and silently break sign-in flows.

DNS​

The value you pick for DSPM_HOSTNAME must resolve to the VM's IP address from:

  • Client browsers — configure a DNS A record, or add an entry to each client's hosts file.
  • In-cluster pods — handled automatically by the installer's CoreDNS rewrite. No customer action needed.

Active Directory information​

Gather these values from your directory team before starting:

  • Domain controller hostname or IP, and port (636 LDAPS strongly recommended; 389 plain LDAP works but is unencrypted)
  • Service account distinguished name (DN) — read-only access to the user directory is sufficient
  • Service account password
  • Base DN where your user accounts are stored (for example, CN=Users,DC=example,DC=com)
  • Email attribute name (usually mail)

Connector port requirements​

Ports the Access Analyzer server must be able to reach on your data sources and directory services. Only open the ports for the connectors you plan to configure.

Direction of traffic:

  • Outbound from the Access Analyzer server to the target source/host — required for all connectors.
  • Inbound at the target source/host from the Access Analyzer server — required (the target must accept the connection on the listed port).
  • Two-way communication between the Access Analyzer server and the target — optional. Can be configured for environments that require it, but not required for any connector.
ConnectorPortProtocolNotes
CIFS / SMB445TCPSMB file sharing
Active Directory389TCPLDAP
Active Directory636TCPLDAPS (encrypted) — required for AD authentication
Active Directory135–139TCPRPC
Active Directory49152–65535TCPRPC dynamic ports
SharePoint Online443TCPMicrosoft Graph API
Entra ID443TCPMicrosoft identity platform
Local Groups5985TCPWinRM (HTTP)
Local Groups5986TCPWinRM (HTTPS)

Internal port requirements​

These ports are used within the Access Analyzer VM for service-to-service communication. No external firewall rules are required — only port 443 (Traefik) is exposed externally.

PortProtocolServiceDescription
443TCPTraefikHTTPS ingress for web UI and API
6443TCPK3s APIKubernetes API server
8090TCPArgoCDArgoCD UI (via port-forward)
5432TCPPostgreSQLDatabase connections
8123TCPClickHouseHTTP interface
9000TCPClickHouseNative protocol
6379TCPRedisCache and queue connections

For firewall rule examples, see Network and Port Requirements.

Required Domains​

All outbound endpoints use HTTPS (port 443). The following domains must be reachable from the Access Analyzer server before installation. For firewall rule examples, see Network and Port Requirements.

EndpointCategoryPurposeWhen Required
api.keygen.shKeygen / LicensingLicense validation APIInstallation and updates
oci.pkg.keygen.shKeygen / LicensingNetwrix OCI registry — Helm charts and application imagesInstallation and updates
raw.pkg.keygen.shKeygen / LicensingInstaller script downloadInstallation and updates
keygen-dist.c3c9112df8df715f42d1162cdce5dba1.r2.cloudflarestorage.comKeygen / Licensing CDNKeygen artifact storageInstallation and updates
api.github.comGitHubGitHub APIInstallation only
github.comGitHubRepository and release accessInstallation only
raw.githubusercontent.comGitHubArgoCD bootstrap manifestsInstallation only
release-assets.githubusercontent.comGitHubRelease asset downloadsInstallation only
pkg-containers.githubusercontent.comGitHub Container RegistryGitHub Packages CDNInstallation and updates
ghcr.ioGitHub Container RegistryContainer imagesInstallation and updates
get.k3s.ioK3s / RancherK3s installer downloadInstallation only
rpm.rancher.ioK3s / RancherK3s package repositoryInstallation only
storage.googleapis.comK3s / RancherK3s artifact storageInstallation only

Active Directory Authentication​

Step 1: Prepare the VM — upload certs and trust the CA​

For full details on each certificate file (SAN rules, ownership, CA bundle concatenation), see TLS Certificate Requirements.

sudo mkdir -p /opt/dspm-tls

# Copy your three PEM files into /opt/dspm-tls/:
#   - <hostname>.crt   (Access Analyzer server certificate — SAN must match DSPM_HOSTNAME, lowercase)
#   - <hostname>.key   (private key — chown to install user, chmod 644)
#   - ca-bundle.crt    (concatenated: application CA + LDAPS DC CA)

sudo chown $(whoami) /opt/dspm-tls/<hostname>.key
sudo chmod 644 /opt/dspm-tls/<hostname>.key

sudo cp /opt/dspm-tls/ca-bundle.crt /usr/local/share/ca-certificates/dspm-ca.crt
sudo update-ca-certificates

Step 2: Set environment variables​

Paste and customize the following at the top of your terminal session. Every subsequent command references these variables.

export DSPM_TARGET_REVISION="<version, e.g. 0.3.*-dev or leave unset for latest>"
export LICENSE_KEY="<Your-License-Key>"
export DSPM_HOSTNAME="<AA2601 FQDN, e.g. aa2601.corp.example.com>"
export TLS_CERT_FILE="/opt/dspm-tls/<hostname>.crt"
export TLS_KEY_FILE="/opt/dspm-tls/<hostname>.key"
export TLS_CA_BUNDLE_FILE="/opt/dspm-tls/ca-bundle.crt"
export IDP_TYPE="ad"
export IDP_ALIAS="<login-button-label>"                   # letters, digits, hyphens, underscores, dots only — no spaces
export LDAP_URL="ldaps://<dc-hostname-or-ip>:636"
export LDAP_BIND_DN="<Service-Account-DN>"                # e.g. CN=svc-dspm,OU=ServiceAccounts,DC=example,DC=com
export LDAP_USERS_DN="<Users-Base-DN>"                    # e.g. CN=Users,DC=example,DC=com
export LDAP_EMAIL_ATTRIBUTE="mail"

Environment variable reference:

VariableDescriptionExample
LICENSE_KEYNetwrix license keyNWRX-XXXX-XXXX-XXXX
DSPM_HOSTNAMEFully qualified domain name. Must be lowercase and match the cert SANaa2601.corp.example.com
TLS_CERT_FILEFull path to PEM server certificate/opt/dspm-tls/aa2601.crt
TLS_KEY_FILEFull path to PEM private key. Must be readable by the install user/opt/dspm-tls/aa2601.key
TLS_CA_BUNDLE_FILEFull path to CA bundle (application CA + LDAPS DC CA)/opt/dspm-tls/ca-bundle.crt
IDP_TYPEIdentity provider typead
IDP_ALIASLogin button label. Letters, digits, hyphens, underscores, dots onlyactive-directory
LDAP_URLLDAPS URL for the domain controllerldaps://dc.corp.example.com:636
LDAP_BIND_DNDistinguished name of the read-only service accountCN=svc-dspm,OU=ServiceAccounts,DC=corp,DC=example,DC=com
LDAP_USERS_DNBase DN for the OU containing user accountsCN=Users,DC=corp,DC=example,DC=com
LDAP_EMAIL_ATTRIBUTELDAP attribute storing the user's email addressmail
DSPM_TARGET_REVISION(Optional) Specific version to install. Omit for latest0.3.*-dev

Step 3: Download and run the installer​

Download the installer:

curl -sLfo /tmp/dspm-install.sh \
  "https://raw.pkg.keygen.sh/v1/accounts/netwrix/artifacts/dspm-install.sh?auth=license:${LICENSE_KEY}"

Run it with one of the two password options below. Installation takes 15–30 minutes.

Option — Pipe the LDAP bind password (automated)​

printf '<Service-Account-Password>\n' | bash /tmp/dspm-install.sh

Runs non-interactively. Suitable for scripted or automated installs. After the install completes, clear your shell history if others can read the session (history -c, and clear ~/.bash_history or equivalent) — the password was part of the printf command line.

Option — Type the password when prompted​

bash /tmp/dspm-install.sh

The installer pauses part-way through and displays Enter LDAP bind credential:. Type the password (input is silent — no characters are echoed) and press Enter. The password is never placed in shell history, environment, or disk. Requires a human at the keyboard at that moment.

note

Setting LDAP_BIND_CREDENTIAL as an environment variable is not an alternative. The installer always reads the bind password interactively, which overwrites any exported value. Use one of the two options above.

Step 4: Verify the installation​

After the installer completes, confirm all pods are healthy:

kubectl get pods -A
kubectl get apps -n argocd

All pods should show Running or Completed status. All ArgoCD applications should be Synced and Healthy.

Step 5: Sign in as the bootstrap User Admin and pre-provision users​

The installer seeds a bootstrap account, admin@dspm.local, with the User Admin role. This account can create and manage other users but cannot access system configuration. Use it on first login to pre-provision your AD users, then sign out and sign back in as an Administrator for system-level work.

  1. Retrieve the bootstrap admin password:

    sudo kubectl get secret -n access-analyzer dspm-bootstrap-admin \
      -o jsonpath='{.data.password}' | base64 -d; echo

  2. Open a browser and navigate to https://<DSPM_HOSTNAME>.

  3. Sign in with:

    • Username: admin@dspm.local
    • Password: (from step 1)

  4. Complete first-login setup:

    • Scan the QR code with an authenticator app, enter a device name, submit the one-time code. Save this enrollment — you will need the same authenticator for any future bootstrap admin login.
    • Enter a first name and last name. Do not change the email address.

  5. Pre-provision each user who should be able to sign in. For each user:

    • Click + Add User.
    • Enter the Name and Email. The email must match the user's AD mail attribute exactly, including case.
    • Assign a role (see Roles below).

    Assign at least one user the Administrator role — the bootstrap account cannot access system configuration, so someone needs to. Assign at least one additional user the User Admin role if you want a non-bootstrap user to manage accounts going forward.

  6. Sign out.

Step 6: Sign in with AD credentials​

  1. Navigate to https://<DSPM_HOSTNAME>.
  2. Enter the email and password for a pre-provisioned AD user and sign in.

Roles​

This table is also published at Configuration > Identity Provider > Roles. It is duplicated here so this guide reads top-to-bottom.

RoleDescription
AdministratorFull access: system configuration (sources, scans, connectors, application settings) and user management (create, edit, activate, deactivate, and delete users; assign roles; pre-provision federated users).
User AdminUser and role management rights only: create, edit, activate, deactivate, and delete users; assign roles; pre-provision federated users. Does not have system configuration rights. The bootstrap admin@dspm.local account is assigned this role.
ViewerRead-only access to data and reports. No configuration or user management rights.

The User Admin role exists to provide a dedicated account for user management with no system configuration access — useful for delegating user administration separately from system configuration. The bootstrap admin@dspm.local account is seeded as User Admin — you'll use it to pre-provision the rest of your users, including your first Administrator.

Troubleshooting​

For certificate-specific issues, see TLS Certificate Requirements — Troubleshooting.

SymptomLikely causeFix
Sign-in returns HTTP 401 with correct credentialsSAN hostname is mixed-case; browser normalized it to lowercaseRe-issue the certificate with lowercase hostname in the SAN list
Installer exits with "Failed to read TLS private key"Key file owned by root, installer runs as non-root usersudo chown <install-user> /opt/dspm-tls/<hostname>.key
Sign-in silently fails with PKIX path building failed in Keycloak logsCA bundle is missing the LDAPS DC's CA (AD only)Concatenate the DC's LDAPS CA into the bundle and re-run the installer with --configure-idp-only
Browser rejects the application URL with a SAN mismatch errorDSPM_HOSTNAME is an IP, or SAN does not include the hostname in useUse a DNS hostname for DSPM_HOSTNAME and verify the cert SAN list
Installer rejects --idp-aliasAlias contains a space or special characterUse only letters, digits, hyphens, underscores, and dots
Sign-in fails after pre-provisioningPre-provisioned email does not match the directory attributeConfirm the email matches exactly, including case
Entra ID login redirects failRedirect URI in App Registration does not matchVerify the redirect URI is https://<DSPM_HOSTNAME>/auth/realms/dspm/broker/entra-id/endpoint exactly
Entra ID login prompt does not appearClient secret entered incorrectly or has expiredRe-run with --configure-idp-only and re-enter the secret; rotate the secret in Azure if expired

For other identity provider failures, see Configure Identity Provider — Troubleshooting.

Reinstalling​

  • Same VM: your certificates are already in place at /opt/dspm-tls/. Skip Step 1 and restart at Step 2.
  • New VM, same CA: upload the same three certificate files to /opt/dspm-tls/ on the new VM (Step 1), then continue with Step 2.