Deploy LIDER AHENK on Pardus and Enroll Your First Clients

Version note: The official LIDER AHENK server installer instructions currently name Pardus 25.1, while Pardus has since published Pardus 25.2. For a documented baseline, use the 25.1 combination described by the project; before putting 25.2 into production, confirm compatibility with the maintainers or validate it in a staging environment. The basic setup is to install the Lider management server, then enroll each Pardus endpoint with the Ahenk agent.

LIDER AHENK is a central management system. Lider provides the server and management interface; Ahenk is the privileged agent on each managed computer. LDAP stores directory data, while XMPP carries system communications.

1. Plan the server and network

Before installing, decide whether this is a pilot or a production deployment. The current official requirements page lists 4 CPU cores, 8 GB of memory, and 50 GB of disk for an installation, with resources increasing as the client count grows. For development or testing, it lists 2 CPU cores, 4 GB of memory, and 20 GB of disk. Treat these as starting points; size up as your client count grows.

The requirements page lists ports 8080, 22, 5222, 5280, 3306, and 389. Do not expose them publicly. Because the page does not map every port to each deployment flow, confirm source and destination rules for your topology before changing the firewall.

The installer supports an all-in-one server or separate component hosts. For a pilot, use one server; for larger deployments, plan a distributed layout. Set a stable hostname and address, confirm DNS and time synchronization, and use English for the server OS as the installer guide specifies.

2. Install the server and prepare the installer workstation

The latest server installation page specifies Pardus 25.1 Server, and the official download directory now also lists a Pardus 25.2 Server image. The version gap matters: the page does not confirm that its installer workflow has been validated with 25.2. Use the documented release for a strict reproduction, or test the newer release with a nonproduction server before enrolling real devices.

The graphical installer runs on a separate Pardus GNOME or Xfce workstation and connects to the target server over SSH. Install its documented system dependencies and SSH client, plus the Python virtual-environment package:

sudo apt update
sudo apt install python3-paramiko python3-pyqt5 python3-pip python3-psutil python3-venv xterm git openssh-client

The current installer page also instructs users to remove a Python EXTERNALLY-MANAGED marker and install Python libraries globally with pip. Avoid deleting that marker: it protects the operating system’s managed Python environment, and the instructions name a Python 3.11 path even though Pardus 25.2 release notes list Python 3.13. Use an isolated virtual environment instead, then test the installer before production use:

python3 -m venv --system-site-packages ~/.venvs/lider-installer
~/.venvs/lider-installer/bin/python -m pip install mysql-connector-python argon2-cffi
git clone https://github.com/Pardus-LiderAhenk/lider-ahenk-installer.git
cd lider-ahenk-installer
~/.venvs/lider-installer/bin/python src/app.py

The virtual environment isolates the PyPI libraries while exposing apt-installed GUI libraries. This safer adjustment is not documented by the project, so validate it in a lab. Both workstation and server need SSH; verify the host key and use an authorized administrator account.

3. Configure and run the Lider installer

In the installer window, enter the target server access details. Choose the option to place all components on one server for a simple pilot, or assign individual components to servers if you have a planned distributed topology. Use the connection-check control before proceeding; if it fails, resolve SSH, routing, firewall, or account permissions rather than continuing with guessed settings.

Next select the Lider package repository. The project documentation distinguishes the main repository for stable packages from the test repository. Use the stable source for a production deployment. If your organization mirrors the packages internally, enter the mirror address and its matching repository key file instead of mixing public and internal sources.

Enter the LDAP Base DN, system administrator password, Lider interface username and password, and interface user email. A Base DN is the root naming path for LDAP entries; use your organization’s naming plan. Use separate strong passwords and store them in an approved vault. Review hosts and repository before starting installation, which configures several services and may take time.

4. Open the console and enroll Ahenk clients

When the server installation finishes, open the Lider interface using the server address on port 8080, as shown in the installation guide. Use the scheme configured for your deployment, and keep the console inside a trusted network or behind an approved secure access layer. Sign in with the interface account you created.

On a Pardus endpoint, first check whether the Ahenk repository is already configured. The project’s client guide says it is defined on Pardus computers; if the package is available, install and register it:

sudo apt update
apt-cache policy ahenk
sudo apt install ahenk
sudo ahenk-register

If no package candidate appears, follow the repository setup in the official client guide. It provides the repository signing key and the stable package source. Avoid appending duplicate source lines; add the repository once and verify the key and source address before running apt update. On the registration prompt, confirm the action and enter the Lider server and enrollment details requested by the wizard. The guide says registration completes by restarting the computer, so schedule enrollment when a reboot is acceptable.

Ahenk runs with high privileges. Enroll a pilot group first and review policy scope; do not test software removal, account, USB, firewall, or script actions across every client at once.

5. Verify the pilot before scaling

After the endpoint restarts, find it in the Lider console and confirm its status or inventory is current. Send a low-impact task and review its result. Interface labels vary by Lider version, so use the matching manual.

If the client does not appear, check network reachability and the Ahenk registration output first. Confirm that the server’s required firewall paths are open only between the intended hosts, and verify the selected repository and LDAP Base DN. A successful web login proves the console is reachable; it does not prove an agent enrolled or completed a task. Expand the rollout only after both the client record and a harmless task result are visible.

Sources: Lider server installation instructions, Lider system requirements, Ahenk client installation, Pardus 25.2 release notes, and the Python specification for externally managed environments.