---
title: MDM deployment on Linux
sidebar:
  label: Linux
description: Deploy the scanner on Linux with a managed configuration file and the .deb or .rpm package.
---

On Linux, the enrollment token is delivered in a small file the scanner reads at start.

## Before you begin

- An [enrollment token](/surface/admin/enrollment-tokens).
- The `.deb` or `.rpm` from the console's **Downloads** page, or the pre-filled `install.sh`.

1. **Write the managed file**

    Create `/etc/surface/managed.conf` with permissions `0600`, one `NAME=value` per line:

    ```bash
    SURFACE_ENROLLMENT_TOKEN=sae_xxxxxxxx.yyyyyyyyyyyyyyyy
    SURFACE_USER_EMAIL=jane@example.com
    SURFACE_USER_FULL_NAME="Jane Doe"
    ```

    The same names work as environment variables on the service.

2. **Install the package**

    **Debian, Ubuntu**

    ```bash
    sudo apt install ./SuperAlign-surface-{version}-linux-amd64.deb
    ```

    **Fedora, RHEL, Rocky, Alma**

    ```bash
    sudo dnf install ./SuperAlign-surface-{version}-linux-amd64.rpm
    ```
    Use `dnf` or `yum`, not `rpm -i`, so the WebKit runtime the tray app needs is installed too.

3. **Verify**

    ```bash
    cat /etc/surface/managed.conf
    systemctl status surface.service
    sudo surface status
    ```

    The laptop appears on **Endpoints** within one scan interval.

## Uninstall

```bash
sudo apt remove surface     # or: sudo dnf remove surface
```

The package manager keeps `/var/lib/surface`. Remove it by hand for a full clean-up. Upgrades with `apt` or `dnf` never unenroll the laptop.

## Next steps

- [Browser extension](/surface/deploy/mdm/browser-extension) if you plan to record AI websites
- [Troubleshooting](/surface/scanner/troubleshooting) if a laptop does not appear
- [Update and uninstall](/surface/scanner/update-and-uninstall) for upgrades through the same policy