JumpCloud Agent Compatibility, System Requirements, and Impacts

1. This is the primary credential that is linked with your keychain  and FileVault (if enabled).
2. This password is used to log into your local user account in macOS. 

1. Bootstrap Tokens grant a secure token to mobile or MDM administrator accounts.
2. These won't be created automatically if the first user created is a standard user during MDM enrollment, or if local account creation is skipped entirely.
3. Only available after MDM enrollment (JumpCloud MDM currently doesn't use this feature).

/var/log/jc*.log

You can download the most recent 1 MB of logs for a device from the System Details panel by clicking Get system logs. Logs are only available for online devices.

The jumpcloud-user-agent application handles actions that must be performed in a user’s context:

• App location -  /opt/jc_user_ro/jumpcloud-user-agent
• Log file -  /Users/<username>/Library/Logs/JumpCloud/jc-user-agent.log

The log file is present for every user on the device, whether or not the user is managed by JumpCloud, because the user-agent runs for each logged-in user. However, the agent will only install and manage certificates for managed users.

To ensure that the JumpCloud user-agent is started when the user logs in and is restarted automatically, the agent installer places a properties list file here:

/Library/LaunchAgents/com.jumpcloud.user-agent.plist

When the JumpCloud user-agent requests new Device Trust certificates for the user, it creates a new MacOS keychain:

/Users/username/Library/Keychains/jumpcloud-device-trust-keychain-db

It stores the password to unlock this keychain in the user’s login keychain in this item: JumpCloud Device Trust Keychain Password.

The user-agent imports the Device Trust certificates and private key into this new keychain.

Safari looks for identity preference settings in the user’s login keychain to automatically select certificates. The user-agent creates identity preferences in the keychain to associate the Device Trust certificate with two JumpCloud URLs:

• https://console.jumpcloud.com
• https://device-cert.jumpcloud.com

On MacOS, Chrome uses a properties list (plist) file to configure certificate auto-selection filters. The user agent will update the user’s current ‘Library/Preferences/com.google.chrome.plist’ file if it’s present or create a new file if it's not.

The auto-selection filters allow Chrome to find a certificate in the keychain to apply to a given URL. The selection filters will match a cert with a Subject Organizational Unit (SUBJECT:OU) of JumpCloud Device Trust to two JumpCloud URLs:

• https://console.jumpcloud.com
• https://device-cert.jumpcloud.com

/Library/Preferences/com.apple.loginwindow.plist

/Library/Security/SecurityagentPlugins/jumpcloud-loginwindow.bundle/Contents/Info.plist

When enabled, key files are stored on a per user basis in this directory at this path:

/etc/ssh/jumpcloud_totp/${USER}

JumpCloud manages this based on users having uploaded  public keys to JumpCloud.

JumpCloud enables sudo users by adding those users to:

 /etc/sudoers.d/00-USERNAME-jumpcloud

All JumpCloud-managed users will be added to the path. However, non-privileged users will contain a configuration file that explicitly denies sudo privileges.

/opt/jc/bin/jcosqueryi

Note: OS query is only installed when System Insights is enabled.

166 MB minimum

This includes C++ runtime components

C:\Windows\Temp\jcagent.log

You can download the most recent 1 MB of logs for a device from the System Details panel by clicking Get system logs. Logs are only available for online devices.

C:\Users\username\AppData\Local\Temp\jcagent.log

The log file lives in the directory for the admin user who installs the agent.

The jumpcloud-user-agent application handles actions that must be performed in a user’s context:

• App location - C:\Program Files\JumpCloud\jumpcloud-user-agent\jumpcloud-user-agent.exe
• Log file -  C:\Users\<username>\AppData\Local\Temp\jc-user-agent.log

The agent and user-agent import certificates into Windows Certificate Stores:

• The agent imports the root certificate into the System Certificate Store. This action requires administrative privileges, which is why the agent performs this import.
• The user-agent imports the intermediate certificate into the user’s Intermediate Certificate Store.
• The user-agent imports the leaf cert and private key into the user’s Personal Certificate Store.

To support certificate auto-selection in Chrome and Edge, the agent creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ 

AutoSelectCertificateForUrls

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ 

AutoSelectCertficateForUrls

The agent adds an entry for the ‘https://device-cert.jumpcloud.com’ URL if it doesn't exist.

HKEY_LOCAL_MACHINE\SOFTWARE\JumpCloud\JumpCloud agent\ConfigFile

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Uninstall\{96542816-DAD1-4D02-8363-CA4121E5CAE7}_is1

Amazon Linux (amd64, arm64): 2, 2022

The following core packages must be installed:

• chkconfig
• coreutils
• curl
• dmidecode
• glibc-common
• grep
• initscripts
• lsof
• net-tools
• nss
• nss-tools
• openssl
• psmisc
• redhat-lsb-core
• rpm
• shadow-utils
• sudo
• tar
• util-linux
• yum

CentOS (amd64): 7

The following core packages must be installed:

• chkconfig
• coreutils
• curl
• dnf
• findutils
• gawk
• glibc-common
• grep
• initscripts
• lsof
• net-tools
• nss
• nss-tools
• openssl
• policycoreutils
• psmisc
• redhat-lsb-core
• rpm
• shadow-utils
• sudo
• tar
• util-linux
• which
• yum

Debian (amd64): 10 

Debian (amd64, arm64): 11

The following core packages must be installed:

• apt-rdepends
• apt-show-versions
• coreutils
• curl
• dpkg
• grep
• hostname
• libc-bin
• libnss3 
• libnss3-tools
• libpam-runtime
• libpam-modules
• lsb-release
• lsof
• mawk
• openssl
• passwd
• procps
• psmisc
• sudo
• sysv-rc
• sysvinit-utils
• tar

Fedora (amd64): 36, 37

The following core packages must be installed:

• chkconfig
• coreutils
• curl
• dnf
• findutils
• gawk
• glibc-common
• grep
• initscripts
• lsof
• net-tools
• nss
• nss-tools
• openssl
• policycoreutils
• psmisc
• redhat-lsb-core
• rpm
• rsyslog
• shadow-utils
• sudo
• tar
• util-linux
• which
• yum

Linux Mint (Cinnamon) (amd64): 19, 20, 21

The following core packages must be installed:

• apt-rdepends
• apt-show-versions
• coreutils
• curl
• dpkg
• grep
• hostname
• libc-bin
• libnss3 
• libnss3-tools
• lsb-release
• lsof
• mawk
• openssl
• passwd
• procps
• sudo
• sysvinit-utils
• tar

Pop!_OS (amd64): 22.04

The following core packages must be installed:

• apt-rdepends
• apt-show-versions
• coreutils
• curl
• dpkg
• grep
• hostname
• libc-bin
• libnss3-tools
• lsb-release
• lsof
• mawk
• passwd
• procps
• sudo
• sysvinit-utils
• tar

RHEL (amd64): 7, 8

RHEL (amd64, arm64): 9

The following core packages must be installed:

• chkconfig
• coreutils
• curl
• dnf
• findutils
• gawk
• glibc-common
• grep
• initscripts
• lsof
• net-tools
• nss
• nss-tools
• openssl
• psmisc
• redhat-lsb-core
• rpm
• shadow-utils
• sudo
• tar
• util-linux
• which
• yum

Rocky Linux (amd64, arm64): 8, 9

The following core packages must be installed:

• coreutils
• curl
• findutils
• gawk
• glibc-common
• grep
• initscripts
• lsof
• net-tools
• nss-tools
• policycoreutils
• psmisc
• rpm
• shadow-utils
• sudo
• tar
• util-linux
• which
• yum

Ubuntu (amd64, arm64): 18.04, 20.04, 22.04

The following core packages must be installed:

• apt-rdepends
• apt-show-versions
• coreutils
• apt-curl
• dpkg
• grep
• hostname
• libc-bin
• libnss3 
• libnss3-tools
• lsb-release
• lsof
• mawk
• openssl
• passwd
• procps
• sysvinit-utils
• sudo
• tar

jcagent-<os-version-arch>.<deb/rpm>

jcagent, agent-monitor (init.d systems)

/opt/jc/

The following script lives on Linux devices that use System V init scripts:

/etc/init.d/jcagent

All other versions use systemd initialization and will have the following script:

/lib/systemd/system/jcagent.service

This is the OS and Arch lib directory, for example: /lib, /lib64, etc.
/security/pam_google_authenticator.so

The JumpCloud agent adds the following configuration lines to the device's /etc/pam.d/sshd configuration file:

auth required pam_google_authenticator.so nullok user=root secret=/etc/ssh/jumpcloud_totp/${USER}

auth required pam_permit.so

These configuration lines are removed when ssh with MFA is disabled. 

/var/log/jc*

You can download the most recent 1 MB of logs for a device from the Device Details panel by clicking Get agent log. Logs are only available for online systems.

JumpCloud appends a local host address (127.0.0.1:14028) when enabling Syslog for the Events API (logging user events). 

/etc/rsyslog.d/jumpcloud.conf

Contains one or more of the following parameters: [PermitRootLogin, PasswordAuthentication, UsePAM, PubkeyAuthentication, ChallengeResponseAuthentication]. Other config management systems may cause a conflict if it also tries to manage this file. 

/etc/ssh/sshd_config

When enabled, TOTP key files are stored on a per user basis at this path:

/etc/ssh/jumpcloud_totp/${USER}

JumpCloud enables sudo users by adding those users to:

 /etc/sudoers.d/00-USERNAME-jumpcloud

All JumpCloud-managed users will be added to the path. However, non-privileged users will contain a configuration file that explicitly denies sudo privileges.

JumpCloud manages this based on users having uploaded public keys to JumpCloud.

/root/.ssh/authorized_keys, /home/${USER} .ssh/authorized_keys

/opt/jc/bin/jcosqueryi

The JumpCloud agent handles all Device Trust actions.

The agent imports the Device Trust certificates into a Network Security Services (NSS) SQLite database (one per managed user). The databases are located in the user’s home directory:

• Certificate database: /home/username/.pki/nssdb/cert9.db
• Key database: /home/username/.pki/nssdb/key4.db

 If the databases don't exist, the agent creates them.

The agent creates a system-wide policy configuration for Chrome in the file ‘/etc/opt/chrome/policies/managed/JumpCloudCertificateAutoselect.json’.

This file contains ‘AutoSelectCertificateForUrls’ settings that match the JumpCloud Device Trust certificate to the following JumpCloud URL: https://device-cert.jumpcloud.com.