Install the Management Server

1. Prepare the host

Configure a static IP, hostname, time synchronization, and the firewall rules listed in Network requirements. Transfer the verified axiom-installer.sh to the server.

2. Start the wizard

chmod +x axiom-installer.sh
sudo ./axiom-installer.sh

Choose management as the server role. The wizard asks for:

• Management NIC and bind IPv4
• Web UI port, default 8443
• Initial local administrator username and password
• HTTP or HTTPS
• TLS certificate and key paths, or a self-signed evaluation certificate
• Optional LDAP/Active Directory settings

No default production administrator password is created.

3. Verify the service

sudo systemctl status axiom --no-pager
sudo ss -ltnp | grep ':8443'
sudo journalctl -u axiom -n 120 -l --no-pager

Open the URL printed by the installer. With a self-signed certificate, a browser warning is expected until the issuing CA or certificate is trusted. Production systems should use a certificate issued by the organization's trusted CA.

4. Retrieve the enrollment token

Sign in and open Settings. Copy the enrollment token exactly. The token is a secret that authorizes data-plane enrollment, reporting, configuration recovery, and authenticated policy push. Store it in an approved password manager and rotate it if disclosure is suspected.

5. Configure offline licensing

Management starts with the configured trial behavior when no signed license is installed. Open Settings > License Activation:

1. Download the .axact activation file.
2. Upload it to the Axiom customer portal or provide it to authorized Axiom staff.
3. Download the returned signed .axlic file.
4. Upload the .axlic file in Management.
5. Confirm edition, expiry, and limits are displayed correctly.

The private license signing key is never installed on customer servers.

6. Enroll nodes

Install SMB and DNS nodes only after Management is reachable from their networks. A successful node installation validates the Management URL and token before completion. The node should appear in Nodes after its first report.

Optional directory integration

Management supports local administrator login and optional LDAP/Active Directory authentication. Configure a dedicated least-privilege bind account, a narrow base DN and user filter, and an optional required group. Use LDAPS or a trusted protected network path. Test local login before enabling directory-only operational procedures.