Photo by Divyansh Jain on Unsplash

Automating Debian workstation enrollment

Elite Enrollment

Article from ADMIN 90/2025

By Sam Klein

Puppet enrollment can be automated for enterprise deployment on Debian workstations, but security policy should be enforced with autosign scripts, so the implementation of the policy can be automated with a one-time enrollment script and an automated installation preseed.

Imagine it's Friday afternoon: Five new workstations arrive with the urgent requirement that they be ready for orientation on Monday. You're not planning to give up your weekend, and there's no chance you'll come in early Monday. However, each system still needs to be inventoried, labeled, booted, imaged, and configured with every department-required application. That's hours of repetitive work made worse by the fact that the systems are running Linux, not Windows. How do you possibly finish in one afternoon, while tickets continue to stack up?

The answer is automated enrollment. By combining Debian preseed installation with Puppet server configuration, you can turn the entire process into a hands-off workflow. All that's required is a USB stick, a bit of preparation, and a reliable network connection (e.g., wired Ethernet). Puppet handles configuration and deployment automatically: no manual domain joins, no one-off tweaks. Systems can be networked, managed, audited, and logged without direct intervention.

Much of this setup requires only minimal configuration, sometimes as little as a single file change on a modern Puppet server. In this tutorial, you'll first see the simplest approach: the use of a wildcard rule to accept all client certificates. From there, you'll strengthen the policy by restricting the wildcard to a few hostnames and checking whether a required file exists as authorization. Finally, you use a method to check custom certificate signing request (CSR) attributes, ensuring that only authorized Linux workstations can enroll (Figure 1). Both approaches remove the need for manual enrollment once the device boots from an approved preseed installer.

...

Use Express-Checkout link below to read the full article (PDF).