Skip to main content

​
Enroll and organize several remote hosts

Outcome: A small operator team enrolls two branch PCs/servers securely and collects them in one Managed Host Group without changing their service permissions or network identity.

​
Step 1 — prepare each site

Each destination must have outbound connectivity to the Server’s enrollment/control endpoints and permission to install the platform-specific Agent. Follow Linux, Windows or macOS requirements before running the generated installer. The Server must already be installed from a product distribution.

​
Step 2 — issue a bounded enrollment batch

Real Data Relay Link CLI capture — Real enrollment list excerpt: completed, expired and revoked states; no raw enrollment tickets displayed. Figure 1. Real enrollment list excerpt: completed, expired and revoked states; no raw enrollment tickets displayed. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
The interactive enrollment wizard supports a count or UTF-8 CSV workflow; at most 10 codes per batch and 10 active unused codes. The CSV header is exactly:
Set TTL according to the wizard (default 1 hour, maximum 24 hours). ssh_user is optional: an empty value selects management-only enrollment. Never assume the OS account exists merely because its hint was entered.

​
Step 3 — install each Agent once

Send the individual generated enrollment/installation command to the corresponding authorized site administrator by a secure channel. Each ticket/code is single-use, short-lived and credential-sensitive. Execute the matching generated command on the correct host; do not reuse a consumed ticket or paste an illustrative made-up URL. On each Agent Host shell after installation:
Expect Agent Host role, real enrollment identity and healthy control connectivity. For Windows/macOS use the supported platform’s documented CLI invocation rather than assuming the Linux sudo syntax.

​
Step 4 — verify both identities on the Server

Real Data Relay Link CLI capture — Actual Server Managed Host inventory: confirm registered host rows and connected status. Figure 2. Actual Server Managed Host inventory: confirm registered host rows and connected status. CLI output example; sensitive addresses and hostnames are masked. Server REPL:
Resolve any actual assigned Managed Host names/immutable IDs before proceeding; enrollment labels need not be accepted as privileged identity selectors automatically. Reissuance requires a new enrollment credential; reinstalling from an already consumed code is not a recovery mechanism.

​
Step 5 — organize inventory

Actual DRLink Server main CLI menu — choose 1 Managed Hosts for inventory and enrollment Figure 3. Real Server CLI menu: choose 1 Managed Hosts for registered hosts and inventory operations. Actual CLI output example. Server REPL:
A Managed Host Group organizes registered host inventory. It is not a Network Group used as an access-policy selector. Membership alone never creates Remote Services, broadens Remote Access, or rewrites clients.

​
Verify / recover

Check that both actual hosts appear in the group, their immutable Managed Host identities are preserved and no unintended Remote Service was automatically published. If enrollment fails, inspect show enrollments, expiration/revocation state and Agent system diagnostics; do not log or disclose secret ticket material. To adjust only metadata, use unset managed-host branch-b group branches. Deleting a Managed Host is a separate irreversible trust/endpoint retirement and requires explicit review.

​
Current behavior check — 2026-10-28

The UTF-8 CSV header is label,ssh_user,note. A blank ssh_user means management-only enrollment. Zero-Touch can use a verified numeric-IP/private-CA compact launcher without DNS; failed prerequisites must not issue a ticket. Managed Host Group membership is inventory metadata, separate from Network Group policy membership. Current CLI inventory · MCP compatibility

​
Automatic service result in this example

The CSV row branch-a,operator,... automatically configures SSH/22 and its public endpoint. branch-b,,... is management-only and publishes no SSH. Inspect show remote-services on each Agent; do not recreate branch-a SSH manually. A blank ssh_user in bulk has different semantics from a blank username in single-host SSH only.
Last modified on October 29, 2026