--- title: "On-Prem Connectivity Utility Install Instructions" slug: "on-prem-utility-install" updated: 2026-10-02T21:16:48Z published: 2026-10-02T21:16:48Z canonical: "help.nucleussec.com/on-prem-utility-install" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.nucleussec.com/llms.txt > Use this file to discover all available pages before exploring further. # On-Prem Connectivity Utility Install Instructions ## Hardware and Operating System Requirements | **Requirement** | **Details** | | --- | --- | | Operating Systems | A modern Linux distribution that natively supports *systemd* and includes a *ssh client* *Nucleus officially supports Red Hat Family distributions; other systemd distros should be compatible.* | | CPU | 1 Core | | Memory | 4 GB RAM | | Storage | 20 GB | | Firewall | Open port 2222 outbound from the server you are installing the On-Prem Connectivity utility on to the Connectivity Manager FQDN provided by the Nucleus support team. | | Misc | root access (or full sudo privileges) on the machine you are installing the On-Prem Connectivity utility on. This procedure assumes you are logged in as the root user. | ## On-Prem Connectivity Utility Configuration Elements You will also need the following data elements and services available to complete the Connectivity Utility installation process. | **Requirements** | **Details** | | --- | --- | | Username | Unique identifier allowing access to your Nucleus instance | | FQDN | Fully Qualified Domain Name, the most complete and accurate network address for your instance’s Connectivity Manager. | | ssh | Secure Shell (ssh) client used to securely connect log into, and manage remote servers or devices over an encrypted network. | | systemd | System and service manager for Linux. This standard package initializes user space, acts as PID 1, and manages system resources. | ## Installation *Before proceeding, please* [***submit a support request***](https://nucleussec.atlassian.net/servicedesk/customer/portal/3/group/11/create/33)*. Nucleus Support will ensure you have all the proper information for a successful Connectivity Utility install.* You will be provided with the following information by Nucleus Support: - Your Connectivity Utility username for authentication. - The FQDN of the Connectivity Manager for your instance (referred to as in this procedure). - Port numbers for your internal services. - On request, Nucleus Support can provide IPs for firewall rule configuration. ***Note*** *Your firewall must be configured to allow outbound SSH access on port 2222 from the server you are installing the Connectivity Utility on to this FQDN.* ***Warning*** *The Connectivity Utility uses key-based authentication.* ***We will never ask for an account password or private key. We will require your public key, covered below.*** ***Note*** *Standard Connectivity Utility provisioning allows for five internal sources. If you are connecting to more than five internal tools, contact Nucleus Support for additional allocation. Nucleus will assign a list of ports for your internal services. Each internal tool that Nucleus will be connecting to will use one of these assigned ports.* Once you have the above information, proceed to the next section. ## Install Dependencies To install the Connectivity Utility, you’ll need a SSH client and *systemd* suite. These are standard packages available on supported Linux operating systems. If they are not available, you will need to install them to continue. ### Obtain Your Public Key File | # Setup SSH keys for authentication mkdir /home//.ssh ssh-keygen -t rsa -b 4096 -C Enter the file in which to save the key: /home//.ssh/id_rsa Enter the passphrase: Enter the same passphrase again: | | --- | ***Stop Here!*** *Send your* ***public key file*** *to your Nucleus Support representative before continuing. You can provide the file directly to your representative or by including the information on your open support ticket.* ## Description of Fields The following fields are referenced during the Connectivity Utility installation process. - `<internal tool name>`: The name of the internal tool you are connecting to (e.g. Nessus, Jira, etc.) - `<NUCLEUS_PORT>`: One unused port from the range of ports that Nucleus assigned to your organization. If you need more ports, reach out to your Nucleus support representative. - `<TARGET_HOST>`: The internal IP of the internal tool/application that you would like to expose to Nucleus. If you are installing the Connectivity Utility on the server that runs the internal tool, use 127.0.0.1 - `<TARGET_PORT>`: This is the port that the internal tool/application listens on. For example, Nessus Professional listens on port 8834 by default. - `<Connectivity Manager fqdn>`: This is the FQDN of the Connectivity Manager given to you by Nucleus Support. `nucleus-mgr.nucleussec.com`) ## Install & Configure the Connectivity Utility Ports, IP addresses, user information, etc. in the following instructions are **examples only**. Please use your account-specific details. 1. Create the necessary files Create the file /etc/systemd/system/nucleus-agent.slice with the following contents. | [Unit] Description=Connectivity Utility tunnels | | --- | Create the file `/etc/systemd/system/nucleus-agent@.service` with the following contents: | [Unit] Description=Connectivity Utility tunnel for %i After=network.target [Service] Type=simple EnvironmentFile=/etc/nucleus-agent/%i ExecStart=ssh -NT -o StrictHostKeyChecking=no \ ${NUCLEUS_AGENT_USER}@nucleus-mgr.nucleussec.com -p 2222 \ -R ${NUCLEUS_PORT}:${TARGET_HOST}:${TARGET_PORT} \ -i ${NUCLEUS_SSH_KEY} \ -o ExitOnForwardFailure=yes \ -o ServerAliveInterval=30 \ -o ServerAliveCountMax=3 RestartSec=5 Restart=on-success RestartForceExitStatus=255 Slice=nucleus-agent.slice [Install] WantedBy=multi-user.target | | --- | 1. Create nucleus-agent directory and place config files Create a directory `/etc/nucleus-agent/` and place config files NOTE: Customize the filenames as desired/necessary, ensuring they are referenced correctly in step 4. Also remember to use your own IP addresses, ports, usernames, and keys. 1. `tunnel_config1`: | TARGET_HOST="10.1.66.195" TARGET_PORT="1234" NUCLEUS_PORT="6789" NUCLEUS_AGENT_USER="sample_username" NUCLEUS_SSH_KEY="/path/to/id_rsa" | | --- | 1. `tunnel_config2`: (IF NEEDED) | TARGET_HOST="172.16.16.156" TARGET_PORT="1234" NUCLEUS_PORT="6789" NUCLEUS_AGENT_USER="sample_username" NUCLEUS_SSH_KEY="/path/to/id_rsa" | | --- | 1. Run `systemctl daemon-reload` 2. Run `systemctl enable --now nucleus-agent@tunnel_config1`, repeat for each config file added above. 3. Each `tunnel` is now managed as a standard system-native service; there is no need for external dependencies. 1. Individual tunnel connections can be targeted with the @ syntax, e.g. `systemctl stop nucleus-agent@tunnel_config5` or `systemctl restart nucleus-agent@tunnel_config1`. 2. All tunnels can be targeted for `systemct1` commands via the slice name, e.g. `systemctl status nucleus-agent.slice`. If the service is not starting correctly, please refer to the Troubleshooting guide in this folder If you need any assistance, we're always close at support@nucleussec.com. ## Next Steps Now that you've set up the Connectivity Utility, it's time to set up a Connector through the UI. [Here's how](https://help.nucleussec.com/v1/docs/nucleus-agent-usage)