Overview
Swif provides policies for Linux devices, so you can manage their settings, security, and compliance from one place.
Supported distributions:
Debian
Ubuntu
Fedora
openSUSE
Arch Linux
Manjaro
MX Linux
Mint
Pop!_OS
RHEL (Red Hat)
NixOS. Learn more →
Universal Blue. Learn more →
Omarchy. Learn more →
Available policies
All Linux policies work on both company-owned and BYOD devices.
Policy | What it controls | Min. OS | BYOD compatible |
Linux Application Block Policy | Blocks desktop or command-line apps, by package name or path. | Any supported Linux distro | Yes |
Linux Azure Login Policy | Lets users sign in to devices with Microsoft Entra ID (formerly Azure AD). | Ubuntu and Fedora | Yes |
Linux Bluetooth Policy | Turns Bluetooth on or off, and sets discoverability and pairing rules. | Any supported Linux distro | Yes |
Linux Cron Policy | Restarts devices every few days, or on a set date. | Any supported Linux distro | Yes |
Linux Device CVE Report Policy | Vulnerability detection with the Swif Security agent. | Any supported Linux distro | Yes |
Linux Docker Policy | Controls which Docker images can run on devices. | Any supported Linux distro | Yes |
Linux Encryption Recovery Policy | Stores LUKS recovery keys in Swif, and sends recovery unlock commands. | Any supported Linux distro | Yes |
Linux Firefox Extension Policy | Installs or blocks Firefox add-ons, including Swif Browser Security. | Any supported Linux distro | Yes |
Linux Firewall Policy | Manages iptables and nftables firewall rules, by table, chain, match criteria, and action. | Any supported Linux distro | Yes |
Linux Firmware Update Policy | Manages how firmware updates are found and installed. | Any supported Linux distro | Yes |
Linux Google Chrome Browser Policy | Manages key Google Chrome settings. | Any supported Linux distro | Yes |
Linux Google Chrome Extension Deployment & Blocking Policy | Installs or blocks Chrome and Chromium extensions, including Swif Browser Security. | Any supported Linux distro | Yes |
Linux Google Login Policy | Lets users sign in to devices with their Google Workspace accounts. | Any supported Linux distro | Yes |
Linux Guest Login Policy | Controls whether users can sign in with a guest session. | Any supported Linux distro | Yes |
Linux Home Encryption Policy | Encrypts specific users' home folders, as an alternative to full-disk encryption. | Any supported Linux distro, without TPM | Yes |
Linux Login Message Policy | Shows a custom message on the login screen. | Any supported Linux distro | Yes |
Linux OS Upgrade Restriction Policy | Restricts OS upgrades: how far devices can upgrade (major, minor, security only, or frozen), the update channel, packages to hold back, and upgrade notifications. | Any supported Linux distro | Yes |
Linux Password Policy | Sets local account password length, complexity, and expiry, with PAM. Applies to command-line tools only; KDE's password settings aren't supported. | Any supported Linux distro | Yes |
Linux Printer Policy | Adds CUPS printers, each with a queue name, connection method, and driver. | Any supported Linux distro | Yes |
Linux RADIUS Policy | Connects devices to secure Wi-Fi (WPA2 or WPA3 Enterprise) through RADIUS. | Any supported Linux distro | Yes |
Linux Remote Desktop (RustDesk) Policy | Lets you start a remote desktop session with RustDesk from the Swif console. | Any supported Linux distro with a desktop | Yes |
Linux Screen Saver Policy | Sets the idle lock, timeout, and screen blanking, for GNOME, Xfce, MATE, and Cinnamon. | Any supported Linux distro | Yes |
Linux Software Update Policy | Installs package updates on a schedule, and adds external package repositories. | Any supported Linux distro | Yes |
Linux SSH User Policy | Gives users SSH access with their public keys. Swif creates the accounts, and installs the keys. | Any supported Linux distro | Yes |
Linux SSHD Policy | Manages OpenSSH server settings. | Any supported Linux distro | Yes |
Linux Sudoer Policy | Controls which users and groups can run commands with | Any supported Linux distro | Yes |
Linux Tracking Policy | Tracks USB activity, and device lock and unlock events. | Any supported Linux distro | Yes |
Linux USB Policy | Allows or blocks removable storage, sets it to read-only, and matches devices by vendor and product ID. | Any supported Linux distro | Yes |
Linux User Authorization Policy | Controls how user passwords are enforced. | Any supported Linux distro | Yes |
Linux VPN Policy | Sets up VPN profiles. | Any supported Linux distro | Yes |
Linux VPN Policy (RADIUS) | Connects devices to IPsec/IKEv2 VPN, with RADIUS authentication. | Any supported Linux distro | Yes |
Linux VSCode Policy | Manages Visual Studio Code extension update settings. | Any supported Linux distro | Yes |
Linux Wi-Fi Policy | Sets up WPA2 and WPA3 Enterprise and personal Wi-Fi networks, and auto-join priorities. | Any supported Linux distro | Yes |
For Agentic Security policies on Linux, see the List of Agentic Security Policies.
How Linux policies work
The Swif agent applies and enforces Linux policies on each device.
Policies apply automatically after a device enrolls.
Drift is flagged. If a device stops matching a policy, Swif shows it in the console.
Manage policies in Device Management > Policies. To create one, select Create new policy > Configure a Policy.
Requirements
A supported distribution, listed at the top of this article
The Swif agent, installed and connected to Swif
An internet connection, so devices can receive policies and report compliance
Tips
Encryption recovery: the Linux Encryption Recovery Policy stores LUKS recovery keys in Swif, so you don't need to record them by hand.
Works with any package manager: the Linux Application Block Policy works with
apt,dnf,yum,pacman, and others.Match settings across platforms: to apply the same rule everywhere, such as blocking USB storage, create matching policies for macOS and Windows, and assign them to the same device group.
Support compliance: combine Linux policies with Swif's compliance features, to support SOC 2, ISO 27001, and HIPAA.