---
title: "alpacon agent install-pam"
description: "Install or upgrade alpamon-pam on a Linux server from the CLI. Check the sudo with MFA requirement, skip confirmation, and follow the installation progress."
---

> Full documentation index: https://docs.alpacax.com/llms.txt

# alpacon agent install-pam

Install or upgrade alpamon-pam on a Linux server.

## Usage

`alpacon agent install-pam SERVER [flags]`

## Key facts

- Requires sudo with MFA to be enabled for the workspace.
- Pass `--yes` for a non-interactive run.
- Active user work does not block installation; this command has no `--force`.
- The request returns before installation finishes; monitor it with `alpacon exec ls`.

## Flags

| Flag | Type | Description | Default |
| --- | --- | --- | --- |
| `-h, --help` | `bool` | help for install-pam | `false` |
| `-y, --yes` | `bool` | Skip confirmation prompt | `false` |
| `--output` | `string` | Output format: table or json | `table` |

## Examples

Install alpamon-pam

```bash
alpacon agent install-pam my-server
```

Skip confirmation

```bash
alpacon agent install-pam my-server --yes
```

## When to use it

Use this command for a Linux server where alpamon-pam is missing, including a server that was offline when [sudo with MFA](/use/work-sessions/terminal/sudo-with-mfa/) was enabled. You can also choose **Install or upgrade alpamon-pam** on the server’s [Agent card](/use/servers/manage/#agent-card).

## Output

On success the command prints `alpamon-pam installation requested. Run 'alpacon exec ls' to monitor progress.` Follow the install with [`alpacon exec ls`](/reference/cli/exec/#exec-ls); it runs on the server after the command returns.

## Refusals

The server refuses the action in three cases. Each exits with code `1`, like any other refused agent action.

| Code | Status | Meaning | What to do |
|------|--------|---------|------------|
| `server_pam_install_unsupported` | 400 | The host has no `alpamon-pam` package: macOS, Windows, or a package manager Alpacon doesn't drive. | Nothing to install; sudo with MFA applies to Linux hosts only. |
| `server_pam_install_requires_sudo_with_mfa` | 400 | **Sudo through Alpacon** is off for the workspace, or the deployment can't complete MFA step-up. | Turn the setting on in [Access rules](/use/policies/server-access/). If the deployment cannot complete MFA step-up, resolve that first; enabling the setting alone is not enough. |
| `server_pam_install_in_progress` | 409 | An install is already pending on this server. | Wait for it to finish, then try again. |

A host already on the current version isn't an error: the request is accepted and the package manager treats it as a no-op. The action never reinstalls, so it doesn't bring back a removed `/etc/sudoers.d/alpacon`—see [The user has no sudoers rule](/use/work-sessions/terminal/troubleshoot-sudo/#the-user-has-no-sudoers-rule).

Source: https://docs.alpacax.com/reference/cli/agent/install-pam/