Installation Checklist

New Lumina server

• Create the Lumina server in the portal. See: Add servers

Download the required files

• Have the Lumina server license and certificate bundle issued for this deployment ready.

• In the Download Center, select the appropriate release channel, open ida-lumina-server, choose the release, and download the Linux x64 or arm64 archive. Download IDA Pro separately if needed.

Choose the storage backend

• Embedded database (default). Nothing to prepare — skip to the next section.

• MariaDB, for a multi-user or production deployment: create the database and a user for it, and have the host, port, user and password ready for setup.

Choose how IDA users authenticate

Decide now: the choice is recorded in the database at setup time and cannot be changed later without starting from an empty one. Most deployments use Lumina setup; choose Teams setup only if you already run a Hex-Rays Vault (Teams) server.

• Lumina setup (default) — the Lumina server manages user authentication.

• Teams setup — only if you already run a Vault (Teams) server. The Teams server manages user authentication; have its host and port ready. Note that the Git backend is now the recommended option for Teams, and it needs no dedicated Vault server — a Git-based team uses Lumina setup above. The legacy Vault backend is planned for deprecation; see Migrating from Vault to Git.

Installation

• Unzip the download. It contains one folder with the server, the admin client and a README.

• Decide how it will run, because it decides where the folder goes:

  • to try it out or run it yourself, anywhere will do;

  • for a system service that starts at boot, put it where the service account can read it.

>sudo mv lumina-<version>-<target> /opt/lumina-server
>cd /opt/lumina-server

• Run setup, giving it the two files you downloaded.

Lumina setup

>sudo ./lumina-server setup --defaults \
   --cert-bundle <your-bundle>.zip \
   --license <your-license>.hexlic

Teams setup

>sudo ./lumina-server setup --defaults --no-service \
   --db sqlite --auth-mode vault \
   --vault-host <teams-server-host>:65433 \
   --cert-bundle <your-bundle>.zip \
   --license <your-license>.hexlic

• For a Teams setup, approve the vault's certificate — after checking the fingerprint against the vault itself — then register and start the service:

>sudo ./lumina-server vault-trust
>sudo ./lumina-server service register

• Save the administrator password from the closing summary. It is shown once and never written to a log. If it is lost: ./lumina-server admin reset-password.

Testing and starting the server

• Check the server is up:

    # installed as a service
    >sudo ./lumina-server service status

    # running it yourself
    >./lumina-server start

• Check it answers on the admin port (8080 unless you changed it):

    >curl http://<host>:8080/api/health

• Check it answers a client on the Lumina port (7443 by default):

    >./lumina-client -h <host>:7443 -u <user> info

In case of startup problems, check the troubleshooting section.

Creating the users

• Sign in to the administration console at http://<host>:8080/admin with the account setup created.

• Lumina setup: add one account per analyst, on the console's Users page or with ./lumina-server admin create --username <name> --no-admin. Nothing registers itself over the network.

• Teams setup: nothing to do — an account works here as soon as it works in Teams.

The first user to log in no longer becomes the administrator: setup creates that account and prints its password once.

Connecting IDA

• Configure the Lumina server host, port and user name in IDA's Lumina options.

• Load a binary and confirm the connection in the server log (./lumina-server service logs).