> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install and configure the TDP agent

> Install the Linux TDP agent and fesfifs kernel module on the SAP HANA host and point them at CryptoHub.

Install the Linux TDP agent and the `fesfifs` kernel module on the SAP HANA host, then point the agent at CryptoHub using the endpoint credentials.

## Install the agent and driver

<Steps>
  <Step>
    Copy the TDP agent (`ftdp`) and the `fesfifs-dkms` packages to the SAP HANA host.
  </Step>

  <Step>
    Install both packages. The `fesfifs-dkms` package builds the `fesfifs` kernel module for your running kernel.

    ```bash theme={null}
    sudo dnf install ./fesfifs-dkms-*.rpm ./ftdp-*.rpm
    ```

    <Note>
      `fesfifs-dkms` requires `dkms`, which is not on the RHEL 9 installation media. On an unregistered or airgapped host, enable EPEL or an equivalent repository that provides `dkms` first.
    </Note>
  </Step>

  <Step>
    Confirm the kernel module is present and loadable:

    ```bash theme={null}
    modprobe fesfifs
    lsmod | grep fesfifs
    ```
  </Step>
</Steps>

## Configure the agent for CryptoHub

Transcribe the values from the endpoint bundle into the agent configuration so the agent can authenticate to CryptoHub and receive policy and keys.

<Steps>
  <Step>
    Place the API key and trust chain from the endpoint bundle into the agent configuration directory (for example, under `/etc/futurex/tdp/`).
  </Step>

  <Step>
    Set the CryptoHub host and the service UUID in the agent configuration to match the values from the endpoint bundle.
  </Step>

  <Step>
    Start the TDP services. The `fesfifs`-related services are socket-activated, so start the sockets first, then the services:

    ```bash theme={null}
    sudo systemctl start ftdp-pkmd.socket ftdp-odd.socket
    sudo systemctl start ftdp-pkmd.service ftdp-odd.service fesfpolicy.service
    ```

    <Warning>
      Start (and restart) the `.socket` units, not just the `.service` units. Restarting only the services can remove the runtime socket the agent listens on, which causes policy lookups to fail and files to fall through to unencrypted passthrough.
    </Warning>
  </Step>

  <Step>
    Confirm the agent reached CryptoHub and loaded policy:

    ```bash theme={null}
    sudo systemctl is-active ftdp-pkmd.service ftdp-odd.service fesfpolicy.service
    journalctl -u ftdp-pkmd.service --since "-2min" | grep -i "policy cache"
    ```

    <Check>
      A `policy cache refreshed` message confirms the agent authenticated to CryptoHub and loaded the service policy.
    </Check>
  </Step>
</Steps>

For more on how the TDP agent manages policy and keys, see [Agent management](/CryptoHub/7.2.0.x/Administrator_guide/Data_protection/Transparent_Data_Protection_\(TDP\)/Agent_management) and [Understanding TDP](/CryptoHub/7.2.0.x/Administrator_guide/Data_protection/Transparent_Data_Protection_\(TDP\)/Understanding_TDP).