Why not create a separate account on Linux just for the agent? This security measure should also be enabled by default. Many packages REQUIRE the creation of an account, but agents do not. Interesting.