InfraFenceInfraFence

Live Security Operations

Get Started

Command reference

Every command of the infrafence-agent binary - preflight, version, check, register, start, uninstall --clean and the panel commands used by the WHM and Plesk plugins.

Last updated:

The agent binary is /usr/local/bin/infrafence-agent. Run its commands as root.

preflight

bash
sudo infrafence-agent preflight
sudo infrafence-agent preflight --json

The read-only check of the server: firewall, other security tools, web servers, hosting panels, configuration management, package operations and resources. It changes nothing. Without --json it exits with status 2 when a finding blocks protection, 0 otherwise. See What the installer does.

version

bash
infrafence-agent version

Prints the installed version, infrafence-agent v<version>. --version and -v do the same. It needs agent 1.0.34 or later; on an older agent, infrafence-agent check prints the version too.

check

bash
infrafence-agent check

The self-test used by updates and by the recovery script: it prints infrafence-agent v<version> OK and exits 0.

register

bash
sudo infrafence-agent register <server_url> <agent_name> <install_token>

Registers the server and writes /etc/infrafence/config.json. The installer runs it for you; you need it only after install.sh --install-only, for example:

bash
sudo infrafence-agent register https://infrafence.com web-01 <YOUR_TOKEN>
sudo systemctl start infrafence-agent

On success it prints Agent registered successfully; on failure Registration failed: followed by the dashboard's answer.

start

bash
infrafence-agent start

Runs the agent in the foreground. The service runs this command; you do not need it by hand. Without a configuration file it stops with Run 'infrafence-agent register' first.

uninstall --clean

bash
sudo infrafence-agent uninstall --clean

Removes everything the agent added to the system (firewall chains and sets, web server and hardening changes) and prints one removed … line per item, then InfraFence changes removed from this host. It does not remove the binary or the service: install.sh --uninstall does all of it. See Uninstall.

panel

bash
sudo infrafence-agent panel status --json

The interface of the hosting panel plugins: one JSON object on standard output, {"ok": true, …} or {"ok": false, "error": "<code>", "message": "…"}, and exit status 0 only when ok. Root only.

Command What it does
status Version, running state, last heartbeat, connection, plan, AutoMode, and whether the plugin may show data (entitled, entitlement).
bans [--limit N] Active bans with reason, source and expiry.
unban <ip> --actor <user> Lifts a ban on this server only, for at most 30 days.
allow <ip> [--note …] --actor <user> Adds an address to the whitelist.
allowlist The whitelist, from the panel and from the dashboard.
disallow <ip> --actor <user> Removes an address the panel added.
findings [--limit N] Malware and file integrity findings, each open or resolved.
events [--limit N] [--since 24h] Recent events; problems open or resolved.
coexistence Other security tools found, and what InfraFence does next to each.
sites Accounts, domains and document roots, with scan coverage.
scan <document root> --actor <user> Starts a malware scan of one site.
map [--hours N] Where this server's attacks came from, per country and attack type, over the last 24 hours (--hours 24, the default) or 7 days (--hours 168).
score The server's security score, its grade, what takes points off it and its trend over 30 days.

The commands that change something need --actor, and the agent reports them to the dashboard as events with source panel. The command talks to the running agent over /run/infrafence/panel.sock (root only, mode 0600, no network listener). Without a running agent, status, coexistence and sites still answer; the others return agent_not_running. See Hosting panels.

map and score need agent 1.0.33 or later. The dashboard computes them; the agent asks it at most every 5 minutes for a map and every 15 minutes for the score, and keeps the answer. When the dashboard does not answer, the agent gives its last copy with "stale": true, or not_connected when it has none.

Paid plans only (agent 1.0.34 or later). The plugins are included in the Basic, Pro and AutoMode plans. status always answers, with entitled (true or false) and entitlement:

entitlement When
ok The plan is Basic, Pro or AutoMode, and protection is not switched off.
plan_required Another plan, such as Starter.
unpaid Protection is switched off: the dashboard has refused the server for 24 hours, for example because the subscription is not active.
unknown The plan is not known yet: the agent has not synced since it was installed or updated.

When it is not ok, every other command answers only an error with the same code (plan_required, unpaid or unknown), with no data, and changes nothing: an unban, allow, disallow or scan is refused. The agent keeps the plan of the last successful sync across restarts and uses it while the dashboard cannot be reached, so an outage does not empty the plugin. The gate applies to the replies only: it never changes the server's protection.

Open or resolved (agent 1.0.34 or later). In events and findings, every problem (an exposed database port, a changed system file, a risky PHP setting, malware...) has a subject, the key of what it is about (port:tcp/3306, file:/etc/passwd...), and a state, open or resolved, with resolved_at and resolved_how (port_closed, fix_applied, quarantined, package_updated, marked_expected, marked_resolved...). Events that are not problems, such as attacks and scans, have state null. A problem is resolved in the dashboard, or by the agent itself when it fixed it; a newer occurrence is open again. See Open and resolved problems.