Configuration
Configure the InfraFence agent - the dashboard settings that reach every server in seconds, every key of /etc/infrafence/config.json and the environment variables the agent reads.
Last updated:
Almost everything is configured in the dashboard, and changes reach the servers in about a second. On the server there is only the registration file and a few environment variables for unusual setups.
Settings in the dashboard
Settings › Agent applies to every server of the organization. Members can read it; owners and admins change it.
| Setting | Default | What it does |
|---|---|---|
| Monitor mode (detect only, never block) | off | Detects and reports everything, bans nothing and applies no country blocks. |
| Brute-force threshold (failed attempts) | 5 | Failed SSH logins from one address before a ban. Mail, database and FTP use a fixed 5 attempts in 5 minutes. |
| Brute-force window (seconds) | 60 | The window the SSH attempts are counted in. |
| Ban duration | Escalating | Escalating: 24 hours, 7 days, 30 days, then permanent, or always 1 hour, 24 hours, 7 days, 30 days, or permanent. |
| Ban on all servers | off | An address banned on one server is banned on every server of the organization; unbanning it lifts it everywhere. |
| Blocked countries (comma-separated ISO codes) | none | Country blocking. |
| SSH session tracking enabled | on | Scores every SSH session: SSH session risk. |
| Sigma detection enabled, Sigma minimum level | on, warning | Raises the risk of open SSH sessions when other detectors fire at or above the level. |
Under Changes to your servers:
| Setting | Default | What it does |
|---|---|---|
| Allow web server configuration changes | off | Lets the agent add ModSecurity rules and user-agent blocking to nginx or Apache. Never on servers whose configuration a hosting panel, LiteSpeed or a configuration-management tool manages. |
| Block traffic from threat-intelligence lists | off | Drops inbound traffic from the listed networks. Needs ipset; never in monitor mode. |
| Inspect DNS traffic | on | Outbound and DNS threats. |
| Detect port scans | on | 15 or more ports in 10 minutes from one address, or 30 or more from one network. |
| Ban port scanners | off | Bans the addresses that port scans come from. |
| Agent updates | Notify only | Or Install automatically. See Updating the agent. |
Other pages hold the rest: the whitelist and the InfraFence network under Settings › Network, the malware scan schedule under Settings › Malware, the web firewall rules on Web firewall, bot choices on Bots, alerts under Settings › Alerts.
/etc/infrafence/config.json
Written by the registration, mode 0600. You normally never edit it.
| Key | Type | Meaning |
|---|---|---|
server_url |
string | The dashboard address. Required. |
agent_token |
string | The agent's own token, received at registration. Required. |
agent_id |
number | The server's id in the dashboard. |
reverb_url |
string | Address of the legacy real-time channel, if any. |
reverb_app_key |
string | Its key. |
auth_endpoint |
string | Its authorization endpoint. |
panel |
boolean | true opens the hosting panel socket on a server without cPanel or Plesk. Off by default. |
Without server_url or agent_token the agent stops with config is incomplete: server_url and agent_token are required.
Environment variables
Set them with sudo systemctl edit infrafence-agent:
[Service]
Environment=WEB_LOG_PATH=/srv/www/logs/access.logthen sudo systemctl restart infrafence-agent.
| Variable | Default | Effect |
|---|---|---|
INFRAFENCE_CONFIG |
/etc/infrafence/config.json |
The configuration file. |
AUTH_LOG_PATH |
the systemd journal, else /var/log/auth.log or /var/log/secure |
A non-standard SSH log file to read instead. |
WEB_LOG_PATH |
detected | Web access logs, comma-separated. When set, it always wins over detection. |
MAIL_LOG_PATH |
detected (/var/log/mail.log, /var/log/maillog…) |
The mail server log. |
DB_LOG_PATH |
detected | The database log. |
FTP_LOG_PATH |
detected (/var/log/vsftpd.log, /var/log/proftpd/proftpd.log) |
The FTP server log. |
MODSEC_AUDIT_LOG |
detected | The ModSecurity audit log. |
GEOIP_DB_PATH |
the database downloaded from the dashboard, /etc/infrafence/geoip-country.mmdb |
Your own country database in MaxMind format; when it is set nothing is downloaded. |
AGENT_IP |
detected | The server's public address, when detection picks the wrong one. |
Web access logs are found automatically for nginx, Apache, LiteSpeed, hosting panels and Docker containers. If none is found the log says [webwatcher] no access logs found — web attack detection disabled (set WEB_LOG_PATH to override).
Commands
The agent's own commands are in the command reference.