InfraFenceInfraFence

Live Security Operations

Get Started

Installation

Install the InfraFence agent on Linux with install.sh - requirements, every installer option, where files go, and how to reinstall or move a server.

Last updated:

The agent runs as a service on the server: systemd, upstart or sysvinit. For containers see Docker and Kubernetes.

Requirements

  • Linux on x86-64 (x86_64) or ARM64 (aarch64). Any other architecture stops the installer with Unsupported architecture.
  • Root access.
  • systemd, upstart or sysvinit.
  • apt-get, dnf or yum, to install what is missing: curl, iptables and ca-certificates. ipset is installed too when the read-only check says it is safe to do so.
  • Outbound HTTPS to infrafence.com, github.com and release-assets.githubusercontent.com: the agent is downloaded from its GitHub releases only.

The supported distributions page lists the 15 distributions every release is tested on.

Install

Create an install token in the dashboard (Servers › Add server), then on the server:

bash
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <YOUR_TOKEN>

The installer never asks questions, so it also works from provisioning scripts.

Installer options

Option Effect
--token <TOKEN> The single-use install token from the dashboard. Needed for a new registration.
--dry-run Download the agent, run the read-only check, print what a real run would do. Nothing is installed or changed, and no token is needed.
--no-ipset Never install ipset. Bans still work, as one firewall rule per address (up to 500); country blocking and blocking of threat-intelligence lists then only detect.
--install-only Install the binary and the service without registering. The service is enabled but not started; the installer prints the infrafence-agent register command to run later.
--force-register Register again even if /etc/infrafence/config.json exists, with a new token.
--skip-checksum Install even when the release checksum cannot be downloaded. Unsafe: the binary is not verified. Without it, a missing or wrong checksum stops the installer and nothing is installed.
--uninstall Remove the agent and what it added. See Uninstall.

The installer also reads these environment variables:

Variable Default Effect
INFRAFENCE_AGENT_NAME the short hostname The name the server gets in the dashboard.
INFRAFENCE_SERVER_URL https://infrafence.com The dashboard the agent registers with.

Pass them through sudo, for example:

bash
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo INFRAFENCE_AGENT_NAME=web-01 bash -s -- --token <YOUR_TOKEN>

Where things go

Path What
/usr/local/bin/infrafence-agent The agent binary. The previous version is kept as infrafence-agent.bak after an update.
/etc/infrafence/config.json Dashboard address and the agent's own token (mode 0600, directory 0750).
/var/lib/infrafence/ State: bans, whitelist, country blocks, closed ports, quarantined files.
/etc/systemd/system/infrafence-agent.service The systemd unit (upstart: /etc/init/infrafence-agent.conf; sysvinit: /etc/init.d/infrafence-agent).
/usr/local/bin/infrafence-agent-recover.sh Runs before each start under systemd: if the binary is broken it restores the backup or downloads the release again, checking its checksum and signature.

The agent logs to the journal under systemd (journalctl -u infrafence-agent) and to syslog with upstart or sysvinit.

Run it again

Running the installer again without --token on a registered server updates the binary and the service and keeps the registration:

bash
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash

It prints Existing config found at /etc/infrafence/config.json — keeping current registration. To connect the server to another organization, or as a new server, use --force-register with a new token.

If something fails

The installer explains each failure in a box with the next step: a missing dependency, a failed download, or a failed registration (Invalid or expired install token, Server URL is unreachable, Server limit reached for your plan). See Troubleshooting.