Supported distributions
The 15 Linux distributions the InfraFence agent is tested on before every release, from Ubuntu and Debian to Rocky, AlmaLinux, Fedora and Amazon Linux.
Last updated:
Every release is tested end to end on these 15 distributions: each one boots with systemd in a container, runs the real install.sh, receives an SSH brute-force attack from another host, and must detect it, ban the address at the firewall, drop its connections and uninstall cleanly.
| Distribution | Versions | Package manager |
|---|---|---|
| Ubuntu | 20.04, 22.04, 24.04, 26.04 | apt |
| Debian | 12, 13 | apt |
| Rocky Linux | 8, 9 | dnf |
| AlmaLinux | 8, 9 | dnf |
| CentOS Stream | 9 | dnf |
| Oracle Linux | 9 | dnf |
| Fedora | 41, 42 | dnf |
| Amazon Linux | 2023 | dnf |
Both architectures are supported: x86-64 and ARM64.
SSH logs without rsyslog
Debian 12 and 13, Fedora and Amazon Linux 2023 have no /var/log/auth.log or /var/log/secure by default. The agent reads SSH authentication messages from the systemd journal first, so these distributions are covered without installing rsyslog. The agent log says which source it uses: reading authentication messages from ….
Other distributions
Other Debian- and RHEL-family distributions with apt-get, dnf or yum and iptables usually work, but they are not part of the release tests. Run the installer with --dry-run first: the read-only check reports anything that would get in the way.
Firewall backend
The agent uses iptables with either backend, legacy or nf_tables, as the distribution ships it. It does not write nft rules of its own. Bans, the whitelist and country blocks apply to IPv4; closed ports apply to IPv4 and IPv6.