InfraFenceInfraFence

Live Security Operations

Get Started

Uninstall

Remove the InfraFence agent and everything it added to the server - firewall chains and sets, web server changes, hardening files, the service - and remove the server from the dashboard.

Last updated:

Uninstall the agent

bash
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --uninstall

It stops the service, then runs infrafence-agent uninstall --clean, which removes what the agent added to the system:

  • its firewall jumps from INPUT, OUTPUT and DOCKER-USER, and its chains INFRAFENCE, INFRAFENCE-RULES, INFRAFENCE-PORTS and INFRAFENCE-EGRESS (with the IPv6 INFRAFENCE-PORTS);
  • every ipset whose name starts with infrafence-;
  • the user-agent blocking it added to nginx or Apache;
  • its ModSecurity rules, virtual patches included (/etc/modsecurity/infrafence);
  • the hardening files it wrote: /etc/ssh/sshd_config.d/00-infrafence-hardening.conf and the zz-infrafence-hardening.conf files of nginx and Apache, reloading those services.

Then the installer removes the service, the binary and its backup, the recovery script, the state files, the login notice /etc/motd.d/infrafence, the panel socket and the whole /etc/infrafence directory (configuration, token and caches). It ends with InfraFence Agent uninstalled.

Your own firewall rules are not touched: the agent only ever worked in its own chains.

What stays

  • Quarantined files, in /var/lib/infrafence/quarantine/, so nothing is lost. Restore or delete them yourself, then remove /var/lib/infrafence.
  • The packages the installer added, if any: ipset, iptables, curl, ca-certificates.

Remove the server from the dashboard

Uninstalling does not delete the server's history. In the dashboard, open the server, then Settings › Remove this server and type the hostname to confirm. It deletes the server with all its events, bans and scans. Owners and admins only.

Containers

bash
docker rm -f infrafence-agent && docker volume rm infrafence-config
bash
helm uninstall infrafence-agent --namespace infrafence

The agent's firewall chains live in the host's firewall, not in the container. To remove them at once, run infrafence-agent uninstall --clean through the image:

bash
docker run --rm --privileged --network host --pid host ghcr.io/infrafence/infrafence-agent:latest uninstall --clean