InfraFenceInfraFence

Live Security Operations

Get Started

What the installer does

Every step of the InfraFence install.sh, the read-only preflight check it runs before changing anything, and the dry run that shows the plan without touching the server.

Last updated:

InfraFence is built for production servers: the installer checks the server read-only before it changes anything, and leaves alone what it cannot change safely.

The steps

  1. Token and root. Without --token on a server that is not registered yet, it stops with Install token is required; a dry run needs no token. It must run as root.
  2. System. Linux only; it detects the init system (systemd, upstart or sysvinit) and the architecture (amd64 or arm64).
  3. Certificates. On RHEL-family systems, or when curl cannot verify the download, it adds the ISRG Root X1 certificate (Let's Encrypt) to a bundle of its own, /etc/infrafence/ca-bundle.pem, and on RHEL-family systems to the system's trust store too. The certificate is part of the installer and never downloaded; where openssl is present it is checked against its pinned SHA-256 fingerprint first.
  4. Dependencies. Missing curl, iptables or ca-certificates are installed with apt-get, dnf or yum; on rpm systems iptables is installed as iptables-nft where that package exists, so its rules share the backend of firewalld and nftables. If another package operation is running it waits up to 5 minutes (Another package operation is running — waiting for it to finish...). It never runs dpkg --configure -a or repairs broken packages on its own.
  5. Download. The agent binary for the architecture is downloaded from the latest GitHub release (github.com and release-assets.githubusercontent.com, the only download source) and checked against its published SHA-256 checksum. The checksum is required: if it cannot be downloaded or does not match, nothing is installed. --skip-checksum installs without it and is unsafe.
  6. Read-only check. It runs infrafence-agent preflight before installing anything (below).
  7. ipset. Installed only if missing, not refused with --no-ipset, and the check says it is safe: a package manager is available and no package operation is running.
  8. Install. The binary goes to /usr/local/bin/infrafence-agent, the service is created, enabled and started.
  9. Register. The agent registers with your token and stores its own token in /etc/infrafence/config.json. The install token is not kept.
  10. Start check. It verifies that the service is running, and prints where to read the logs.

The download, the registration and the service start report their result to the dashboard (with the first characters of the token only), so a failed install can be traced.

The read-only check (preflight)

infrafence-agent preflight scans the server and changes nothing. The installer runs it before installing, the agent runs it at every start and then once a day, and you can run it any time:

bash
sudo infrafence-agent preflight
sudo infrafence-agent preflight --json

The output starts with InfraFence preflight (read-only — nothing was changed), then one line per finding with its level: ok, info, warn or block. Without --json, the exit status is 2 when a finding is block and 0 otherwise.

It looks at:

  • Firewall: whether iptables is installed and usable, and its backend; whether ipset is present; other firewall managers and security tools (ufw, firewalld, CSF, fail2ban, CrowdSec, netfilter-persistent, Docker, Kubernetes).
  • Web servers: nginx, Apache (apache2 or httpd), Caddy and LiteSpeed.
  • Who manages the configuration: hosting panels and configuration-management tools (Ansible, Puppet, Chef, Salt). When one is present, InfraFence never edits the web server configuration.
  • Packages: the package manager and any package operation in progress.
  • Resources: free disk space on / (warns under 200 MB), available memory (warns under 128 MB), the SELinux mode.

The result also reaches the dashboard: the server's Host tab shows it under Host compatibility.

The dry run

bash
curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --dry-run

It needs no token, and changes nothing on RHEL-family systems either: the certificate step above applies to that run only. It downloads the agent, runs the read-only check and prints Dry run — nothing was installed or changed. followed by what a real run would do: install the binary and the service, install ipset or not, create the INFRAFENCE firewall chains (jumped to from INPUT, and from DOCKER-USER if Docker is present) and register. Web server configuration changes and inbound blocking of threat-intelligence lists stay off until you turn them on in the dashboard.

What it never does

  • It never modifies your existing firewall rules: everything lives in the agent's own chains.
  • It never finishes other packages' half-done configurations (dpkg --configure -a), which could restart services.
  • It never edits a configuration that a hosting panel, LiteSpeed or a configuration-management tool owns.