Agent reference
Files, services and logs
Linux
| Path | Content | Rights |
|---|---|---|
/usr/local/bin/sec-agent, /usr/local/bin/sec-supervisor |
Programs (installation line) | root |
/usr/bin/sec-agent, /usr/bin/sec-supervisor |
Programs (package) | root |
/opt/sec-agent/slot-a/sec-agent, /opt/sec-agent/slot-b/sec-agent |
The two agent slots; the running agent comes from one of them | root |
/opt/sec-agent/current |
Link to the active slot | root |
/opt/sec-agent/state.json |
Supervisor state (active slot, trial, last failure) | root |
/opt/sec-agent/health.json |
Written by the agent after a confirmed report | root |
/opt/sec-agent/manifest.json |
SHA-256 of the programs in each slot | root |
/etc/sec/policy.toml |
The local policy | root writes, readable |
/etc/sec/tuf-root.json |
Trust anchor for agent updates | root |
/var/lib/sec-agent/ |
Identity, keys, endpoint list, signed configuration, local state | 0700, root only |
/etc/systemd/system/sek-agent.service |
The service (installation line); the package uses /usr/lib/systemd/system/ |
root |
The service is sek-agent.service, with the alias sec-agent.service (both names work with systemctl). It
runs the supervisor, which runs the agent:
sec-supervisor run --dir /opt/sec-agent -- run --state-dir /var/lib/sec-agent --interval 300 --update-repo …
Logs go to the journal:
journalctl -u sek-agent # all
journalctl -u sek-agent -f # follow
journalctl -u sek-agent --since -1h
The package also creates a system user sec-agent (without login). It is reserved; the agent itself runs as root.
Windows
| Path or name | Content |
|---|---|
C:\Program Files\SEC\sec-supervisor.exe |
The supervisor |
C:\Program Files\SEC\slot-a\sec-agent.exe, slot-b\sec-agent.exe |
The two agent slots |
C:\Program Files\SEC\current.txt |
The active slot (slot-a or slot-b) |
C:\Program Files\SEC\manifest.json |
SHA-256 of the programs in each slot |
C:\ProgramData\SEC\ |
Identity, keys, state, policy.toml, trust anchor; only SYSTEM and Administrators |
C:\ProgramData\SEC\agent.log, supervisor.log |
Logs; each is rotated once at 10 MB to .1 |
| Service SEKSupervisor ("SEK Systems Supervisor") | Runs the agent; LocalSystem |
| Service SEKAgent ("SEK Systems Agent") | Only on installations without supervisor |
Older installations used the service names SECSupervisor and SECAgent. The agent renames them by itself after an
update; the folder names stay the same.
Protection of these files
- The agent checks its own programs, the permissions of its folders and the local policy, and reports a tamper flag to SEK Systems when something changes unexpectedly (for example a modified program or loosened folder rights). Tamper flags are shown on the host's Summary tab under Identity.
- Where possible the private key of the agent is sealed to the machine (TPM on Linux and Windows, or Windows DPAPI).
A copy of
/var/lib/sec-agentorC:\ProgramData\SECthen does not work on another computer. - The agent identity is renewed automatically with new keys before it expires; see Security model.