Getting started

Install on Linux

#Requirements

• x86_64 (amd64) with systemd;
• root rights (sudo);
• curl, sha256sum (coreutils);
• outbound HTTPS to SEK Systems, see Requirements and network.

#1. Create an installation line

1. In the console, open Agents and click Add agent.
2. Choose Linux.
3. Optional: open Manual steps (advanced) and choose the profile: observe (report only), patch (default) or full. The profile is only used when the host has no local policy yet. See Profiles.
4. Click Create installation line and confirm. You need the owner or admin role.

The console shows one line:

curl -fsSL https://console.sek.systems/i/<code> | sudo sh

The code is valid for one host, for one hour, and only once. After use, the line in your shell history is worthless. Need another host? Click Create another line.

#2. Run it on the host

Paste the line into a root shell on the host (or a shell with sudo). Output lines start with sec-install:. A successful run ends with:

sec-install: connected: the agent reported to SEK Systems
sec-install: done: sec-agent runs under sec-supervisor on <host> (service sek-agent, alias sec-agent; slots in /opt/sec-agent).
sec-install: New hosts appear in the SEK Systems dashboard within a minute (an administrator approves them). This link is now used up.

Tip

Prefer to read the script before running it? Download it first and run it after review:

curl -fsSL https://console.sek.systems/i/<code> -o sek-install.sh
less sek-install.sh
sudo sh sek-install.sh && rm -f sek-install.sh

Downloading uses up the code: the script you receive contains the one-time enrollment token for this host. Run it within the hour and delete the file afterwards.

#What the installer does

The script is generated for your environment and checks everything before it changes the host.

1. Checks that it runs as root on Linux x86_64 with systemd and sha256sum. If the host already runs the SEK Systems package from a package repository, it stops and asks you to update with the package manager.
2. Downloads sec-agent (the current stable release) and sec-supervisor, and verifies the SHA-256 of both. The agent hash comes from the signed release metadata; nothing is installed if a hash does not match (SHA-256 mismatch … refusing to install).
3. Installs the trust anchor for updates (/etc/sec/tuf-root.json), also checked against a fixed hash.
4. Writes the local policy /etc/sec/policy.toml with the chosen profile, only if there is none yet. An existing policy is never overwritten.
5. Enrolls the host once with the one-time token. The token is passed to the agent through the environment of that one process, never as a command-line argument. If the host is already enrolled (/var/lib/sec-agent/credential.bin exists), it keeps the existing identity.
6. Installs the agent into slot A or B under /opt/sec-agent, behind the supervisor, and writes the systemd unit sek-agent.service (alias sec-agent.service). It never replaces a newer agent that has already updated itself.
7. Starts the service and waits until it has been up for 10 seconds in a row. If the new installation does not come up within a minute, it restores the previous installation and stops with an error.
8. Waits up to a minute for the first report and tells you whether the agent reached SEK Systems.

Running the line again on an enrolled host (with a new code) is safe: it updates the installation and keeps the identity and the state.

#What gets installed

See Files, services and logs for all paths.

#3. Approve the host

The host appears under Agents with the status pending. It already reports its inventory, but receives no jobs until an owner or admin opens it and clicks Approve agent.

#Check the installation

systemctl status sek-agent                 # active (running)
journalctl -u sek-agent -n 50              # recent log lines of agent and supervisor
sudo sec-supervisor status --dir /opt/sec-agent   # active slot, update trial, last failure
sudo sec-agent policy                      # the effective local policy

More in Verify the connection.

#Errors during installation