How it works

Agent updates

The agent keeps itself up to date. Because it runs with full rights on your hosts, an update must be both authentic (really from SEK Systems) and safe (a bad version must not leave the host without a working agent).

#Authentic: signed release metadata

Agent releases are published in an update repository that uses The Update Framework (TUF), a standard designed for exactly this: secure software updates that hold up even if the download server is compromised.

• The release metadata is signed. The agent checks the signatures against a trust anchor that was installed with the agent (/etc/sec/tuf-root.json, C:\ProgramData\SEC\…) and that the installer itself checked against a fixed hash.
• The metadata states the length and SHA-256 of every agent program. The agent only uses a download that matches.
• The metadata expires and has version numbers, so an attacker cannot replay old metadata or hold back updates unnoticed.
• The agent never downgrades.

The update repository is part of console.sek.systems (/repo/). The agent checks for updates every hour.

#Safe: two slots and a supervisor

The agent program lives in two slots, A and B. The supervisor decides which one runs.

1. The agent downloads and verifies the new version and writes it into the free slot. The running version stays untouched.
2. The agent asks the supervisor to switch, and exits. No update starts while a job is running.
3. The supervisor starts the new version as a trial.
4. The trial is committed once the new version has connected to SEK Systems and a report was confirmed (the agent writes health.json).
5. If that does not happen within 10 minutes, or the new version crashes repeatedly, the supervisor switches back to the previous slot, records the failure, and the agent reports it. That version is never tried again on this host.

sudo sec-supervisor status --dir /opt/sec-agent shows the active slot, a running trial, the last commit and the last failure.

#Channels: canary and stable

New versions go to a small canary group first, and only after that to stable. The installation line always installs the current stable version. You cannot choose a channel yourself; the release notes list the stable versions: Agent release notes.

#Switching updates off

Set in the local policy:

self_update = false

The agent then refuses updates (policy:self_update) and stays on its version. To update later, run a new installation line. Pinning a specific version is not supported.

#When a host cannot update itself

The console shows Self-update not possible on the host (and can notify you) when:

Also see Agent problems.