Install the agent
The ghostpsy agent is a single Go binary that runs on Linux servers. It does not run as root.
Requirements
- Linux with systemd (Debian 9+, Ubuntu 16+, RHEL/CentOS 7+, Fedora, SUSE) or Upstart (RHEL/CentOS 6)
- Root access for the install itself, to create the user and the sudo rule
- Outbound HTTPS to the ghostpsy API. Nothing listens on your server.
Install
- Log in to the ghostpsy dashboard
- Click + Add machine
- Copy the one-line command and run it on your server
curl -fsSL https://raw.githubusercontent.com/ghostpsy/agent-linux/main/run-agent.sh \
| sudo bash -s -- --token="<the code from the dashboard>"
That is the whole install. It takes about two minutes.
The code works once and stops working after 24 hours.
What it does to your server
| Step | What |
|---|---|
| 1 | Installs sudo, if your server does not have it |
| 2 | Downloads the agent and checks its SHA256, then installs /usr/local/bin/ghostpsy |
| 3 | Creates a locked ghostpsy system user. It cannot log in and has no password. |
| 4 | Installs a sudo rule listing every command the agent may run as root — and nothing else |
| 5 | Registers this machine and runs the first scan |
| 6 | Starts a background service that scans once a day |
Prefer to look first?
Nothing below installs anything.
# Read the script
curl -fsSL https://raw.githubusercontent.com/ghostpsy/agent-linux/main/run-agent.sh -o install.sh
less install.sh
# See every change it would make
sudo bash install.sh --dry-run
# Install only the binary — no user, no service, no sudo rule
sudo bash install.sh --binary-only
# Then read exactly what rights it wants
ghostpsy sudoers
Why it does not run as root
The agent needs to read things only root can read: the effective SSH settings, firewall rules, pending security updates. There are two ways to do that — run everything as root, or run as a small locked user that sudo allows a fixed list of exact commands.
We chose the second. The list lives in /etc/sudoers.d/ghostpsy, every line carries its reason, and the agent refuses any command that is not in it — before sudo is ever asked.
# read the firewall rules, to count them and spot an open default policy
ghostpsy ALL=(root) NOPASSWD: /usr/sbin/iptables-save
Read the whole grant at any time:
ghostpsy sudoers # what this version needs
ghostpsy sudoers --check # does the installed rule still match?
ghostpsy sudoers --diff # what an upgrade would change
There is no root mode. If sudo cannot be installed, ghostpsy does not install.
Day to day
ghostpsy status # healthy? when is the next scan?
sudo ghostpsy scan --dry-run # see exactly what would be sent, send nothing
sudo ghostpsy scan --yes # scan now, without waiting for the schedule
sudo ghostpsy update # signed self-update
The scan runs once a day at a time chosen from your machine's identity, so a fleet of servers does not all report at the same moment.
Removing it
sudo ghostpsy uninstall # service, sudo rule and binary. Keeps config and state.
sudo ghostpsy uninstall --purge # the above, plus everything else. Leaves nothing.
Without --purge, reinstalling later keeps this machine's identity and its history in the dashboard. Your scan history stays in the dashboard either way.