Linux Agent¶

The SentriKat Linux Agent is a shell script (sentrikat-agent-linux.sh) that collects installed software inventory (dpkg/rpm/snap/flatpak and more) and reports it to your SentriKat instance. Installed, it runs as systemd units: an inventory timer (default: every 4 hours) plus a lightweight heartbeat timer (every 5 minutes, polls for commands).

Requirements¶

Any systemd-based distro (Ubuntu 20.04+, Debian 11+, RHEL 8+, SLES, …)
bash, curl — present on any standard install
Root for the install step
Network access to your SentriKat server (HTTPS recommended)

Installation¶

Two official ways — both give every machine its own key.

One or a few machines (recommended)Many machines (install token)

In SentriKat go to Integrations → Agent Deploy → Deploy on a machine
Click Linux — this downloads sentrikat-agent-linux.sh with a unique per-host key already baked in (nothing to paste)
Copy it to the target machine and run:

sudo bash ./sentrikat-agent-linux.sh --install

Integrations → Agent Deploy → Mass / automated deploy → Create Install Token — copy the ready-made command (shown once)
Push the script + command with your tooling (Ansible, Salt, SSH loop):

sudo bash ./sentrikat-agent-linux.sh --install \
  --server-url "https://sentrikat.company.com" --enroll-token "<token>"

Each machine exchanges the token once for its own per-host key; revoke the token anytime without touching enrolled machines.

The installer copies the agent to a stable path — after install the command is simply sentrikat-agent (in /usr/local/bin).

Useful options¶

Option	Meaning
`--server-url <url>`	Override the server URL baked into the download
`--enroll-token <t>`	Enroll via install token (mass deploy)
`--interval <hours>`	Scan interval (default `4`)
`--proxy-url <url>`	HTTP/HTTPS/SOCKS proxy
`--ca-cert <path>`	Custom CA bundle (TLS-inspecting proxies / internal PKI)
`--allow-http`	Permit plain HTTP (labs only)
`--run-once`	Single scan now, no install
`--diagnose`	Connectivity self-test (DNS/TCP/TLS/auth) + log bundle
`--verbose`	Verbose output
`--uninstall`	Remove units, binary and config

Verify it works¶

systemctl status sentrikat-agent.timer      # inventory scans
systemctl status sentrikat-heartbeat.timer  # command polling
tail -n 20 /var/log/sentrikat-agent.log

Within a minute the machine appears in SentriKat under Inventory → Endpoints and on Agent Activity with a "last seen" timestamp. Config lives at /etc/sentrikat/agent.conf.

Run a scan manually at any time:

sudo sentrikat-agent --run-once

What gets collected¶

Installed packages (dpkg, rpm, snap, flatpak), OS release info and the hostname — metadata only, no file contents. Optional capabilities (container image scanning, code dependency scanning) are opt-in per agent key: see Container Scanning and Extension & Dependency Scanning.

Troubleshooting¶

Symptom	Fix
Install works on the server, other machines can't connect	the download baked in a `localhost` URL — set a network-reachable `SENTRIKAT_URL` in SentriKat and re-download, or pass `--server-url <url>`
TLS errors behind corporate proxy/PKI	`--ca-cert /path/ca.pem` and/or `--proxy-url http://proxy:3128`
Timer not firing	`systemctl list-timers \| grep sentrikat` and `journalctl -u sentrikat-agent.service -n 50`
Anything else	`sudo sentrikat-agent --diagnose` — DNS/TCP/TLS/auth self-test with a log bundle you can attach to a support request

Uninstall¶

sudo sentrikat-agent --uninstall