Installation – Debian / Ubuntu

CEF support is currently unavailable on Debian/Ubuntu and Linux Mint

This document describes the official installation procedure for BastionGuard on Debian-based distributions, including Debian 13 and Ubuntu.

The instructions below are intended for system administrators and advanced users.

Supported Platforms

  • Debian 13
  • Ubuntu (including LTS releases)

Required Privileges

Installation and configuration require root privileges. Several components rely on:

  • systemd services
  • Polkit (pkexec)
  • DNS and network configuration
  • Filesystem access under /usr, /etc, and /var

Install Dependencies (Debian 13 )

Install all required build-time and runtime dependencies:

sudo apt update && sudo apt install -y \
  clamav \
  clamav-daemon \
  clamav-freshclam \
  nginx \
  php-fpm \
  polkitd \
  dnsmasq \
  rsync \
  curl \
  yara \
  libnss3 \
  libnss3-tools \
  debhelper-compat \
  build-essential \
  cmake \
  pkg-config \
  gettext \
  libgtkmm-4.0-dev \
  libsigc++-3.0-dev \
  libsoup-3.0-dev \
  libsecret-1-dev \
  libudev-dev \
  libidn2-dev \
  libsqlite3-dev \
  libcurl4-openssl-dev \
  libssl-dev \
  libboost-thread-dev \
  libre2-dev \
  libhyperscan-dev \
  nlohmann-json3-dev \
  libyara-dev \
  libpolkit-gobject-1-dev \
  libsmbclient-dev \
  libsystemd-dev \
  meson \
  ninja-build \
  python3 \
  git \
  libffi-dev \
  zlib1g-dev \
  libmount-dev \
  libpcre2-dev \
  libpng-dev \
  libjpeg-dev \
  libtiff-dev \
  libwebp-dev \
  libfribidi-dev \
  libx11-dev \
  libxcursor-dev \
  libxrandr-dev \
  libxi-dev \
  libxinerama-dev \
  libxdamage-dev \
  libxcomposite-dev \
  libxfixes-dev \
  libxkbcommon-dev \
  libwayland-dev \
  wayland-protocols \
  libasound2-dev \
  libglibmm-2.4-dev \
  libglibmm-2.68-dev \
  libpangomm-2.48-dev \
  gperf \
  libxml2-dev \
  libgstreamer1.0-dev \
  libgstreamer-plugins-base1.0-dev \
  libgstreamer-plugins-bad1.0-dev \
  valac \
  libgtk-4-dev \
  libglib2.0-dev \
  libjson-glib-dev \
  libvte-2.91-gtk4-dev \
  libgee-0.8-dev \
  golang-go \
  protobuf-compiler \
  protobuf-compiler-grpc \
  libprotobuf-dev \
  libgrpc++-dev \
  libshumate-dev \
  libnetfilter-queue-dev \
  libbpf-dev \
  clang \
  libgtk-3-dev \
  help2man \
  libbpf1 \
  libbpf-tools \
  bpftool \
  libzstd-dev \
  liblzo2-dev \
  libvte-2.91-0 \
  libvte-2.91-dev \
  gir1.2-vte-2.91

Install Dependencies (Ubuntu )

Install all required build-time and runtime dependencies:

sudo apt update && sudo apt install -y \
  build-essential \
  cmake \
  pkg-config \
  gettext \
  libgtkmm-4.0-dev \
  libsigc++-3.0-dev \
  libsoup-3.0-dev \
  libsecret-1-dev \
  libudev-dev \
  libcups2 \
  libcups2-dev \
  libidn2-dev \
  libsqlite3-dev \
  libcurl4-openssl-dev \
  libssl-dev \
  libboost-thread-dev \
  libre2-dev \
  libhyperscan-dev \
  nlohmann-json3-dev \
  libyara-dev \
  libpolkit-gobject-1-dev \
  libsmbclient-dev \
  libsystemd-dev \
  rsync \
  meson \
  ninja-build \
  python3 \
  git \
  libffi-dev \
  zlib1g-dev \
  libmount-dev \
  libpcre2-dev \
  libpng-dev \
  libjpeg-dev \
  libtiff-dev \
  libwebp-dev \
  libfribidi-dev \
  libx11-dev \
  libxcursor-dev \
  libxrandr-dev \
  libxi-dev \
  libxinerama-dev \
  libxdamage-dev \
  libxcomposite-dev \
  libxfixes-dev \
  libxkbcommon-dev \
  libwayland-dev \
  wayland-protocols \
  libasound2-dev \
  libglibmm-2.4-dev \
  libglibmm-2.68-dev \
  libpangomm-2.48-dev \
  gperf \
  libxml2-dev \
  libgstreamer1.0-dev \
  libgstreamer-plugins-base1.0-dev \
  libgstreamer-plugins-bad1.0-dev \
  valac \
  libgtk-4-dev \
  libglib2.0-dev \
  libjson-glib-dev \
  libvte-2.91-gtk4-dev \
  libgee-0.8-dev \
  golang-go \
  protobuf-compiler \
  protobuf-compiler-grpc \
  libprotobuf-dev \
  libgrpc++-dev \
  libshumate-dev \
  libnetfilter-queue-dev \
  libbpf-dev \
  clang \
  libgtk-3-dev \
  help2man \
  libbpf1 \
  libbpf-tools \
  linux-tools-common \
  linux-tools-generic \
  libzstd-dev \
  liblzo2-dev \
  libvte-2.91-0 \
  libvte-2.91-dev \
  gir1.2-vte-2.91 \
  clamav \
  clamav-daemon \
  clamav-freshclam \
  nginx \
  php-fpm \
  polkitd \
  dnsmasq \
  yara \
  curl \
  libnss3 \
  libnss3-tools

Build BastionGuard Debian 13

mkdir build && cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_SYSTEMD_SERVICES=ON -DCMAKE_INSTALL_SYSCONFDIR=/etc -DENABLE_USER_AGENT_AUTO=ON -DINSTALL_NGINX_DEFAULTS=ON 

make -j$(nproc)
sudo make install

Build BastionGuard Ubuntu

mkdir build && cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_SYSTEMD_SERVICES=ON -DCMAKE_INSTALL_SYSCONFDIR=/etc -DENABLE_USER_AGENT_AUTO=ON -DINSTALL_NGINX_DEFAULTS=ON -DENABLE_CEF=OFF 

make -j$(nproc)
sudo make install

Post-Installation Configuration

Network Configuration

sudo ip addr add 127.0.0.2/8 dev lo
sudo systemctl restart NetworkManager dnsmasq

dnsmasq Configuration

Create the configuration directory if missing:

sudo mkdir -p /etc/dnsmasq.d

Create /etc/dnsmasq.d/BastionGuard.conf with the following content:

listen-address=127.0.0.1,127.0.0.2
bind-interfaces

Ensure the following line is enabled in /etc/dnsmasq.conf:

conf-dir=/etc/dnsmasq.d/,*.conf

Clamav configuration

Add the following lines of code to clamd.conf or clamd-scan.conf in /etc/clamav or /etc:

# Exclude the UID of the scanner itself from checking, to prevent loops
OnAccessExcludeUname clamav or vscan or clamscan


# Alternatively, add some directories instead of mount points
OnAccessIncludePath /home/username/folder_custom

# Prevention doesn't work with OnAccessMountPath.
# It works with OnAccessIncludePath, as long as /usr and /etc are not included.
# Including /var while activating prevention is also not recommended, because
# this would slow down package installation by a factor of 1000.
OnAccessPrevention no

# Perform scans on newly created, moved, or renamed files
OnAccessExtraScanning yes

# Optionallyexclude root-owned processes
# OnAccessExcludeRootUID true

AppArmor Adjustments

Disable AppArmor Profiles for ClamAV

sudo aa-disable usr.bin.clamonacc
sudo aa-disable usr.bin.clamd
sudo systemctl reload apparmor
sudo systemctl restart clamav-daemon

User and Group Configuration

sudo usermod -aG clamav $USER
sudo chown root:clamav /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

IMPORTANT: Logout and login is required after this step.

Enable Required Services

BastionGuard requires the following system services to be enabled and running:

  • nginx
  • php-fpm
  • clamav-daemon
  • clamav-clamonacc
  • clamav-freshclam
  • dnsmasq
  • bsc-daemon

Enable and start them with:

systemctl enable --now nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon

Verification

To verify that all services are running correctly, use:

systemctl status nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon

Make sure that all services are listed as active (running).

A system reboot is strongly recommended after enabling services.

Warning: the wizard will perform all the required processes and finally, when starting the software, a first run will ask you to enable all services.

Uninstall

sudo make uninstall

This document covers only Debian-based installations. Other distributions are documented separately.

Published on:
Last updated on: