Installation – Fedora

This document describes the official installation procedure for BastionGuard on Fedora distributions. Include

The instructions below are intended for system administrators and advanced users.

The wizard will create a bridge for clamd@scan as it is needed by the program, it does not affect the daily use of the system at all.

CEF support is currently unavailable on Fedora, RHEL, Rocky and AlmaLinux due to SELinux restrictions that prevent proper operation, even with dedicated SELinux policies in place.

Supported Platforms

Fedora 44

Required Privileges

Installation and configuration require root privileges. Several components rely on:

systemd services
Polkit (pkexec)
DNS and network configuration
Filesystem access under /usr, /etc, and /var

Install Dependencies (Fedora 44)

Install all required build-time and runtime dependencies:

sudo dnf install -y \
  gcc-c++ \
  cmake \
  make \
  pkgconf-pkg-config \
  gettext \
  python3 \
  rsync \
  git \
  systemd-rpm-macros \
  gtkmm4.0-devel \
  glibmm2.68-devel \
  pangomm2.48-devel \
  libsigc++30-devel \
  libsoup3-devel \
  libsecret-devel \
  systemd-devel \
  libidn2-devel \
  sqlite-devel \
  libcurl-devel \
  openssl-devel \
  boost-devel \
  re2-devel \
  vectorscan-devel \
  nlohmann-json-devel \
  yara-devel \
  polkit-devel \
  libffi-devel \
  zlib-devel \
  pcre2-devel \
  libpng-devel \
  libjpeg-turbo-devel \
  libtiff-devel \
  libwebp-devel \
  nss-devel \
  nspr-devel \
  fribidi-devel \
  libX11-devel \
  libXcursor-devel \
  libXrandr-devel \
  libXi-devel \
  libXinerama-devel \
  libXdamage-devel \
  libXcomposite-devel \
  libxkbcommon-devel \
  wayland-devel \
  alsa-lib-devel \
  pipewire-jack-audio-connection-kit-devel \
  libsmbclient-devel \
  libzstd-devel \
  lzo-devel \
  nginx \
  php-fpm \
  dnsmasq \
  polkit \
  yara \
  bubblewrap \
  clamav \
  clamav-freshclam \
  clamd \
  curl \
  nss \
  nss-tools \
  sudo \
  meson \
  ninja-build \
  vala \
  gtk4-devel \
  glib2-devel \
  json-glib-devel \
  vte291-gtk4-devel \
  libgee-devel \
  help2man \
  vte291 \
  vte291-devel \
  golang \
  protobuf-compiler \
  protobuf-devel \
  grpc-plugins \
  grpc-devel \
  libshumate-devel \
  libnetfilter_queue-devel \
  libbpf \
  libbpf-devel \
  libbpf-tools \
  bpftool \
  clang \
  patchelf

Build BastionGuard

mkdir build && cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_SYSTEMD_SERVICES=ON -DCMAKE_INSTALL_SYSCONFDIR=/etc -DENABLE_USER_AGENT_AUTO=ON -DINSTALL_NGINX_DEFAULTS=ON -DENABLE_CEF=ON -DENABLE_CEF_DAEMON=OFF -DENABLE_SYSTEM_CA_INSTALL=OFF -DBASTIONGUARD_INIT_SYSTEM=AUTO

make -j$(nproc)
sudo make install

Post-Installation Configuration

Network Configuration

sudo ip addr add 127.0.0.2/8 dev lo
sudo systemctl restart NetworkManager dnsmasq

dnsmasq Configuration

Create the configuration directory if missing:

sudo mkdir -p /etc/dnsmasq.d

Create /etc/dnsmasq.d/BastionGuard.conf with the following content:

listen-address=127.0.0.1,127.0.0.2
bind-interfaces

Ensure the following line is enabled in /etc/dnsmasq.conf:

conf-dir=/etc/dnsmasq.d/,*.conf

Change port dnsmash

sudo sed -i 's/^port=.*/port=5353/' /etc/dnsmasq.conf

Clamav configuration

Add the following lines of code to clamd.conf or clamd-scan.conf in /etc/clamav or /etc:

# Exclude the UID of the scanner itself from checking, to prevent loops
OnAccessExcludeUname clamav or vscan or clamscan


# Alternatively, add some directories instead of mount points
OnAccessIncludePath /home/username/folder_custom

# Prevention doesn't work with OnAccessMountPath.
# It works with OnAccessIncludePath, as long as /usr and /etc are not included.
# Including /var while activating prevention is also not recommended, because
# this would slow down package installation by a factor of 1000.
OnAccessPrevention no

# Perform scans on newly created, moved, or renamed files
OnAccessExtraScanning yes

# Optionallyexclude root-owned processes
# OnAccessExcludeRootUID true

SeLinux Adjustments

SeLinux Profiles for ClamAV

setsebool -P antivirus_can_scan_system 1
sudo setsebool -P httpd_can_network_connect 1
sudo setsebool -P httpd_can_network_relay 1 2>/dev/null || true
sudo setsebool -P httpd_can_connect_http 1 2>/dev/null || true
sudo semanage permissive -a dnsmasq_t
sudo ausearch -c 'dnsmasq' --raw | audit2allow -M local-dnsmasq
sudo semodule -i local-dnsmasq.pp

The wizard will perform all the required processes and finally, when starting the software, a first run will ask you to enable all services.

Firewalld

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=81/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --permanent --add-port=444/tcp
sudo systemctl reload firewalld

User and Group Configuration

sudo usermod -aG virusgroup $USER
sudo usermod -aG clamscan $USER
sudo chown root:clamscan /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

IMPORTANT: Logout and login is required after this step.

Enable Required Services

BastionGuard requires the following system services to be enabled and running:

nginx
php-fpm
clamav-daemon
clamav-clamonacc
clamav-freshclam
dnsmasq
bsc-daemon

Enable and start them with:

systemctl enable --now nginx php-fpm clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon clamd@scan

Verification

To verify that all services are running correctly, use:

systemctl status nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon clamd@scan

Make sure that all services are listed as active (running).

A system reboot is strongly recommended after enabling services.

Uninstall

sudo make uninstall

This document covers only Fedora installations. Other distributions are documented separately.

Published on: 29 January 2026

Last updated on: 21 July 2026