Installation – openSuse

This document describes the official installation procedure for BastionGuard on Opensuse distributions. Include Tumbleweed

The instructions below are intended for system administrators and advanced users.

The wizard will create a bridge for clamd.service as it is needed by the program, it does not affect the daily use of the system at all

CEF support is currently unavailable on Tumbleweed and Leap 16

Supported Platforms

Tumbleweed
Leap 16

Required Privileges

Installation and configuration require root privileges. Several components rely on:

systemd services
Polkit (pkexec)
DNS and network configuration
Filesystem access under /usr, /etc, and /var

Install Dependencies ( openSuse Tumbleweed )

Install all required build-time and runtime dependencies:

sudo zypper refresh
sudo zypper install -y \
  gcc-c++ \
  cmake \
  make \
  ninja \
  pkgconf-pkg-config \
  git \
  rsync \
  tar \
  gzip \
  patch \
  findutils \
  which \
  gettext-tools \
  python311 \
  'pkgconfig(gtk4)' \
  'pkgconfig(gtkmm-4.0)' \
  'pkgconfig(glib-2.0)' \
  'pkgconfig(glibmm-2.68)' \
  'pkgconfig(giomm-2.68)' \
  'pkgconfig(pangomm-2.48)' \
  'pkgconfig(sigc++-3.0)' \
  'pkgconfig(libudev)' \
  'pkgconfig(libsoup-3.0)' \
  'pkgconfig(libsecret-1)' \
  'pkgconfig(libsystemd)' \
  'pkgconfig(libidn2)' \
  'pkgconfig(sqlite3)' \
  'pkgconfig(libcurl)' \
  'pkgconfig(openssl)' \
  'pkgconfig(polkit-gobject-1)' \
  'pkgconfig(yara)' \
  'pkgconfig(re2)' \
  nlohmann_json-devel \
  boost-devel \
  libboost_thread-devel \
  'pkgconfig(hyperscan)' \
  'pkgconfig(libpng)' \
  'pkgconfig(libjpeg)' \
  'pkgconfig(libtiff-4)' \
  'pkgconfig(libwebp)' \
  'pkgconfig(fribidi)' \
  'pkgconfig(nspr)' \
  'pkgconfig(nss)' \
  'pkgconfig(x11)' \
  'pkgconfig(xcursor)' \
  'pkgconfig(xrandr)' \
  'pkgconfig(xi)' \
  'pkgconfig(xinerama)' \
  'pkgconfig(xdamage)' \
  'pkgconfig(xcomposite)' \
  'pkgconfig(xfixes)' \
  'pkgconfig(xkbcommon)' \
  'pkgconfig(wayland-client)' \
  'pkgconfig(wayland-protocols)' \
  'pkgconfig(alsa)' \
  'pkgconfig(libpipewire-0.3)' \
  samba-devel \
  meson \
  vala \
  'pkgconfig(gio-unix-2.0)' \
  'pkgconfig(json-glib-1.0)' \
  'pkgconfig(vte-2.91-gtk4)' \
  'pkgconfig(gee-0.8)' \
  help2man \
  go \
  protobuf-devel \
  grpc-devel \
  'pkgconfig(shumate-1.0)' \
  libnetfilter_queue-devel \
  clang \
  libvte-2_91-0 \
  vte-devel \
  typelib-1_0-Vte-2_91 \
  bubblewrap \
  polkit \
  nginx \
  php8-fpm \
  dnsmasq \
  clamav \
  yara \
  curl \
  mozilla-nss \
  mozilla-nss-tools \
  sudo \
  patchelf \
  'pkgconfig(libzstd)' \
  lzo-devel \
  libbpf1 \
  libbpf-devel \
  libbpf-tools \
  bpftool

Install Dependencies ( openSuse Leap 16 )

Install all required build-time and runtime dependencies:

sudo zypper refresh && sudo zypper install -y --no-recommends \
binutils cmake file findutils gcc-c++ gettext-tools git gzip make ninja patch \
pkgconf-pkg-config rsync tar which python3 python3-devel \
'pkgconfig(gtk4)' 'pkgconfig(gtkmm-4.0)' 'pkgconfig(glib-2.0)' \
'pkgconfig(glibmm-2.68)' 'pkgconfig(giomm-2.68)' 'pkgconfig(pangomm-2.48)' \
'pkgconfig(sigc++-3.0)' 'pkgconfig(libudev)' 'pkgconfig(libsoup-3.0)' \
'pkgconfig(libsecret-1)' 'pkgconfig(libsystemd)' 'pkgconfig(libidn2)' \
'pkgconfig(sqlite3)' 'pkgconfig(libcurl)' 'pkgconfig(openssl)' \
'pkgconfig(polkit-gobject-1)' 'pkgconfig(yara)' 'pkgconfig(re2)' \
nlohmann_json-devel boost-devel libboost_atomic-devel libboost_system-devel \
libboost_thread-devel 'pkgconfig(libpng)' 'pkgconfig(libjpeg)' \
'pkgconfig(libtiff-4)' 'pkgconfig(libwebp)' 'pkgconfig(fribidi)' \
'pkgconfig(nspr)' 'pkgconfig(nss)' 'pkgconfig(x11)' 'pkgconfig(xcursor)' \
'pkgconfig(xrandr)' 'pkgconfig(xi)' 'pkgconfig(xinerama)' \
'pkgconfig(xdamage)' 'pkgconfig(xcomposite)' 'pkgconfig(xfixes)' \
'pkgconfig(xkbcommon)' 'pkgconfig(wayland-client)' \
'pkgconfig(wayland-protocols)' 'pkgconfig(alsa)' \
'pkgconfig(libpipewire-0.3)' samba-devel meson vala \
'pkgconfig(gio-unix-2.0)' 'pkgconfig(json-glib-1.0)' \
'pkgconfig(vte-2.91-gtk4)' 'pkgconfig(gee-0.8)' help2man go \
protobuf-devel grpc-devel 'pkgconfig(shumate-1.0)' \
libnetfilter_queue-devel clang libbpf-devel 'pkgconfig(libzstd)' lzo-devel \
bubblewrap clamav curl dnsmasq mozilla-nss mozilla-nss-tools nginx polkit \
sudo yara libyara-devel patchelf system-user-wwwrun

Build BastionGuard

mkdir build && cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_SYSTEMD_SERVICES=ON -DCMAKE_INSTALL_SYSCONFDIR=/etc -DENABLE_USER_AGENT_AUTO=ON -DINSTALL_NGINX_DEFAULTS=ON -DENABLE_CEF=OFF -DENABLE_EMBEDDED_CEF=ON -DENABLE_CEF_DAEMON=OFF -DENABLE_SYSTEM_CA_INSTALL=OFF 

make -j$(nproc)
sudo make install

Post-Installation Configuration

Network Configuration

sudo ip addr add 127.0.0.2/8 dev lo
sudo systemctl restart NetworkManager dnsmasq

dnsmasq Configuration

Create the configuration directory if missing:

sudo mkdir -p /etc/dnsmasq.d

Create /etc/dnsmasq.d/BastionGuard.conf with the following content:

listen-address=127.0.0.1,127.0.0.2
bind-interfaces

Ensure the following line is enabled in /etc/dnsmasq.conf:

conf-dir=/etc/dnsmasq.d/,*.conf

Change port dnsmash

sudo sed -i 's/^port=.*/port=5353/' /etc/dnsmasq.conf

Clamav configuration

Add the following lines of code to clamd.conf or clamd-scan.conf in /etc/clamav or /etc:

# Exclude the UID of the scanner itself from checking, to prevent loops
OnAccessExcludeUname clamav or vscan or clamscan


# Alternatively, add some directories instead of mount points
OnAccessIncludePath /home/username/folder_custom

# Prevention doesn't work with OnAccessMountPath.
# It works with OnAccessIncludePath, as long as /usr and /etc are not included.
# Including /var while activating prevention is also not recommended, because
# this would slow down package installation by a factor of 1000.
OnAccessPrevention no

# Perform scans on newly created, moved, or renamed files
OnAccessExtraScanning yes

# Optionallyexclude root-owned processes
# OnAccessExcludeRootUID true

AppArmor Adjustments

Disable AppArmor Profiles for ClamAV

sudo aa-disable usr.bin.clamonacc
sudo aa-disable usr.bin.clamd
sudo systemctl reload apparmor
sudo systemctl restart clamav-daemon

The wizard will perform all the required processes and finally, when starting the software, a first run will ask you to enable all services.

User and Group Configuration

sudo usermod -aG vscan $USER
sudo chown root:vscan /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

IMPORTANT: Logout and login is required after this step.

Enable Required Services

BastionGuard requires the following system services to be enabled and running:

nginx
php-fpm
clamav-daemon
clamav-clamonacc
clamav-freshclam
dnsmasq

Enable and start them with:

systemctl enable --now nginx php-fpm  clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon

Verification

To verify that all services are running correctly, use:

systemctl status nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon

Make sure that all services are listed as active (running).

A system reboot is strongly recommended after enabling services.

Uninstall

sudo make uninstall

This document covers only OpenSuse installations. Other distributions are documented separately.

Published on: 29 January 2026

Last updated on: 21 July 2026