Installation – ArchLinux

This document describes the official installation procedure for BastionGuard on ArchLinux distributions.

The instructions below are intended for system administrators and advanced users.

Supported Platforms

  • ArchLinux

Required Privileges

Installation and configuration require root privileges. Several components rely on:

  • systemd services
  • Polkit (pkexec)
  • DNS and network configuration
  • Filesystem access under /usr, /etc, and /var

Install Dependencies

Install all required build-time and runtime dependencies:

sudo pacman -S --needed \
  glibc gcc-libs \
  gtkmm-4.0 gtk4 glib2 glibmm pangomm-2.48 pango cairomm cairo \
  harfbuzz gdk-pixbuf2 graphene libsigc++-3.0 \
  boost-libs boost libsoup3 libsecret curl openssl sqlite libidn2 \
  re2 yara polkit systemd-libs smbclient nlohmann-json sudo \
  nss nspr libglvnd vulkan-icd-loader mesa libdrm \
  alsa-lib dbus at-spi2-core \
  libxcomposite libxdamage libxrandr libxfixes libxkbcommon \
  vte4 vte3 libgee json-glib grpc protobuf \
  libshumate libnetfilter_queue libbpf help2man bcc-libbpf-tools bpf zstd lzo \
  nginx php clamav dnsmasq bubblewrap rsync \
  cmake pkgconf gettext python \
  meson ninja mm-common cargo-c hyperscan \
  vala go clang

Build BastionGuard

mkdir build && cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_SYSTEMD_SERVICES=ON -DCMAKE_INSTALL_SYSCONFDIR=/etc -DENABLE_USER_AGENT_AUTO=ON -DINSTALL_NGINX_DEFAULTS=ON -DBASTIONGUARD_INIT_SYSTEM=AUTO

make -j$(nproc)
sudo make install

Post-Installation Configuration

Network Configuration

sudo ip addr add 127.0.0.2/8 dev lo
sudo systemctl restart NetworkManager dnsmasq

dnsmasq Configuration

Create the configuration directory if missing:

sudo mkdir -p /etc/dnsmasq.d

Create /etc/dnsmasq.d/BastionGuard.conf with the following content:

listen-address=127.0.0.1,127.0.0.2
bind-interfaces

Ensure the following line is enabled in /etc/dnsmasq.conf:

conf-dir=/etc/dnsmasq.d/,*.conf

Change port dnsmash

sudo sed -i 's/^port=.*/port=53/' /etc/dnsmasq.conf

Clamav configuration

Add the following lines of code to clamd.conf or clamd-scan.conf in /etc/clamav or /etc:

# Exclude the UID of the scanner itself from checking, to prevent loops
OnAccessExcludeUname clamav or vscan or clamscan


# Alternatively, add some directories instead of mount points
OnAccessIncludePath /home/username/folder_custom

# Prevention doesn't work with OnAccessMountPath.
# It works with OnAccessIncludePath, as long as /usr and /etc are not included.
# Including /var while activating prevention is also not recommended, because
# this would slow down package installation by a factor of 1000.
OnAccessPrevention no

# Perform scans on newly created, moved, or renamed files
OnAccessExtraScanning yes

# Optionallyexclude root-owned processes
# OnAccessExcludeRootUID true

AppArmor Adjustments

Disable AppArmor Profiles for ClamAV

sudo aa-disable usr.bin.clamonacc
sudo aa-disable usr.bin.clamd
sudo systemctl reload apparmor
sudo systemctl restart clamav-daemon

The wizard will perform all the required processes and finally, when starting the software, a first run will ask you to enable all services.

User and Group Configuration

sudo usermod -aG clamav $USER
sudo chown root:clamav /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

IMPORTANT: Logout and login is required after this step.

Enable Required Services

BastionGuard requires the following system services to be enabled and running:

  • nginx
  • php-fpm
  • clamav-daemon
  • clamav-clamonacc
  • clamav-freshclam
  • dnsmasq
  • bsc-daemon

Enable and start them with:

systemctl enable --now nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon

Verification

To verify that all services are running correctly, use:

systemctl status nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq

Make sure that all services are listed as active (running).

A system reboot is strongly recommended after enabling services.

Uninstall

sudo make uninstall

This document covers only ArchLinux installations. Other distributions are documented separately.

Published on:
Last updated on: