Installation – Mageia 10

This document describes the official installation procedure for BastionGuard on Mageia 10. Include

The instructions below are intended for system administrators and advanced users.

CEF support is currently unavailable on Mageia 10.

Supported Platforms

  • Mageia 10

Required Privileges

Installation and configuration require root privileges. Several components rely on:

  • systemd services
  • Polkit (pkexec)
  • DNS and network configuration
  • Filesystem access under /usr, /etc, and /var

Install Dependencies (Mageia 10)

Install all required build-time and runtime dependencies:

sudo dnf -y \
  gcc-c++ \
  cmake \
  make \
  pkgconf-pkg-config \
  gettext \
  python3 \
  rsync \
  git \
  systemd \
  bash \
  curl \
  file \
  binutils \
  autoconf \
  automake \
  libtool \
  flex \
  bison \
  'pkgconfig(gtkmm-4.0)' \
  'pkgconfig(giomm-2.68)' \
  'pkgconfig(pangomm-2.48)' \
  'pkgconfig(sigc++-3.0)' \
  'pkgconfig(libsoup-3.0)' \
  'pkgconfig(libsecret-1)' \
  'pkgconfig(libsystemd)' \
  'pkgconfig(libudev)' \
  'pkgconfig(libidn2)' \
  'pkgconfig(sqlite3)' \
  'pkgconfig(libcurl)' \
  'pkgconfig(openssl)' \
  boost-devel \
  'pkgconfig(re2)' \
  'pkgconfig(libhs)' \
  json-devel \
  'pkgconfig(polkit-gobject-1)' \
  'pkgconfig(libffi)' \
  'pkgconfig(zlib)' \
  'pkgconfig(libpcre2-8)' \
  'pkgconfig(libpng)' \
  'pkgconfig(libjpeg)' \
  'pkgconfig(libtiff-4)' \
  'pkgconfig(libwebp)' \
  'pkgconfig(nss)' \
  'pkgconfig(nspr)' \
  'pkgconfig(fribidi)' \
  'pkgconfig(x11)' \
  'pkgconfig(xcursor)' \
  'pkgconfig(xrandr)' \
  'pkgconfig(xi)' \
  'pkgconfig(xinerama)' \
  'pkgconfig(xdamage)' \
  'pkgconfig(xcomposite)' \
  'pkgconfig(xkbcommon)' \
  'pkgconfig(wayland-client)' \
  'pkgconfig(alsa)' \
  'pkgconfig(libpipewire-0.3)' \
  'pkgconfig(smbclient)' \
  'pkgconfig(libzstd)' \
  'pkgconfig(lzo2)' \
  nginx \
  meson \
  ninja \
  vala \
  'pkgconfig(gtk+-3.0)' \
  'pkgconfig(gio-2.0)' \
  'pkgconfig(vte-2.91-gtk4)' \
  'pkgconfig(gtk4)' \
  'pkgconfig(gio-unix-2.0)' \
  'pkgconfig(json-glib-1.0)' \
  'pkgconfig(vte-2.91)' \
  'pkgconfig(gee-0.8)' \
  help2man \
  golang \
  protobuf-compiler \
  'pkgconfig(protobuf)' \
  grpc-plugins \
  'pkgconfig(grpc)' \
  'pkgconfig(grpc++)' \
  'pkgconfig(shumate-1.0)' \
  'pkgconfig(libnetfilter_queue)' \
  'pkgconfig(libnfnetlink)' \
  'pkgconfig(libmnl)' \
  'pkgconfig(libelf)' \
  lib64bpf-devel \
  bpftool \
  clang \
  llvm \
  patchelf \
  php-fpm \
  dnsmasq \
  polkit \
  bubblewrap \
  clamav \
  clamav-db \
  clamd \
  nss \
  nss-tools

Build BastionGuard

mkdir build && cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_SYSTEMD_SERVICES=ON -DCMAKE_INSTALL_SYSCONFDIR=/etc -DENABLE_USER_AGENT_AUTO=ON -DINSTALL_NGINX_DEFAULTS=ON -DENABLE_CEF=ON -DENABLE_CEF_DAEMON=OFF -DENABLE_SYSTEM_CA_INSTALL=OFF -DBASTIONGUARD_INIT_SYSTEM=SYSTEMD 
-DBASTIONGUARD_ROOTGUARD_INIT_SYSTEM=systemd 

make -j$(nproc)
sudo make install

Post-Installation Configuration

Network Configuration

sudo ip addr add 127.0.0.2/8 dev lo
sudo systemctl restart NetworkManager dnsmasq

dnsmasq Configuration

Create the configuration directory if missing:

sudo mkdir -p /etc/dnsmasq.d

Create /etc/dnsmasq.d/BastionGuard.conf with the following content:

listen-address=127.0.0.1,127.0.0.2
bind-interfaces

Ensure the following line is enabled in /etc/dnsmasq.conf:

conf-dir=/etc/dnsmasq.d/,*.conf

Change port dnsmash

sudo sed -i 's/^port=.*/port=5353/' /etc/dnsmasq.conf

Clamav configuration

Add the following lines of code to clamd.conf or clamd-scan.conf in /etc/clamav or /etc:

# Exclude the UID of the scanner itself from checking, to prevent loops
OnAccessExcludeUname clamav or vscan or clamscan


# Alternatively, add some directories instead of mount points
OnAccessIncludePath /home/username/folder_custom

# Prevention doesn't work with OnAccessMountPath.
# It works with OnAccessIncludePath, as long as /usr and /etc are not included.
# Including /var while activating prevention is also not recommended, because
# this would slow down package installation by a factor of 1000.
OnAccessPrevention no

# Perform scans on newly created, moved, or renamed files
OnAccessExtraScanning yes

# Optionallyexclude root-owned processes
# OnAccessExcludeRootUID true

Firewalld

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=81/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --permanent --add-port=444/tcp
sudo systemctl reload firewalld

User and Group Configuration

sudo usermod -aG virusgroup $USER
sudo usermod -aG clamscan $USER
sudo chown root:clamscan /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

IMPORTANT: Logout and login is required after this step.

Enable Required Services

BastionGuard requires the following system services to be enabled and running:

  • nginx
  • php-fpm
  • clamav-daemon
  • clamav-clamonacc
  • clamav-freshclam
  • dnsmasq
  • bsc-daemon

Enable and start them with:

systemctl enable --now nginx php-fpm clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon clamd@scan

Verification

To verify that all services are running correctly, use:

systemctl status nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon clamd@scan

Make sure that all services are listed as active (running).

A system reboot is strongly recommended after enabling services.

Uninstall

sudo make uninstall

This document covers only Mageia 10 installations. Other distributions are documented separately.

Published on:
Last updated on: