Installation – OpenMandriva Lx 6 Rock

This document describes the official installation procedure for BastionGuard on OpenMandriva Lx 6 Rock. Include

The instructions below are intended for system administrators and advanced users.

CEF support is currently unavailable on OpenMandriva Lx 6 Rock.

Supported Platforms

  • OpenMandriva Lx 6 Rock

Required Privileges

Installation and configuration require root privileges. Several components rely on:

  • systemd services
  • Polkit (pkexec)
  • DNS and network configuration
  • Filesystem access under /usr, /etc, and /var

Install Dependencies (OpenMandriva Lx 6 Rock)

Install all required build-time and runtime dependencies:

sudo dnf --refresh install \
  gcc-c++ clang llvm lld cmake ninja make pkgconf gettext-devel \
  python rsync git-core systemd bash curl file binutils \
  autoconf automake libtool flex bison \
  'pkgconfig(gtkmm-4.0)' \
  'pkgconfig(giomm-2.68)' \
  'pkgconfig(pangomm-2.48)' \
  'pkgconfig(sigc++-3.0)' \
  'pkgconfig(libsoup-3.0)' \
  'pkgconfig(libsecret-1)' \
  'pkgconfig(libsystemd)' \
  'pkgconfig(libudev)' \
  'pkgconfig(libidn2)' \
  'pkgconfig(sqlite3)' \
  'pkgconfig(libcurl)' \
  'pkgconfig(openssl)' \
  boost-devel \
  nlohmann_json-devel \
  'pkgconfig(polkit-gobject-1)' \
  'pkgconfig(libffi)' \
  'pkgconfig(zlib)' \
  'pkgconfig(libpcre2-8)' \
  'pkgconfig(libpng)' \
  'pkgconfig(libjpeg)' \
  'pkgconfig(libtiff-4)' \
  'pkgconfig(libwebp)' \
  'pkgconfig(nss)' \
  'pkgconfig(nspr)' \
  'pkgconfig(fribidi)' \
  'pkgconfig(x11)' \
  'pkgconfig(xcursor)' \
  'pkgconfig(xrandr)' \
  'pkgconfig(xi)' \
  'pkgconfig(xinerama)' \
  'pkgconfig(xdamage)' \
  'pkgconfig(xcomposite)' \
  'pkgconfig(xkbcommon)' \
  'pkgconfig(wayland-client)' \
  'pkgconfig(alsa)' \
  'pkgconfig(libpipewire-0.3)' \
  'pkgconfig(smbclient)' \
  'pkgconfig(libzstd)' \
  'pkgconfig(lzo2)' \
  nginx meson vala \
  'pkgconfig(gtk+-3.0)' \
  'pkgconfig(vte-2.91)' \
  'pkgconfig(glib-2.0)' \
  'pkgconfig(gobject-2.0)' \
  'pkgconfig(gtk4)' \
  'pkgconfig(gio-2.0)' \
  'pkgconfig(gio-unix-2.0)' \
  'pkgconfig(json-glib-1.0)' \
  'pkgconfig(vte-2.91-gtk4)' \
  'pkgconfig(gee-0.8)' \
  help2man golang protobuf-compiler \
  'pkgconfig(protobuf)' \
  grpc-plugins \
  'pkgconfig(grpc)' \
  'pkgconfig(grpc++)' \
  'pkgconfig(shumate-1.0)' \
  'pkgconfig(libnetfilter_queue)' \
  'pkgconfig(libnfnetlink)' \
  'pkgconfig(libmnl)' \
  'pkgconfig(libelf)' \
  'pkgconfig(libbpf)' \
  bpftool patchelf

Build BastionGuard

mkdir build && cd build
cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DENABLE_SYSTEMD_SERVICES=ON -DCMAKE_INSTALL_SYSCONFDIR=/etc -DENABLE_USER_AGENT_AUTO=ON -DINSTALL_NGINX_DEFAULTS=ON -DENABLE_CEF=ON -DENABLE_CEF_DAEMON=OFF -DENABLE_SYSTEM_CA_INSTALL=OFF -DBASTIONGUARD_INIT_SYSTEM=AUTO

make -j$(nproc)
sudo make install

Post-Installation Configuration

Network Configuration

sudo ip addr add 127.0.0.2/8 dev lo
sudo systemctl restart NetworkManager dnsmasq

dnsmasq Configuration

Create the configuration directory if missing:

sudo mkdir -p /etc/dnsmasq.d

Create /etc/dnsmasq.d/BastionGuard.conf with the following content:

listen-address=127.0.0.1,127.0.0.2
bind-interfaces

Ensure the following line is enabled in /etc/dnsmasq.conf:

conf-dir=/etc/dnsmasq.d/,*.conf

Change port dnsmash

sudo sed -i 's/^port=.*/port=5353/' /etc/dnsmasq.conf

Clamav configuration

Add the following lines of code to clamd.conf or clamd-scan.conf in /etc/clamav or /etc:

# Exclude the UID of the scanner itself from checking, to prevent loops
OnAccessExcludeUname clamav or vscan or clamscan


# Alternatively, add some directories instead of mount points
OnAccessIncludePath /home/username/folder_custom

# Prevention doesn't work with OnAccessMountPath.
# It works with OnAccessIncludePath, as long as /usr and /etc are not included.
# Including /var while activating prevention is also not recommended, because
# this would slow down package installation by a factor of 1000.
OnAccessPrevention no

# Perform scans on newly created, moved, or renamed files
OnAccessExtraScanning yes

# Optionallyexclude root-owned processes
# OnAccessExcludeRootUID true

Firewalld

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=81/tcp
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --permanent --add-port=444/tcp
sudo systemctl reload firewalld

User and Group Configuration

sudo usermod -aG virusgroup $USER
sudo usermod -aG clamscan $USER
sudo chown root:clamscan /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

IMPORTANT: Logout and login is required after this step.

Enable Required Services

BastionGuard requires the following system services to be enabled and running:

  • nginx
  • php-fpm
  • clamav-daemon
  • clamav-clamonacc
  • clamav-freshclam
  • dnsmasq
  • bsc-daemon

Enable and start them with:

systemctl enable --now nginx php-fpm clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon clamd@scan

Verification

To verify that all services are running correctly, use:

systemctl status nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon clamd@scan

Make sure that all services are listed as active (running).

A system reboot is strongly recommended after enabling services.

Uninstall

sudo make uninstall

This document covers only OpenMandriva Lx 6 Rock installations. Other distributions are documented separately.

Published on:
Last updated on: