Installation package

This section applies to installations performed using the official BastionGuard package.

If you compiled BastionGuard manually from source, refer to the “Installation” section instead.

---

Install curl if it is not available on your system, sometimes it is not installed by default

sudo apt install curl
or
sudo zypper install curl
or
sudo dnf install curl
or
sudo pacman -S curl

Enable Required Services

BastionGuard requires the following system services to be enabled and running:

• nginx
• php-fpm
• clamav-daemon
• clamav-clamonacc
• clamav-freshclam
• dnsmasq
• bsc-daemon

Enable and start them with:

systemctl enable --now nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon

---

Verification

To verify that all services are running correctly, use:

systemctl status nginx php-fpm clamav-daemon clamav-clamonacc clamav-freshclam dnsmasq bsc-daemon

Make sure that all services are listed as active (running).

---

Check dnsmasq and if it says port 53 is busy we recommend using port 5353

sudo sed -i 's/^port=.*/port=5353/' /etc/dnsmasq.conf

Set SUID Permissions

Run the following commands as root:

sudo chmod 4755 /usr/bin/bastionguard-privhelper
sudo chmod 4755 /usr/bin/bastionguard-firewall
sudo chmod 4755 /usr/share/BastionGuard/cef/chrome-sandbox

These permissions are required for proper privilege escalation and sandboxing.

---

User and Group Configuration

Add the current user to the ClamAV group:

sudo usermod -aG clamav $USER

Set correct ownership and permissions for the ransomware token:

sudo chown root:clamav /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

For Fedora users:

sudo usermod -aG virusgroup $USER
sudo usermod -aG clamscan $USER

Set correct ownership and permissions for the ransomware token:

sudo chown root:clamscan /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

For Fedora users, complete the setup under SeLinux Adjustments and Firewalld.

For OpenSuse users:

sudo usermod -aG vscan $USER

sudo chown root:vscan /etc/BastionGuard/ransomware.token
sudo chmod 666 /etc/BastionGuard/ransomware.token

For Opensuse users, complete the setup under AppArmor Adjustments

Log out and log back in for group changes to take effect.

---

Clamav configuration

It is recommended to use the configuration file found here and configure it by changing both the username if you use fedora or opensuse and by activating OnAccessIncludePath for a single folder that is not the home but e.g. /home/user/Public

Nginx Configuration

Copy the BastionGuard virtual host configuration files:

sudo cp /usr/share/BastionGuard/data/vhosts/nginx.conf /etc/nginx/sites-available/bastionguard.conf
sudo cp /usr/share/BastionGuard/data/vhosts/nginx-default.conf /etc/nginx/sites-available/default.conf
sudo ln -s /etc/nginx/sites-available/bastionguard.conf /etc/nginx/sites-enabled/bastionguard.conf
sudo ln -s /etc/nginx/sites-available/default.conf /etc/nginx/sites-enabled/default

See nginx and php configuration

Reload Nginx:

sudo systemctl reload nginx

---

Sysctl Network Optimization

Copy the DNS optimization configuration:

sudo cp /usr/share/BastionGuard/data/config/99-dns-fast.conf /etc/sysctl.d/

Apply system parameters:

sudo sysctl --system

---

UDEV Rules Configuration (USB Protection)

Copy the UDEV rule file:

sudo cp /usr/share/BastionGuard/data/udev/99-BastionGuard-usb.rules /etc/udev/rules.d/

Reload UDEV rules:

sudo udevadm control --reload-rules
sudo udevadm trigger

Ensure the user belongs to the plugdev group:

sudo groupadd -f plugdev
sudo usermod -aG plugdev $USER

Reboot the system to apply all changes:

Enable service

System service

sudo systemctl  enable BastionGuard-usbd.service 
sudo systemctl  enable BastionGuard-phishing-scanner.service
sudo systemctl enable BastionGuard-ransomware-realtime.service

User service

systemctl --user enable BastionGuard-privacyd.service 
systemctl --user enable BastionGuard-ransomware-alert.service 
systemctl --user enable BastionGuard-ransomware-realtime-alert.service 
systemctl --user enable BastionGuard-ransomware-scanner.service
systemctl --user enable BastionGuard-useragent.service
systemctl --user enable BastionGuard-pacd.service
systemctl --user enable BastionGuard-cef.service

sudo reboot