Debian / Ubuntu

Install the LinuxGuard agent on Debian, Ubuntu, and derivatives via the APT repository at packages.linuxguard.io.

This guide covers repository-based installation on Debian, Ubuntu, and derivatives (such as Linux Mint).

Note: Supported architectures — Debian/Ubuntu packages ship for amd64, arm64, and armv7. ARMv7 deployments run in DegradedNoEBPFArch mode with no eBPF-derived telemetry. See Multi-Architecture Support for the per-architecture capability matrix.

Prerequisites

• Linux kernel 4.18+ (for eBPF support)

• Root or sudo access

• Outbound HTTPS access to packages.linuxguard.io

Note: See Prerequisites for full system requirements.

Repository Setup

The recommended installation method uses the official LinuxGuard APT repository. This ensures you receive automatic updates and can easily manage the agent through your package manager.

Step 1: Install Prerequisites

Install required packages for repository configuration:

sudo apt install curl ca-certificates gnupg

Step 2: Import GPG Key

Create the keyrings directory and import the LinuxGuard signing key:

sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://packages.linuxguard.io/gpg/linuxguard.asc | \
  sudo gpg --dearmor -o /etc/apt/keyrings/linuxguard.gpg

Step 3: Add Repository

Add the LinuxGuard repository to your system:

echo "deb [signed-by=/etc/apt/keyrings/linuxguard.gpg arch=$(dpkg --print-architecture)] \
  https://packages.linuxguard.io/apt stable main" | \
  sudo tee /etc/apt/sources.list.d/linuxguard.list

Step 4: Install Agent

Update the package index and install the agent:

sudo apt update
sudo apt install linuxguard-agent

The agent service will be installed but not started until enrollment.

Direct Download

If repository setup is not possible, you can download and install the package directly:

curl -fsSL -o linuxguard-agent.deb \
  https://packages.linuxguard.io/apt/pool/linuxguard-agent_latest_$(dpkg --print-architecture).deb
sudo dpkg -i linuxguard-agent.deb

ARM64 installation

The APT repository at packages.linuxguard.io/apt publishes both amd64 and arm64 packages under the same deb line. The repository setup snippet in Step 3 already pins the architecture via arch=$(dpkg --print-architecture), so an arm64 (aarch64) host pulls the arm64 package without further configuration.

To confirm your host is arm64 before installing:

dpkg --print-architecture
# arm64
uname -m
# aarch64

The arm64 package ships the same agent binary + compiled eBPF probe object as the amd64 package — arm64 is a full-eBPF architecture per the capability matrix. No degradation, no missing telemetry.

If your host is ARMv7 (armv7l, armhf), the package is still available via the APT repository but the agent runs in Degraded mode — the eBPF probe is a zero-byte sentinel and no behavioral telemetry is produced. The dpkg --print-architecture value on an ARMv7 host is armhf, and the repository serves the corresponding package. Treat ARMv7 hosts as a documented gap in the evidence chain.

Note: For containerized arm64 deployments (Kubernetes DaemonSet on an arm64 node pool, Docker on an arm64 host), the OCI multi-arch manifest selects the arm64 image automatically when pulling packages.linuxguard.io/linuxguard-agent:vX.Y.Z. See OCI multi-arch manifest for the manifest inspection and --platform pull syntax.

Verification

After installation, verify the agent is correctly installed:

Check Agent Binary

Confirm the agent binary is in your PATH:

which linuxguard-agent

Expected output:

/usr/bin/linuxguard-agent

Verify Agent User

Confirm the agent user and group were created:

id linuxguard

Expected output:

uid=999(linuxguard) gid=999(linuxguard) groups=999(linuxguard)

Note: The UID/GID numbers may vary depending on your system.

Check Service Status

Verify the agent service is installed:

sudo systemctl status linuxguard-agent

Expected output:

○ linuxguard-agent.service - LinuxGuard Security Agent
     Loaded: loaded (/lib/systemd/system/linuxguard-agent.service; disabled; preset: enabled)
     Active: inactive (dead)

The service is inactive until you complete enrollment.

Troubleshooting

Repository Not Found

If apt update fails to find the LinuxGuard repository, verify the repository file exists:

cat /etc/apt/sources.list.d/linuxguard.list

The file should contain the repository configuration with the correct architecture.

GPG Key Errors

If you encounter GPG signature verification errors, verify the key was imported correctly:

ls -l /etc/apt/keyrings/linuxguard.gpg

If the file is missing, repeat Step 2 of the repository setup.

Package Conflicts

If installation fails due to conflicting packages, check for unofficial or third-party LinuxGuard packages:

apt list --installed | grep linuxguard

Remove any unofficial packages before installing from the official repository.

Note: See the Troubleshooting Guide for additional help.

---

Next Step: Configuration →

Related: Installation Overview | Prerequisites | Troubleshooting