Skip to main content

DeaconGuard documentation

DeaconGuard is a Linux security scanner. It finds vulnerable packages, tampered system files, signs of compromise and risky configuration on your Linux machines, and shows the results in a self-hosted dashboard.

It checks installed packages and the running kernel against each distribution's own security data: Canonical's OVAL feeds for Ubuntu, the Debian Security Tracker, Red Hat's OVAL feeds and Amazon Linux's ALAS bulletins. Optional checks add system file integrity, malware and compromise indicators, security configuration, and ClamAV antivirus.

One binary, two roles​

  • Server: an HTTPS dashboard with sign-in and an audit log. It scans the machine it runs on, and every machine running the agent.
  • Agent: runs on each machine you want to scan. It enrolls once with a single-use token, then connects out to the server, runs the scans the server asks for and sends back the results. Scanned machines need no open ports and no internet access.

For a single machine, local mode gives you a dashboard on 127.0.0.1 without any accounts.

Principles​

  • Read-only. Every command DeaconGuard runs on a machine is a fixed, read-only string in its source code. It never installs software or changes the system it scans; the only third-party engine it runs is a ClamAV you already installed, and only when you choose the antivirus check.
  • Honest results. A skipped, partial or failed check is never shown as clean, and missing or stale advisory data is never reported as "no vulnerabilities".
  • The server decides. Agents send the package list; the server evaluates it against the advisories. A modified agent can lie about its check results, but it cannot hand the server its own vulnerability verdicts.
  • Self-hosted and open source. You run the server, and your results stay with you. DeaconGuard is MIT licensed, and every release is signed with Sigstore.

Where to go next​

  • Quick start: a server and a first agent in a few minutes.
  • Installation: every install option, upgrades and uninstalling.
  • Architecture: how the server, agents and certificate pinning fit together.