Installation guide
The agent installs in under 60 seconds with a single command. The first full scan then takes 15–30 minutes while Trivy syncs its CVE database — every scan after is fast. Here's exactly what happens and how to verify it's running.
Sign in to your dashboard and go to Servers. Click + Add server, give it a label (e.g. "web-server-01"), and click Add server.
An agent token and a ready-to-run install command will appear immediately. Copy the token — it is shown only once. The install command includes it automatically.
SSH into your server as root (or a user with sudo). Paste the complete command from the dashboard (it includes your agent token):
Run as root on your server
curl -fsSL https://astrari.io/install.sh | bash -s -- https://api.astrari.io YOUR_AGENT_TOKEN
The installer detects your architecture (x86_64 or arm64), downloads the correct agent binary, writes the config to /etc/astrari/agent.conf, creates systemd units, and installs the security scanning tools. The first Trivy CVE database download may take 10–30 minutes depending on your connection speed.
Before any packages are installed, the script shows you the plan and asks for confirmation.
Installing ClamAV and rkhunter via your system package manager (dnf / apt) can transitively upgrade existing packages — most commonly the rest of the ClamAV stack and OpenSSL on RHEL-family servers. The installer prints exactly what would be installed and upgraded and prompts you to choose:
y — install everything shown (recommended)s — skip OS scanners (install agent only, no package upgrades)n — abort, install nothingFor unattended installs, append --yes to confirm automatically, or --no-tools to install the agent without OS scanners.
Unattended install (skips the prompt)
curl -fsSL https://astrari.io/install.sh | bash -s -- https://api.astrari.io YOUR_AGENT_TOKEN --yes
Agent only — no OS scanner installation
curl -fsSL https://astrari.io/install.sh | bash -s -- https://api.astrari.io YOUR_AGENT_TOKEN --no-tools --yes
The installer sets up the following on your server:
Check that the timer is active and the agent has checked in:
Check timer status
systemctl status astrari-agent.timer
View live agent logs
journalctl -u astrari-agent -f
Check agent version
astrari-agent --version
The agent fires every 30 seconds for fast heartbeats and queued action delivery. The first full scan starts automatically and may take up to 30 minutes on a fresh install while Trivy downloads its CVE database — your server will appear as active in the dashboard with a security score once it completes.
If you host WordPress sites on this server, link them to enable agent-assisted features: WordPress plugin updates via wp-cli, WordPress database scans for injected malware, and .htaccess auto-fixes.
Go to the site's detail page in the dashboard and open the Hosting server card. Select this server from the dropdown. Once linked, the agent will discover all WordPress installations on the server at the next check-in. Non-WordPress sites also benefit from linking — the agent can apply server-side fixes like nginx header directives when supported.
Vault is the optional backup add-on. The agent runs restic on this server, encrypts each snapshot client-side, and pushes it to a Backblaze B2 bucket Astrari provisions for you. Append-only by design — even if the server is compromised, the agent's key cannot delete prior snapshots.
Vault is opt-in per server and adds no overhead to servers that don't use it. Pricing is usage-based: £0.05 per GB stored per month, no per-server fee, with 10 GB/month of restore egress included.
/var/lib/astrari/vault.env on the host.See the Vault FAQ for retention details, database backup behaviour, restore flow, and the security model.
To remove the agent completely, run the uninstall script as root. This stops the timer, removes the binary, config file, and state data.
Run as root
curl -fsSL https://astrari.io/uninstall.sh | bash
Security tools (Trivy, rkhunter, MalDet, and ClamAV if present) are not removed automatically — they may be used by other software on the server. To remove them manually:
Optional: remove scan tools
# Debian / Ubuntu apt-get remove rkhunter clamav dpkg -r trivy maldet --uninstall # RHEL / Fedora / Rocky dnf remove rkhunter rpm -e trivy maldet --uninstall
Astrari works on servers managed by Plesk, cPanel, and WHM. These panels use Apache as the web server, which means .htaccess-based WordPress auto-fixes work correctly on those servers.
MalDet automatically scans cPanel account directories (/home/*/public_html) and Plesk vhost directories for PHP shells and web malware.
All scan tools run under nice -n 19 ionice -c 3. This gives them the absolute lowest scheduling priority — they only get CPU and disk access when the server is otherwise idle. In practice, scans are invisible to live workloads.
The agent binary itself consumes no resources between timer fires — it exits after each run. The systemd timer wakes it every 30 seconds, it reports a heartbeat, processes any queued actions, runs scans only when due (every 6h for full, weekly for ClamAV/MalDet/rkhunter), then exits again.