Aegis V2 Installation

Aegis V2 Installation

Aegis V2 is the current endpoint agent. Aegis V1 is deprecated. Use V2 for new deployments. V1 installers (Windows, MSI, DEB, RPM, OVA) do not install V2.

Open Endpoints, select the Aegis V2 tab, then Enroll Aegis V2. The modal is Install Aegis V2 Endpoint, with Setup then Enroll. Enrollment requires manage_endpoints.

Installation requirements

• Host — Linux (x86_64/amd64, systemd, cgroup v2). Root (sudo) required.
• Network — DNS and outbound TCP 443 to the domains Guard lists. No inbound ports. Cloudflare Tunnel also needs outbound TCP/UDP 7844.
• Debian 12 and Ubuntu 22.04/24.04 can install Docker Engine and nftables automatically. Other distributions must have both first.

Windows, macOS, Docker Desktop, rootless Docker, and arm64 are not supported.

1. Get the installation kit

The tenant kit includes the pinned agent, launcher, checksums, and enrollment config. The signed download is short-lived.

• Download installation kit
• Generate install command (curl on the host)

Do not paste signed URLs into tickets or chat. Generate a fresh link if it expires.

2. Run it on the endpoint host

Extract the kit, then from that directory:

tar -xzf aegis-agent_*_linux_amd64.tar.gz

sudo ./aegis-agent_linux_amd64 install --config ./aegis-agent-install.json

Add --no-install-dependencies when your organization manages host packages. Leave the installer running when it shows the short enrollment code.

3. Approve the enrollment

Select Continue to enrollment approval (or the Enroll tab). Enter the code and inspect tenant, identity, expiry, and reported host details with the person on the host. Hostname, OS, architecture, and version are reported by the installer, not independently verified.

Approval installs identity; it does not prove connectivity. The endpoint stays Not connected until the daemon heartbeats. The installer starts aegis-agent.service, waits up to 90 seconds for a heartbeat, then enables the service at boot. Heartbeat failure stops the service and fails install.

If Guard shows Approval not confirmed, check the host before starting another enrollment — approval may have succeeded.

After install

The endpoint appears on Endpoints → Aegis V2. Drawer: Overview, Health; Control is Praetorian-only. Revoke is Praetorian-only.