Quickstart: put a server on the dashboard

By the end of this page, a test VM will be enforcing and reporting to https://genossec.com/dashboard/, and you'll have watched it block a write.

Time: about an hour, most of it building the enforcer the first time.

What you need

• A dashboard login. Your email has to be on the allowlist; see Operating the fleet server.
• Shell access to the fleet server to mint an enrollment token.
• A disposable Ubuntu 24.04 VM with BPF LSM enabled. The enforcer is a prototype, so don't use a machine you care about.
• A test server for the baseline upload, until the scanner supports HTTPS (see Known gaps). Any machine the VM can reach can run python3 genos_scanner_enforcer/installer/dev_server.py.

The steps at a glance

1. Mint an enrollment token

On the fleet server:

cd ~/genos/genos-server/fleet
FLEET_CONFIG=/etc/genos-fleet/config.toml .venv/bin/flask --app "fleetmon:create_app()" create-token --label test-vm-01

It prints a token like genos_enr_… once. The token works once and expires after 24 hours.

2. Build and install the enforcer on the VM

Follow Build and Install in the enforcer README. In short:

cat /sys/kernel/security/lsm          # must include "bpf"; the README shows how to enable it
cd genos_scanner_enforcer/enforcer
cargo xtask build
sudo cargo run -p xtask -- install

This installs genos-daemon but doesn't start it yet.

3. Give the host its identity

The daemon needs a private key and a config file that tells it where to report. On the VM:

sudo install -d -m 700 /etc/genos
sudo sh -c 'head -c 32 /dev/urandom > /etc/genos/agent.ed25519'
sudo chmod 600 /etc/genos/agent.ed25519

Then create /etc/genos/agent.toml (mode 0600):

server_url = "https://genossec.com"
server_spki_pin_sha256 = "<pin: see below>"
enrollment_token = "<the token from step 1>"

Get the pin, which is genossec.com's public key fingerprint, from any machine:

echo | openssl s_client -connect genossec.com:443 -servername genossec.com 2>/dev/null \
  | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der \
  | openssl dgst -sha256 -binary | base64

Every field is explained in Node setup.

4. Scan the host and start enforcing

Run the scanner in demo mode. It records the baseline, then starts the daemon:

sudo GENOS_SERVER=<test-server>:3000 GENOS_DEMO_ENFORCER=1 bash genos_scanner_enforcer/dist/scanner.sh

The scan prints its progress. When it finishes, the daemon starts, enrolls with genossec.com and sends its first heartbeat.

sudo journalctl -u genos-daemon -n 20 --no-pager
# look for: "reporter initialized" and "enforcing; draining decisions"

5. Check the dashboard

Open https://genossec.com/dashboard/. Within 30 seconds:

• The VM appears in the sidebar and the Nodes table with a green Reporting label.
• Enforcement shows Enforcing, and the node page lists 3 LSM hooks.

Now prove it blocks. On the VM:

echo 'attacker ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/zz-test
# tee: /etc/sudoers.d/zz-test: Operation not permitted

On the dashboard, open the node's Decision log. A red DENY for create appears, and the Denied · 24h count goes up.

Finally, stop the daemon (sudo systemctl stop genos-daemon). Within about 90 seconds (three missed heartbeats) the node turns red and shows up under Alerts → Silent right now. That's Genos treating a stopped enforcer as an incident.

Known gaps