Install the Sentinel

This installs one host and gets it reporting. If you are building a golden image or an autoscaling group, don’t follow this page: each clone has to enroll itself. See Deploy a fleet from a VM template.

Before you start

• A Debian or Ubuntu host, amd64 or arm64.
• Outbound HTTPS on TCP 443 to sentinel.nocert.io and repo.nocert.io. Nothing inbound.
• Behind a corporate proxy: allow CONNECT sentinel.nocert.io:443 and CONNECT repo.nocert.io:443.

Both hostnames sit behind Cloudflare, so their IP addresses are shared and change over time. If your firewall filters by IP, use the official Cloudflare ranges rather than resolving the names once.

1. Fetch the signing key

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://repo.nocert.io/apt/gpg.key -o /etc/apt/keyrings/nocert.asc
sudo chmod a+r /etc/apt/keyrings/nocert.asc

2. Check the fingerprint before you trust it

gpg --show-keys --fingerprint /etc/apt/keyrings/nocert.asc

The line under pub must read:

D5EF CB2E 291B 386D 5161  8CB3 E1DF FDD9 DF7B BB21

If it doesn’t match, stop here. Delete the file and don’t add the repository.

3. Add the repository and install

sudo tee /etc/apt/sources.list.d/nocert.sources >/dev/null <<'EOF'
Types: deb
URIs: https://repo.nocert.io/apt
Suites: stable
Components: main
Architectures: amd64 arm64
Signed-By: /etc/apt/keyrings/nocert.asc
EOF

sudo apt update
sudo apt install nocert-sentinel

4. Enroll the host

Open Sentinels in NoCert and select Deploy Sentinel. The dialog hands you the enroll command with your organization’s token already in it:

sudo nocert-sentinel --enroll-token ncse_...

That single command registers the host, generates its key pair locally, hands the credentials to the nocert-sentinel service user, and starts the service. There is nothing to enable afterwards.

The host appears under Sentinels as soon as enrollment succeeds.

Caution

The token is visible in ps output while the command runs. On a host other people have shell access to, write it to /etc/nocert-sentinel/enroll.env and start the service instead:

sudo systemctl start nocert-sentinel

See Enrollment and key rotation.

5. Confirm it’s running

sudo systemctl status nocert-sentinel
sudo journalctl -u nocert-sentinel -f

The package ships preconfigured for sentinel.nocert.io, so there is no server URL to set. Configuration covers the settings worth changing.

Update

sudo apt update
sudo apt upgrade nocert-sentinel

To pin a specific version, list what the repository currently offers and pick one:

apt list -a nocert-sentinel
sudo apt install nocert-sentinel=<version>

Old releases are pruned from the repository over time, so not every version that ever shipped is still installable.

Uninstall

sudo apt remove nocert-sentinel   # keeps /etc/nocert-sentinel/
sudo apt purge nocert-sentinel    # removes the configuration too

Neither command clears /etc/nocert-sentinel/ entirely. The private key at sentinel-key.json is not a package file, and neither is anything you put under k8s/, so a cluster token you wrote there outlives the uninstall. Remove the directory yourself.

Neither command removes the Sentinel from your organization. Delete it from the Sentinels list to revoke its access, which also drops the filesystem, local and Kubernetes findings it reported.