Skip to content
RevoDocs

Install on Linux

Install RevoAgent on Linux servers and workstations (x64 or ARM64) with one command.

Updated

On this page

The Linux agent is a static binary that runs as a hardened systemd service on x64 and ARM64.

Requirements

  • A systemd-based distribution. Patch inventory and installs cover Debian and Ubuntu (APT), the Red Hat family (DNF) and SUSE (zypper).
  • Root, to install. Running as root also gives the agent visibility of the firewall, SSH configuration and disks.
  • Direct outbound HTTPS to Revo (no proxy support).

Install

  1. In the customer's workspace, open Customer settings → Install agent and choose Create installer link.
  2. Copy the Linux command and run it on the machine, or from your RMM or configuration management:
Shell
curl -fsSL https://<your Revo address>/i/<link key>.sh | sudo sh

The same command works on a Mac. On Linux it runs the link's Linux installer, which picks the x64 or ARM64 build for the machine, checks it against the published release digest, installs it in /usr/local/lib/revo-agent, enrolls the device and starts the revo-agent systemd service.

To switch features off on this device at install time, add the options after sh -s --:

Shell
curl -fsSL https://<your Revo address>/i/<link key>.sh | sudo sh -s -- --disable-patching --disable-reboot

The options are --disable-patching, --disable-reboot and --disable-remote-uninstall; you can also change them later in config.toml (Local controls). Installers created before 2026-10-28 show the older curl -fsSL '<link>/linux.sh' | sudo sh command, which still works.

Where it installs

WhatWhere
Program/usr/local/lib/revo-agent
Identity, keys and config.toml/var/lib/revo-agent (mode 0700; config.toml must be 0600)
Servicerevo-agent.service (systemd, sandboxed)

The service runs in a systemd sandbox (read-only system, no home directories, no new privileges). Package installs run in short-lived, separate systemd units named revo-patch-…, so the main service never needs broader rights.

What it reports

  • Installed packages, with source package names, and the distribution release.
  • Runtimes outside the package manager and running containers (by image tag).
  • Checks for the firewall (nftables, UFW or iptables), SSH configuration, pending security updates, root disk encryption and password policy.
  • SSH, sudo and account events (see Alerts).

Pending security updates are read from the package manager's cached metadata. The read-only report doesn't refresh that metadata, so a machine that never refreshes it shows the check as inconclusive rather than passing.

Check it worked

Shell
systemctl status revo-agent
journalctl -u revo-agent --since today

The device appears in Devices within a minute. If it doesn't, see Troubleshooting devices.