Skip to content
TruthVouch Docs

Sentinel: Linux Installation

Install and configure the Sentinel Agent on Linux for AI tool monitoring and DLP enforcement.

System Requirements

  • OS: Ubuntu 20.04 LTS+, Debian 10+, RHEL 7+, CentOS 7+, Fedora 33+
  • Architecture: x86-64, ARM64
  • Memory: 256MB minimum, 512MB recommended
  • Disk Space: 100MB for installation
  • Permissions: sudo access or root privileges for installation

Installation Methods

1. APT (Debian/Ubuntu)

Add Repository:

Terminal window
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys <KEY_ID>
echo "deb https://apt.truthvouch.io/ focal main" | sudo tee /etc/apt/sources.list.d/truthvouch.list
sudo apt update

Install:

Terminal window
sudo apt install sentinel

With API Key:

Terminal window
SENTINEL_API_KEY="sk-..." sudo apt install sentinel

Upgrade:

Terminal window
sudo apt update && sudo apt upgrade sentinel

Uninstall:

Terminal window
sudo apt remove sentinel

2. YUM/DNF (RHEL/CentOS/Fedora)

Add Repository:

Terminal window
sudo rpm --import https://repo.truthvouch.io/RPM-GPG-KEY-truthvouch
sudo yum-config-manager --add-repo https://repo.truthvouch.io/sentinel.repo

Install:

Terminal window
sudo yum install sentinel

DNF (Fedora):

Terminal window
sudo dnf install sentinel

Upgrade:

Terminal window
sudo yum update sentinel

Uninstall:

Terminal window
sudo yum remove sentinel

3. Direct Package Download

Download:

Terminal window
# Ubuntu/Debian
curl -O https://download.truthvouch.io/sentinel/linux/sentinel_latest_amd64.deb


# RHEL/CentOS
curl -O https://download.truthvouch.io/sentinel/linux/sentinel-latest.x86_64.rpm

Install:

Terminal window
# Ubuntu/Debian
sudo dpkg -i sentinel_latest_amd64.deb


# RHEL/CentOS
sudo rpm -i sentinel-latest.x86_64.rpm

4. Snap

Terminal window
sudo snap install sentinel

First-Time Setup

1. Start Service

Terminal window
# Start the service
sudo systemctl start sentinel


# Enable on boot
sudo systemctl enable sentinel


# Check status
sudo systemctl status sentinel

2. Configure API Key

Edit configuration file:

Terminal window
sudo nano /etc/truthvouch/sentinel/config.yaml

Add:

cloud:
  api_key: sk-...
  organization_id: org-...

3. Reload Configuration

Terminal window
sudo systemctl restart sentinel

4. Verify Installation

Terminal window
# Check if service is active
sudo systemctl is-active sentinel


# View logs
sudo journalctl -u sentinel -f


# Check network connectivity
curl -I https://api.truthvouch.io

Systemd Service

Service File Location

/etc/systemd/system/sentinel.service
/usr/lib/systemd/system/sentinel.service

Manage Service

Terminal window
# Start service
sudo systemctl start sentinel


# Stop service
sudo systemctl stop sentinel


# Restart service
sudo systemctl restart sentinel


# Reload configuration
sudo systemctl reload sentinel


# Enable on boot
sudo systemctl enable sentinel


# Disable auto-start
sudo systemctl disable sentinel


# View service status
systemctl status sentinel


# View service details
systemctl show sentinel

Configuration

Config File Location

/etc/truthvouch/sentinel/config.yaml

Edit Configuration

Terminal window
# Edit config
sudo nano /etc/truthvouch/sentinel/config.yaml


# Validate config
sentinel --validate-config /etc/truthvouch/sentinel/config.yaml


# Reload after changes
sudo systemctl restart sentinel

Logs

View Logs

Terminal window
# Real-time logs
sudo journalctl -u sentinel -f


# Last 50 lines
sudo journalctl -u sentinel -n 50


# View by severity
sudo journalctl -u sentinel -p err


# View since last boot
sudo journalctl -u sentinel -b


# Save to file
sudo journalctl -u sentinel > sentinel.log

Log Files

Terminal window
# Application logs
/var/log/truthvouch/sentinel.log


# Database
/var/lib/truthvouch/sentinel/sentinel.db


# Policies cache
/var/lib/truthvouch/sentinel/policies/

Directory Structure

/etc/truthvouch/sentinel/
├── config.yaml                 # Main configuration
├── ca.crt                      # Certificate (if using custom CA)
└── sentinel.conf               # Additional settings


/var/lib/truthvouch/sentinel/
├── sentinel.db                 # SQLite database
├── policies/                   # Cached policies
└── cache/                      # Temporary cache


/var/log/truthvouch/
└── sentinel.log                # Application logs


/usr/bin/sentinel               # Binary executable
/usr/local/bin/sentinel         # Alternative location

Firewall Rules

UFW (Uncomplicated Firewall)

Terminal window
# Allow outbound HTTPS
sudo ufw allow out 443/tcp


# Verify rule
sudo ufw status

iptables

Terminal window
# Allow outbound HTTPS to API endpoint
sudo iptables -A OUTPUT -p tcp -d api.truthvouch.io --dport 443 -j ACCEPT


# Save rules
sudo iptables-save > /etc/iptables/rules.v4

firewalld

Terminal window
# Allow outbound HTTPS
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" egress action="accept"'


# Reload
sudo firewall-cmd --reload

SELinux Configuration

If using SELinux (RHEL/CentOS):

Terminal window
# Check SELinux status
getenforce


# Create policy (optional)
sudo semanage fcontext -a -t sentinel_t /etc/truthvouch/sentinel


# Restore context
sudo restorecon -R /etc/truthvouch/sentinel

AppArmor Configuration

If using AppArmor (Ubuntu/Debian):

Terminal window
# Load AppArmor profile
sudo apparmor_parser -r /etc/apparmor.d/usr.bin.sentinel


# Check status
sudo aa-status | grep sentinel

Auto-Update

Enable Auto-Update

Edit /etc/truthvouch/sentinel/config.yaml:

advanced:
  auto_update: true
  update_check_interval: 24

Manual Update

Terminal window
# Check for updates
sentinel --check-update


# Install update
sudo apt update && sudo apt upgrade sentinel
# or
sudo yum update sentinel

Uninstallation

APT

Terminal window
# Remove package
sudo apt remove sentinel


# Remove config
sudo rm -rf /etc/truthvouch/


# Remove data
sudo rm -rf /var/lib/truthvouch/

YUM/DNF

Terminal window
# Remove package
sudo yum remove sentinel


# Remove config
sudo rm -rf /etc/truthvouch/


# Remove data
sudo rm -rf /var/lib/truthvouch/

Containerized Deployment

Docker

Dockerfile:

FROM ubuntu:22.04


RUN apt-get update && \
    apt-get install -y curl && \
    echo "deb https://apt.truthvouch.io/ focal main" | tee /etc/apt/sources.list.d/truthvouch.list && \
    apt-get update && \
    apt-get install -y sentinel && \
    rm -rf /var/lib/apt/lists/*


COPY config.yaml /etc/truthvouch/sentinel/config.yaml


CMD ["systemctl", "start", "sentinel"]

Run:

Terminal window
docker build -t sentinel:latest .
docker run -d \
  -e SENTINEL_API_KEY="sk-..." \
  -e SENTINEL_ORG_ID="org-..." \
  -v sentinel-data:/var/lib/truthvouch/sentinel/ \
  sentinel:latest

Kubernetes

Deployment:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: sentinel
  namespace: default
spec:
  selector:
    matchLabels:
      app: sentinel
  template:
    metadata:
      labels:
        app: sentinel
    spec:
      hostNetwork: true
      containers:
      - name: sentinel
        image: truthvouch/sentinel:latest
        env:
        - name: SENTINEL_API_KEY
          valueFrom:
            secretKeyRef:
              name: sentinel
              key: api-key
        volumeMounts:
        - name: config
          mountPath: /etc/truthvouch/sentinel
        - name: lib
          mountPath: /var/lib/truthvouch/sentinel
      volumes:
      - name: config
        hostPath:
          path: /etc/truthvouch/sentinel
      - name: lib
        hostPath:
          path: /var/lib/truthvouch/sentinel

Troubleshooting

Service Won’t Start

Terminal window
# Check status
sudo systemctl status sentinel


# View error logs
sudo journalctl -u sentinel -n 50 -p err


# Validate config
sentinel --validate-config /etc/truthvouch/sentinel/config.yaml

Network Issues

Terminal window
# Test API connectivity
curl -I https://api.truthvouch.io


# Check DNS
nslookup api.truthvouch.io


# View connections
netstat -tulpn | grep sentinel
ss -tulpn | grep sentinel

Permission Denied

Terminal window
# Check file permissions
ls -la /etc/truthvouch/
ls -la /var/lib/truthvouch/


# Fix permissions
sudo chown -R sentinel:sentinel /var/lib/truthvouch/
sudo chmod 755 /etc/truthvouch/sentinel/

High CPU/Memory

Terminal window
# Monitor usage
top -p $(pidof sentinel)


# View process details
ps aux | grep sentinel


# Check for excessive logging
tail -f /var/log/truthvouch/sentinel.log | head -20

Performance Tuning

Reduce Overhead

Edit /etc/truthvouch/sentinel/config.yaml:

monitoring:
  clipboard_monitoring: false
  network_monitoring: false


reporting:
  interval: 120  # 2 hours instead of 1


logging:
  level: WARN    # Less verbose

Increase Resource Limits

Terminal window
# Edit systemd service
sudo systemctl edit sentinel


# Add resource limits
[Service]
MemoryLimit=512M
CPUQuota=50%

Integration with Company IT

Deploy via Configuration Management

Ansible:

- name: Install Sentinel
  hosts: all
  tasks:
    - name: Add Sentinel repo
      apt_repository:
        repo: "deb https://apt.truthvouch.io/ focal main"


    - name: Install sentinel
      apt:
        name: sentinel
        state: present


    - name: Configure sentinel
      template:
        src: config.yaml.j2
        dest: /etc/truthvouch/sentinel/config.yaml


    - name: Start sentinel
      systemd:
        name: sentinel
        state: started
        enabled: yes

Puppet:

class { 'sentinel':
  api_key         => 'sk-...',
  organization_id => 'org-...',
  ensure          => present,
}

See Configuration Reference for detailed options and Policy Sync for managing policies.