Skip to content
Endpoint Security
Skip navigation
Endpoint Security
View as Markdown

Install on Linux

Four commands take a server from nothing to a service that reports under the host's own address.

Published

On this page (5)

Install on Linux Documentation

Run these on the host itself, as a user who can sudo. The sensor service is generated for systemd, on Debian and Ubuntu and on the RHEL family.

1. Install the CLI

bash
curl -fsSL https://get.whisper.online | sh
text
whisper: installed to /usr/local/bin/whisper - run: whisper

Run as root the binary lands in /usr/local/bin; otherwise it lands in ~/.local/bin. --dir or WHISPER_DIR puts it somewhere else. Each fetch is checksum-verified against the signed release before it is written.

This step installs the CLI and nothing else. No identity is minted and no sensor is started yet.

2. Sign in

bash
whisper login --web

The command opens a browser at https://console.whisper.security, and on approval writes your key to ~/.config/whisper/key. Everything after this point is keyed.

3. Bind the host

bash
whisper enroll
text
whisper: bound 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478  (app-1)

The address on that line is what this machine reports as, from now on, across restarts and upgrades. The command is idempotent: run it again and it re-finds the same address rather than minting a second one. It records the result in ~/.config/whisper/bound. Bind the host has the detail.

4. Install and start the service

bash
sudo -E whisper service install --now --sensor
text
whisper: sensor service installed + running (whisper-sensor)

Keep -E. sudo resets HOME, and both your key and the marker from step 3 live under your home directory, so without -E root starts a service that has no identity to report under.

If step 1 put the binary in ~/.local/bin, give the full path: sudo -E ~/.local/bin/whisper service install --now --sensor.

5. Confirm it is reporting

bash
systemctl status whisper-sensor
journalctl -u whisper-sensor -n 3
text
whisper-sensor: active (running)
whisper: sensor: reporting as 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478

The second line is the one that matters. active (running) on its own only says the process started. Until you see reporting as with your address, the digests are staying on the machine, and Troubleshooting has the fix.

The host now appears in your fleet, and the address it reports under can be checked by anyone with no key and nothing installed: see verifying an identity.