# Install on Linux

> Install the Whisper sensor on a Debian, Ubuntu or RHEL-family host: fetch the CLI, sign in, bind the host, install the service, confirm it reports.

*Source: https://www.whisper.security/docs/endpoint/install/linux*

---
Run these on the host itself, as a user who can `sudo`. The sensor service is generated for systemd, on Debian and Ubuntu and on the RHEL family.

## 1. Install the CLI

```bash
curl -fsSL https://get.whisper.online | sh
```

```text
whisper: installed to /usr/local/bin/whisper - run: whisper
```

Run as root the binary lands in `/usr/local/bin`; otherwise it lands in `~/.local/bin`. `--dir` or `WHISPER_DIR` puts it somewhere else. Each fetch is checksum-verified against the signed release before it is written.

This step installs the CLI and nothing else. No identity is minted and no sensor is started yet.

## 2. Sign in

```bash
whisper login --web
```

The command opens a browser at `https://console.whisper.security`, and on approval writes your key to `~/.config/whisper/key`. Everything after this point is keyed.

## 3. Bind the host

```bash
whisper enroll
```

```text
whisper: bound 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478  (app-1)
```

The address on that line is what this machine reports as, from now on, across restarts and upgrades. The command is idempotent: run it again and it re-finds the same address rather than minting a second one. It records the result in `~/.config/whisper/bound`. [Bind the host](/docs/endpoint/install/enroll) has the detail.

## 4. Install and start the service

```bash
sudo -E whisper service install --now --sensor
```

```text
whisper: sensor service installed + running (whisper-sensor)
```

Keep `-E`. `sudo` resets `HOME`, and both your key and the marker from step 3 live under your home directory, so without `-E` root starts a service that has no identity to report under.

If step 1 put the binary in `~/.local/bin`, give the full path: `sudo -E ~/.local/bin/whisper service install --now --sensor`.

## 5. Confirm it is reporting

```bash
systemctl status whisper-sensor
journalctl -u whisper-sensor -n 3
```

```text
whisper-sensor: active (running)
whisper: sensor: reporting as 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
```

The second line is the one that matters. `active (running)` on its own only says the process started. Until you see `reporting as` with your address, the digests are staying on the machine, and [Troubleshooting](/docs/endpoint/troubleshooting) has the fix.

The host now appears in [your fleet](/docs/endpoint/operate/fleet), and the address it reports under can be checked by anyone with no key and nothing installed: see [verifying an identity](/docs/identity/verify).