Agents & Probes

Overview

Three standalone Go binaries extend Eon Aethis beyond the central platform. All of them initiate outbound connections to the backend — none requires an inbound port to be opened on the host or network they run on, except the Perimeter Probe, which is deployed the other way around (see below).

Aethis Agent

Installed with a one-liner that downloads the platform-matched binary from the backend itself:

curl -sSL https://YOUR-SERVER/agents/install.sh | bash -s -- --server https://YOUR-SERVER

Useful flags:

• --insecure — skip TLS verification (self-signed backend certs)
• --token TOKEN — register with a pre-issued token instead of interactive pairing (--no-pair is implied)
• --no-pair — install the binary and systemd unit without registering
• --config PATH — config file path (default /etc/eon-aethis/eon-aethis.conf)
• --no-plugins — skip installing monitoring-plugins/nagios-plugins via the host package manager (apt/dnf/yum/apk, whichever is present)
• --with-geoip — download the DB-IP Lite City database for web-analytics geolocation
• --uninstall — stop, disable, and remove the agent (leaves the config file behind)

The installer detects linux-amd64/linux-arm64, requires systemd and root, installs the binary to /usr/local/bin/aethis-agent, links any discovered Nagios-compatible check_* plugins into /usr/lib/eon-aethis/plugins, and installs an eon-aethis-agent.service systemd unit. Pairing (the default flow when --token isn’t given) requires approval in the Eon Aethis UI before the config file — and therefore the running service — is created.

The generated config (YAML, at --config’s path):

server:
  url: "https://YOUR-SERVER"
  token: "<issued during pairing or --token>"
  tls_verify: true   # false when installed with --insecure

checks:
  interval: "60s"
  plugins_dir: "/usr/lib/eon-aethis/plugins"

metrics:
  cpu: true
  memory: true
  disk: true
  network: true
  processes: true

Additional fields available in the config schema but not written by the installer: checks.system_plugins_dir, checks.plugins (a list of {name, path, args, interval} for custom checks), agent.hostname, agent.tags (a map of key/value tags), and web_analytics (enabled, access_logs: [{path, format, name}], geoip_db, interval) for parsing a local web server’s access logs.

Aethis Probe

Passively observes a network segment: live packet capture, NetFlow/IPFIX/ sFlow listeners, ARP/DHCP analysis, and traffic classification, buffered locally and pushed to the backend. Install as root:

BACKEND_URL=https://YOUR-SERVER ./install.sh

(install.sh ships in the probe package next to the eon-aethis-probe binary and its systemd unit; set BIN_URL instead of placing the binary alongside the script if you’re fetching it remotely.) Set INSECURE=1 to skip TLS verification for a self-signed backend during testing — this also passes --insecure to the pairing step.

The installer creates a dedicated eon-probe system user, installs the binary to /usr/local/bin/eon-aethis-probe, writes /etc/eon-aethis-probe/probe.yaml from the template (owned root:eon-probe, mode 0640), installs the eon-aethis-probe.service systemd unit, and runs the pairing flow — which must be approved in the backend UI — before enabling the service.

Config reference (/etc/eon-aethis-probe/probe.yaml):

backend_url: https://aethis.example.com
probe_id: ""              # filled in by the pairing flow
auth_token: ""            # filled in by the pairing flow
ca_path: ""               # CA cert for a self-signed backend
tls_verify: true          # set false only for --insecure test setups
push_interval: 60s        # how often buffered events are pushed
buffer_path: /var/lib/eon-aethis-probe/buffer.db
buffer_max_events: 100000
buffer_max_bytes: 104857600   # 100 MB
interfaces:
  - name: eth0
    mode: host
    bpf: ""              # optional BPF filter
log_level: info

Events are buffered in a local SQLite database (buffer_path) so a temporary backend or network outage doesn’t drop data; the buffer is capped by both event count and byte size, dropping oldest events past either limit.

Perimeter Probe

A reconnaissance service deployed separately from a tenant’s Eon Aethis instance. Every call between the probe and a tenant’s instance is authenticated with mutual TLS: the probe operator issues each tenant a client certificate from the operator CA.

Config (/etc/perimeter-probe/probe.yaml):

addr: ":8443"
server_cert: /etc/perimeter-probe/server.crt
server_key: /etc/perimeter-probe/server.key
operator_ca: /etc/perimeter-probe/operator-ca.crt
client_cert: /etc/perimeter-probe/client.crt
client_key: /etc/perimeter-probe/client.key

Run it as a container:

docker run -d --name perimeter-probe \
  -v /etc/perimeter-probe:/etc/perimeter-probe:ro \
  -p 8443:8443 \
  perimeter-probe:latest

Tenant onboarding

1. The probe operator issues a tenant client certificate + key.
2. The tenant creates a Perimeter Probe pairing in the Eon Aethis admin UI, supplying: the probe’s base URL (https://<probe-host>:8443), the operator CA certificate (PEM), the probe’s certificate fingerprint (openssl x509 -in server.crt -outform DER | openssl dgst -sha256, formatted as sha256:<hex>), and the tenant’s client certificate + key (PEM).
3. The tenant runs a perimeter scan from the discovery section of the Eon Aethis UI.

Certificate rotation

When the probe operator issues a new tenant certificate, paste it into the Perimeter Probe pairing in the admin UI. When the probe’s server certificate changes, update the pinned fingerprint in the same place.