--- title: "File System and Network Scanner Agent Configuration - Linux" slug: "fortanix-key-insight-file-system-and-network-scanner-agent-configuration-linux" updated: 2026-06-16T14:16:56Z published: 2026-06-16T14:16:56Z canonical: "support.fortanix.com/fortanix-key-insight-file-system-and-network-scanner-agent-configuration-linux" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.fortanix.com/llms.txt > Use this file to discover all available pages before exploring further. # File System and Network Scanner Agent Configuration - Linux ## 1.0 Introduction This article describes the minimum configuration requirements needed to successfully scan **file system and network resources** in an on-premises environment using the **File System and Network Scanner Agent** on the **Linux** platform. It also describes: - How to install the File System and Network Scanner Agent. - How to configure the scanner through the configuration file parameters. - How to execute the File System and Network Scanner Agent. *For detailed information on the File System infrastructure, refer to* [*File System*](/v1/docs/fortanix-key-insight-on-premises-file-system)*.* ## 2.0 Scanning Permissions *For detailed information on on-premises connection scanning permissions, refer to* [*On-premises Connection Permissions*](/v1/docs/fortanix-key-insight-on-premises-connection-permissions). ## 3.0 Prerequisites The following are the prerequisites to configure a File System and Network Scanner Agent on the Linux platform: - **Fortanix On-premises Scanner**: Ensure that the Fortanix On-premises Scanner ( `fortanix-scanner` ) package, which acts as the central service, is installed, configured, and running. It communicates with Fortanix Key Insight and with the File System and Network Scanner Agents. When the file system scanning service (`accumulator` or `fs_accumulator`) is enabled, this package starts a local HTTPS server to receive data from the agents. *For detailed information on Fortanix On-premises Scanner installation and configuration, refer to* [*On-premises Scanner Configuration*](/v1/docs/fortanix-key-insight-on-premises-scanner-configuration)*.* - **Server Specifications** - The server hosting the scanner must have **at least** **2 virtual Central Processing Units (vCPUs)** allocated. - The server must have a **minimum of** **8 GB** of **Random Access Memory (RAM)** to support the scanner. - The server should have **at least** **20 GB** of **storage capacity** for temporarily storing scanned data. - **Operating System and Libraries** - Supported operating systems include Ubuntu 24.04, RHEL 8, and RHEL 9 (alternatively, Rocky Linux 9). The necessary packages are available in `.deb` or `.rpm` formats. - **Network Requirements** > [!NOTE] > NOTE > > The File System and Network Scanner Agent does not expose any ports. It only initiates outbound connections to the `fortanix-scanner` service. - **Outbound (File System and Network Scanner Agent → Fortanix On-premises Scanner):** File System and Network Scanner Agent must be able to establish Transmission Control Protocol (TCP) connections to the Fortanix On-premises Scanner’s host and port, as defined in the configuration file. ## 4.0 File System and Network Scanner Agent Installation and Configuration You must install the File System and Network Scanner Agent package to manage your file system and network resources on a Linux host. 1. [Download](https://fortanix.zendesk.com/hc/en-us/articles/41120469631764-Fortanix-Key-Insight-On-premises-File-System-Scanner-for-Linux) the scanner package to your local machine. The **deb** or **rpm** package is provided with the downloaded package for the supported operating systems. 2. Run the following command to install the scanner package: - **Ubuntu 24.04** ```bash sudo apt install ./fortanix-fs-scanner_-noble_amd64.deb ``` - **RHEL 8** and **RHEL 9** ```bash sudo dnf install ./ fortanix-fs-scanner--1.x86_64.rpm ``` 3. Generate and configure the File System and Network Scanner Agent configuration file as detailed in [*File System and Network Scanner Agent Configuration File*](/v1/docs/fortanix-key-insight-file-system-and-network-scanner-agent-configuration-file)*.* > [!NOTE] > NOTE > > A sample configuration file is present in `/opt/fortanix/fs-scanner/conf/fortanix-fs-scanner.yaml.example`. 4. Initiate the scanning process as detailed in [*Section 5.0: Run the File System and Network Scanner Agent*](/v1/docs/fortanix-key-insight-file-system-and-network-scanner-agent-configuration-linux#50-run-the-file-system-scanner-agent). > [!NOTE] > NOTE > > Installing a new version of the File System and Network Scanner Agent for Linux will overwrite the following default files in the `/opt/fortanix/fs-scanner/conf/` directory: > > - `fortanix-fs-scanner.yaml.example` > - `fortanix-fs-scanner.service.example` > > However, any custom files (for example, user-created configurations) in the same directory will not be removed during the upgrade. > [!TIP] > TIP > > To avoid potential loss of important settings, it is recommended to back up your configuration file before proceeding with the installation. ### 4.1 Scanning Files from Amazon S3 Mounted as Shared Drive This section describes how to **enable the File System and Network Scanner Agent** to access and **scan data stored in an Amazon S3 bucket** by mounting it as a **shared drive on Linux**. Mounting an Amazon S3 bucket (for example, using Mountpoint for Amazon S3) exposes the bucket contents as a file system. The File System and Network Scanner Agent can then traverse and scan the mounted path like a standard file system. #### 4.1.1 Prerequisites In addition to the prerequisites listed in [*Section 3.0: Prerequisites*](/v1/docs/fortanix-key-insight-file-system-and-network-scanner-agent-configuration-linux#30-prerequisites), - Ensure you have access to an Amazon S3 bucket with appropriate permissions (at least read access). - Install the Mountpoint for Amazon S3 utility. *For more information, refer to the* [*AWS official documentation*](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mountpoint-installation.html)*.* - Ensure FUSE is enabled on the system, as it is required to mount the S3 bucket as a file system. - Ensure the File System and Network Scanner Agent is installed on the same machine where the S3 bucket is mounted. #### 4.1.2 Configure S3 Mount and Enable Scanning Perform the following steps to mount the S3 bucket as a shared drive and enable the File System and Network Scanner Agent to access and scan the data: 1. Run the following commands to download and install an S3 mount utility (the example shown below uses Mountpoint for Amazon S3): ```bash wget https://s3.amazonaws.com/mountpoint-s3-release/latest/x86_64/mount-s3.deb sudo apt install ./mount-s3.deb ``` 2. Run the following command to create a local directory to use as the mount path: ```bash mkdir ``` Here, `<mount-path>` is the local directory where the S3 bucket will be mounted. For example, `~/s3-mount`. 3. Run the following command to mount the S3 bucket: ```bash mount-s3 ``` Here, `<bucket name>` is the name of your S3 bucket. For example, `sandeep-ki-001`. 4. By default, mounted S3 buckets may restrict access to the mounting user. Run the following commands to allow the File System and Network Scanner Agent (running as another user, for example, `fortanix`) to access the mount: This ensures the File System and Network Scanner Agent can read files from the mounted path. - Enable FUSE configuration: ```bash echo "user_allow_other" | sudo tee -a /etc/fuse.conf ``` - Remount the bucket with `--allow-other`: ```bash fusermount -u mount-s3 --allow-other ``` 5. Add or modify the `included_root_paths` parameter in the File System and Network Scanner Agent configuration file to include the mounted S3 path so that the scanner can traverse and scan the data. ```bash included_root_paths:  - ``` Here, `<mount-path>` is the directory used to mount the S3 bucket (as created in *Step 2*). For example, `/home/sandeep/s3-mount`. 6. Run the following command to start the scanner and scan the keys: ```bash sudo -u fortanix -H /opt/fortanix/fs-scanner/bin/fortanix-fs-scanner -c ``` Here, `<fs-scanner-config-file>` is the path to the File System and Network Scanner Agent configuration file. For example, `/home/sandeep/Downloads/terraform_azure_sql_vm_final/on-prem/only_fs_agent_config.yaml` . ## 5.0 Run the File System and Network Scanner Agent After configuring the File System and Network Scanner Agent, it can be run under a dedicated restricted user account (For example, `fortanix`) to follow a least-privilege security model. > [!NOTE] > NOTE > > - You **must start the** `fortanix-scanner` **package first** before executing the File System and Network Scanner Agent. If the `fortanix-scanner` service is not running, the File System and Network Scanner Agent fails with a **connection refused** error when attempting to register a new scan. > - After you start the File System and Network Scanner Agent, any changes made to the scanner configuration file require restarting the scanner to apply the latest updates. > - If the scan is interrupted or closed, the next scan will start from the beginning. > - The scanner commands require the configuration file to be named `config.yaml`. If you are using the provided example file (`fortanix-fs-scanner.yaml.example`), ensure to copy or rename it to `config.yaml` before running any of the scanner commands in the following sections. ### 5.1 Manual Run - **Recommended (Least Privilege): Run as the** `fortanix` **User** Use the following command to start the File System and Network Scanner Agent as the dedicated `fortanix` user: ```bash sudo -u fortanix -H /opt/fortanix/fs-scanner/bin/fortanix-fs-scanner -c /opt/fortanix/fs-scanner/conf/config.yaml ``` This ensures the scanner runs under a controlled, restricted account that has only the required permissions to read the intended file system paths. - **Alternative (If already logged in as the** `fortanix` **user)** If you are already logged in as the `fortanix` user or another dedicated user with the required privileges, `sudo` is not needed. ```bash /opt/fortanix/fs-scanner/bin/fortanix-fs-scanner -c /opt/fortanix/fs-scanner/conf/config.yaml ``` ### 5.2 Using a Scheduled Timer To ensure the File System and Network Scanner Agent runs automatically, it can be configured as a systemd timer. This allows the agent to run on a defined schedule without manual intervention. Using a systemd timer is the recommended approach for running the File System and Network Scanner Agent. This method uses the example unit files provided in `/opt/fortanix/fs-scanner/conf/`. The systemd timer automatically triggers the scanner at the specified intervals. While manual execution of the agent is still possible (for example, during debugging), scheduling with a systemd timer ensures consistent and reliable operation. In the downloaded package, you will find the following example files: - **Service file** (`fortanix-fs-scanner.service.example`): Ensures the File System and Network Scanner Agent runs as a low-priority background task, minimizing impact on normal system operations. - **Timer unit** (`fortanix-fs-scanner.timer.example`): Defines the schedule for running the service. Here is the sample timer file: ```bash [Unit] Description = Fortanix File System Scanner (scheduled) [Timer] OnCalendar=Sun 03:45 Persistent=false [Install] WantedBy=timers.target ``` This configuration runs the scanner every Sunday at 03:45 AM, as specified in the `OnCalendar` parameter. Perform the following steps to schedule the File System and Network Scanner Agent: 1. Run the following command to copy the example service and timer unit files into the systemd directory: ```bash sudo cp /opt/fortanix/fs-scanner/conf/fortanix-fs-scanner.service.example /usr/lib/systemd/system/fortanix-fs-scanner.service sudo cp /opt/fortanix/fs-scanner/conf/fortanix-fs-scanner.timer.example /usr/lib/systemd/system/fortanix-fs-scanner.timer ``` 2. Run the following commands to enable and start the timer so it starts automatically on boot: ```bash sudo systemctl enable fortanix-fs-scanner.timer sudo systemctl start fortanix-fs-scanner.timer ``` ## 6.0 Troubleshooting *Refer to* [*On-premises Connection Troubleshooting*](/v1/docs/fortanix-key-insight-on-premises-connection-troubleshooting) *for guidance on troubleshooting steps for common issues encountered while configuring and running Fortanix Key Insight in on-premises environments.*