---
title: Linux Host
slug: docs/linux-host
icon: {"faIcon":"fa-brands fa-linux"}
docTags: 
createdAt: 2024-04-17T16:41:13.944Z
---

# Getting started

If you're looking to run the scanner on a Linux system, setting it up to run as a systemd unit is a good way to ensure that it:

- starts automatically when the node starts up, and automatically restarts as well
- uses centralized system logging with rotation
- can be isolated if needed for security purposes

Most modern Linux distributions include systemd to manage daemons and system services.

By default, systemd services run as the root user of a system, thus inheriting root user permissions. While this is a perfectly valid configuration for many services, it could potentially represent an increased security risk. If you wish to configure the service to run as a non-root user, you will need to ensure you specify `User=` in the service configuration (similar to the example below), and that the user has permissions to:

- Read and write to the directory in which the scanner binary is located
- Read any directories that you would like to scan for secrets

If you would like to create a specific user for the scanner to run as, perform the following command on Debian-based systems (using `truffle` as an example):

```shell
sudo adduser truffle
```

For other Linux distributions:

```shell
sudo useradd -m truffle
```

The user running TruffleHog must have write access to the folder that contains it in order for the updater to work properly.

```shell
chown -R truffle: /path-containing-trufflehog/
```

Continue on to the following sections for the rest of the setup.

## Debian-based systems

Cloud providers like AWS have a default user already configured on Debian and Ubuntu machine images. The example below references `ubuntu`

- Debian: `admin`
- Ubuntu: `ubuntu`

If you've created a special user for running the scanner, substitute it in the configuration below.

1. Extract the TruffleHog scanner archive to `/home/ubuntu`
2. Copy your `config.yaml` into `/home/ubuntu`
3. Copy the Systemd Unit file given below into `/etc/systemd/system/trufflehog.service`

## Amazon Linux

For Amazon Linux-based nodes, the default user is: `ec2-user`.

If you've created a special user for running the scanner, substitute it in the configuration below.

1. Extract the TruffleHog scanner archive to `/home/`
2. Copy your `config.yaml` into `/home/ec2-user`
3. Copy the Systemd Unit file given below into `/etc/systemd/system/trufflehog.service`

```ini
    [Unit]
    Description=Run the TruffleHog scanner as a daemon

    [Service]
    Type=simple
    ExecStart=/home/ec2-user/scanner scan --config=/home/ec2-user/config.yaml
    Restart=on-failure
    RestartSec=15s
    User=ec2-user

    [Install]
    WantedBy=multi-user.target
```

1. Reload Systemd to make it aware of the new service unit file: `sudo systemctl daemon-reload`
2. Configure the Systemd to run TruffleHog at boot: `sudo systemctl enable trufflehog.service`
3. Start TruffleHog right now: `sudo systemctl start trufflehog.service`
4. View the status of TruffleHog `sudo systemctl status trufflehog.service`
5. View the TruffleHog logs: `sudo journalctl -u trufflehog`
6. Tail the TruffleHog logs: `sudo journalctl -fu trufflehog`

## Configuring proxy connections when running as a Systemd service

In some instances, you may want to run a local scanner on a node that does not have outbound connectivity due to firewall configuration or other network topology. In that instance, you can configure systemd services with a proxy by making use of the `Environment=` setting. Using the above `ubuntu` example again:

```ini
    [Unit]
    Description=Run the TruffleHog scanner as a daemon

    [Service]
    Environment="HTTP_PROXY=http://proxy.server.com:8000"
    Environment="HTTPS_PROXY=https://proxy.server.com:8000"
    Type=simple
    ExecStart=/home/ubuntu/scanner scan --config=/home/ubuntu/config.yaml
    Restart=on-failure
    RestartSec=15s
    User=ubuntu

    [Install]
    WantedBy=multi-user.target
```

Be sure to change the URL to the actual address or IP of your proxy server.