1. Home
  2. Guides
  3. Next-Gen WAF
  4. Setup and configuration
  5. Agent management

Installing the agent

This guide explains how to install the Next-Gen WAF agent by adding the package repository, installing and configuring the agent package, and then starting the agent.

Prerequisites

Before installing the agent, you need to:

  1. Alpine Linux
  2. Amazon Linux
  3. Debian
  4. Red Hat/CentOS
  5. Ubuntu
  6. Windows
  • If Alpine is being run in a Docker container, you must start the container.

  • Copy the agent keys for the site that you want the agent to be able to access. You will use the agent keys when configuring the Next-Gen WAF agent package.

Add the package repository

Begin the agent installation process by adding the appropriate package repository for your operating system.

HINT: If you're installing the agent on Windows, you can skip this step and start installing the agent package.

Alpine Linux

Add the version of the Alpine package repository that you want to use.

NOTE: Following these instructions will configure your package manager to pull from https://apk.security.fastly.com. You can find the same package repositories at https://apk.signalsciences.net. To configure your package manager to pull from https://apk.signalsciences.net, replace all instances of security.fastly.com with signalsciences.net in the relevant code sample.

  1. Docker container
  2. VM or bare-metal server

If you are running Alpine in a Docker container, complete the following steps:

  1. Add the following to your Dockerfile:

    FROM alpine:3.20
    ENV ALPINE_VERSION=3.20
    RUN wget https://apk.security.fastly.com/sigsci_apk.pub && \
    apk add --repository https://apk.security.fastly.com/${ALPINE_VERSION}/main --no-cache && \
    apk update

  2. Verify the downloaded key contains the proper key by running the following command:

    $ openssl rsa -pubin -in /etc/apk/keys/sigsci_apk.pub -text -noout

    If the downloaded key contains the proper key, the expected output looks like the following:

    Public-Key: (2048 bit)
    Modulus:
       00:c7:71:47:93:fe:ee:0e:9e:6f:28:7d:d8:67:d7:
       ce:2a:43:bf:af:54:91:d1:f1:09:59:e2:86:20:65:
       a6:59:8c:2f:7b:1c:d5:e7:b7:34:62:52:90:1c:f3:
       de:2e:26:4b:a4:46:97:32:ca:f8:a2:e8:0e:36:0d:
       5e:70:82:3a:97:ce:8b:37:e6:52:31:af:cb:6a:11:
       c8:c1:6e:dd:01:bb:37:62:39:f1:53:ce:22:ef:8b:
       46:50:31:8f:e8:40:7e:4d:01:77:0e:37:06:34:ac:
       ce:aa:a2:d5:dc:a4:e3:f0:44:c0:dd:53:f6:e5:34:
       f9:8d:54:22:43:90:d8:2e:69:3d:a7:e9:11:b1:31:
       9e:83:a0:d5:e2:f6:0c:21:f9:96:ac:33:13:89:93:
       ed:c5:bf:d4:8b:4c:14:26:a4:fb:f3:51:1d:d8:ec:
       25:04:f7:ab:b4:a9:73:d4:b2:05:39:ae:4d:57:ff:
       79:8e:24:e7:23:a3:0a:53:48:cb:8b:a0:8a:d2:14:
       44:3a:29:09:4e:ec:a6:df:2c:53:b5:a1:db:33:84:
       29:db:14:0a:7d:38:97:ac:cb:9d:40:53:d2:1e:84:
       f4:71:cb:67:15:c0:a1:fe:f1:93:cf:67:f6:ee:0d:
       6d:ab:d9:b1:8a:ce:4f:83:e4:36:12:45:11:b4:64:
       99:97
    Exponent: 65537 (0x10001)

Amazon Linux

Add the version of the Amazon Linux package repository that you want to use.

NOTE: Following these instructions will configure your package manager to pull from https://yum.security.fastly.com. You can find the same package repositories at https://yum.signalsciences.net. To configure your package manager to pull from https://yum.signalsciences.net, replace all instances of security.fastly.com with signalsciences.net in the relevant code sample.

  1. Amazon Linux 2023
  2. Amazon Linux 2

To add the Amazon Linux 2023 package, run the following script:

$ sudo tee /etc/yum.repos.d/sigsci.repo <<-'EOF'
[sigsci_release]
name=sigsci_release
baseurl=https://yum.security.fastly.com/release/amazon/2023/$basearch
repo_gpgcheck=1
gpgcheck=1
enabled=1
gpgkey=https://yum.security.fastly.com/release/gpgkey https://dl.security.fastly.com/sigsci-agent/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
EOF

Debian

Add the version of the Debian package repository that you want to use.

NOTE: Following these instructions will configure your package manager to pull from https://apt.security.fastly.com. You can find the same package repositories at https://apt.signalsciences.net. To configure your package manager to pull from https://apt.signalsciences.net, replace all instances of security.fastly.com with signalsciences.net in the relevant code sample.

To add the package for Debian 9 (Stretch) and above, run the following script:

$ sudo apt-get update
$ sudo apt-get install -y apt-transport-https wget gnupg lsb-release
$ sudo wget -qO - https://apt.security.fastly.com/release/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/sigsci.gpg
$ sudo echo "deb [signed-by=/usr/share/keyrings/sigsci.gpg] https://apt.security.fastly.com/release/debian/ `lsb_release -cs` main" | sudo tee /etc/apt/sources.list.d/sigsci-release.list
$ sudo apt-get update

If installing the utilities fails, some customers may need to add the archive repositories first for older versions of Debian. For example, in Debian 10 (Buster), you would run the following script:

$ sudo echo "deb http://archive.debian.org/debian/ buster main contrib non-free" >> /etc/apt/sources.list
$ sudo apt-get update

Red Hat/CentOS

Add the version of the Red Hat/CentOS package repository that you want to use.

NOTE: Following these instructions will configure your package manager to pull from https://yum.security.fastly.com. You can find the same package repositories at https://yum.signalsciences.net. To configure your package manager to pull from https://yum.signalsciences.net, replace all instances of security.fastly.com with signalsciences.net in the relevant code sample.

  1. Red Hat/CentOS 10
  2. Red Hat/CentOS 9
  3. Red Hat/CentOS 8
  4. Red Hat/CentOS 7

To add the Red Hat/CentOS 10 package, run the following script:

$ sudo tee /etc/yum.repos.d/sigsci.repo <<-'EOF'
[sigsci_release]
name=sigsci_release
baseurl=https://yum.security.fastly.com/release/el/10/$basearch
repo_gpgcheck=1
gpgcheck=1
enabled=1
gpgkey=https://yum.security.fastly.com/release/gpgkey https://dl.security.fastly.com/sigsci-agent/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
EOF

Ubuntu

Add the version of the Ubuntu package repository that you want to use.

NOTE: Following these instructions will configure your package manager to pull from https://apt.security.fastly.com. You can find the same package repositories at https://apt.signalsciences.net. To configure your package manager to pull from https://apt.signalsciences.net, replace all instances of security.fastly.com with signalsciences.net in the relevant code sample.

  1. V24.04
  2. V22.04
  3. V20.04
  4. V18.04
  5. V16.04
  6. V14.04

To add the Ubuntu 24.04 - Noble package, run the following script:

$ sudo apt-get update
$ sudo apt-get install -y apt-transport-https wget gnupg
$ wget -qO - https://apt.security.fastly.com/release/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/sigsci.gpg
$ sudo echo "deb [signed-by=/usr/share/keyrings/sigsci.gpg] https://apt.security.fastly.com/release/ubuntu/ noble main" | sudo tee /etc/apt/sources.list.d/sigsci-release.list
$ sudo apt-get update

Install and configure the agent package

After adding the package repository, install and configure the Next-Gen WAF agent.

  1. Alpine Linux
  2. Amazon Linux
  3. Debian
  4. Red Hat/CentOS
  5. Ubuntu
  6. Windows
  1. Run the following command to install the Next-Gen WAF agent package:
    $ sudo apk add sigsci-agent
  2. Create an empty agent configuration file in the following directory: /etc/sigsci/agent.conf.
  3. Add the agent keys for your site to the agent configuration file.
    accesskeyid = "AGENTACCESSKEYHERE"
    secretaccesskey = "AGENTSECRETACCESSKEYHERE"
  4. Save the agent configuration file.

Start the agent

Next, start the Next-Gen WAF agent that you installed.

NOTE: If you installed the agent on Windows, you can skip this step. The last step of the installation process started the agent.

  1. Alpine Linux
  2. Amazon Linux
  3. Debian
  4. Red Hat/CentOS
  5. Ubuntu

If you are running Alpine in a Docker container, run the following command to start the Next-Gen WAF agent:

$ /usr/sbin/sigsci-agent

If you are running Alpine in a VM or on a bare-metal server, run the following command to allow the agent to start on reboot:

$ sudo rc-update add sigsci-agent default

Then, start the agent by running any of the following commands:

$ sudo service sigsci-agent start
$ sudo rc-service sigsci-agent start
$ sudo /etc/init.d/sigsci-agent start

Next steps

Continue setting up your Next-Gen WAF deployment by installing the Next-Gen WAF module or configuring the agent to run as a reverse proxy.

If your agent is on Debian, Red Hat/CentOS, or Ubuntu, consider enabling the agent auto-update service. This service checks our package downloads website for a new version of the agent and updates the agent when a new version is available.

Related content

Fastly
© Fastly 2026