Installing the agents

Both are downloaded from the Downloads page in the console. Choose the agent, then your platform. Every download link is single-use and short-lived, so fetch a fresh one rather than sharing a URL.

One-click install

Under Install Steps each platform carries a single command - PowerShell or Command Prompt on Windows, one form everywhere else - with Manual beside it for anyone who would rather do it by hand, which is where the package download is. Paste the command into a terminal on the machine you are installing on: it downloads the package, installs it, and starts the service. There is nothing to carry over, unpack, or paste at a prompt.

• It picks the right build for the machine. The command carries every architecture and the script chooses on the target host, so the browser you generate it in does not have to be the machine you install on - which it usually is not.
• It installs as administrator. On Windows the command asks for elevation itself; on Linux and macOS it includes sudo, so it asks for your password. It will not install without it.
• The command is the credential. It carries single-use links that expire in 30 minutes and work once, so it needs no sign-in on the target machine - and is not worth keeping afterwards. Generate a new one whenever you need it.

The steps below are that same install done by hand.

Signing in

There is one button. Connect signs you in if it has to - your browser opens, you sign in there - and then brings the tunnel up. If your organization has more than one FGMesh you are asked which to join before anything is enrolled; a client is on one mesh at a time.

Client Agent, Windows

1. Download and run the installer.
2. Approve the Windows prompt so it can install its background service.
3. Fowlguard Connect starts itself. It is also in the Start menu and on the desktop.
4. Press Connect and sign in when the browser opens.
5. Choose your FGMesh if you are asked. You now reach the systems you have been granted.

Client Agent, macOS

1. Download the package and double-click it.
2. Follow the installer. It asks for your password: it installs a background service.
3. Open Fowlguard Connect from Applications.
4. Press Connect, sign in, and choose your FGMesh if you are asked.

Client Agent, Linux

1. Download the package and install it: sudo apt install ./<package>.deb
2. The background service starts on its own.
3. Open Fowlguard Connect from your applications menu. On GNOME, install the AppIndicator extension first or the tray icon will not appear.
4. Press Connect, sign in, and choose your FGMesh if you are asked.

Fowlguard Remote

The client installs a second application beside Fowlguard Connect: Fowlguard Remote, for SSH, RDP and WinRM sessions to the systems you have been granted. Open it like any other app - from Applications on macOS, the Start menu on Windows, or your applications menu on Linux.

• No second sign-in. If you are signed in to Fowlguard Connect, Remote signs itself in with the same account. If you are not, it asks you to sign in.
• Connect first. Remote reaches systems through the tunnel, so its sessions only open while Connect is connected.
• Re-verifying. Opening a session can ask you to confirm it is still you, as often as Re-Authenticate Every on the Session Privilege Policy page says. Signing in to Connect counts, so someone who has just signed in there is not asked again.
• Signing out of Connect signs Remote out too.

Which version is installed

Choose About Fowlguard Connect from the Fowlguard icon in the menu bar or system tray. It shows the version number, which is what support will ask for.

Server Agent

Generate a server licence key on the Licences page first: the installer takes it as an argument and a first install refuses to proceed without one. Once the gateway registers it appears on Asset Management, and you grant people access to it under Private Access → Access Policy.

• Linux, extract the archive, then sudo ./install.sh FG-XXXX-XXXX-XXXX-XXXX.
• macOS, extract, clear the download quarantine (xattr -dr com.apple.quarantine .), then sudo bash install.sh --no-build --license-key FG-XXXX-XXXX-XXXX-XXXX.
• Windows, unzip, then in an elevated PowerShell in that folder .\install.ps1 -LicenceKey FG-XXXX-XXXX-XXXX-XXXX.

No inbound port needs opening. The gateway makes its own way out.