No long-lived keys
With the built-in OpenBao CA, collection uses SSH certificates valid for five minutes. There are no per-server private keys to protect.
v0.5.2 available on GitHubYour infrastructure inventory,
Your infrastructure inventory,
always up to date.
Connect a server with one command. InfraWard discovers what runs on it, finds the vulnerabilities that matter and keeps everything current on its own.
- Self-hosted
- Proxmox · Docker · Podman · Plesk
- Open source, AGPL-3.0
#curl -fsSL https://infraward.net/api/enroll/Lq…n0 | sudo bash[infraward] User 'inventory'[infraward] Root helper (closed list of queries)[infraward] Restricted sudoers (version 7)[infraward] InfraWard SSH CA: short-lived certificates[infraward] Notifying InfraWard[infraward] Done. InfraWard will now verify the SSH connection.4 containers, 150 packages and 487 vulnerabilities inventoried
Product tour
Everything you run, in one place
Real screens from a test installation with three servers and a Docker host.
An inventory that builds itself
Every server with what it contains: CTs and VMs, containers, images, networks and volumes, in their real hierarchy.
- Filters such as tag:prod -estado:retirado ip:10.0.0.0/24
- Bulk actions and CSV or JSON export
- Snapshots with the differences between collections
See how it all connects
A graph of hosts, containers, images, networks and volumes, with critical vulnerabilities highlighted.
- Connected to, mounts, instance of
- Expand a host to load its contents
- Highlight assets with critical CVEs
Start with what is exploited and exposed
One row per CVE, ranked by CISA KEV, EPSS, network exposure and fix availability, with the reasons spelled out.
- SBOMs re-evaluated daily without rescanning
- New CVEs since your last visit
- Noise such as unused kernels kept out of the way
A shell without handing out keys
Open a session from the browser. Each one uses an SSH certificate signed for that session and valid for two minutes.
- Permissions per server, tag or project
- Re-authentication before every session
- Opening and closing recorded in the audit log
Team passwords, kept apart
Console, web panel and IPMI passwords in a store the scanning workers cannot read.
- Revealing requires signing in again
- Versions, rotation reminders and trash
- Linked to the assets they open
How it works
From one command to a complete picture
- 1
Generate a command
Choose certificate or key access. The token is single-use and expires in minutes.
- 2
Run it on the server
The script creates a read-only inventory user and pins the host keys. No agent stays behind.
- 3
InfraWard collects
Over SSH, with Ansible: packages, services, ports, and everything the server contains.
- 4
It stays up to date
Trivy SBOMs, KEV and EPSS updates and scheduled reconciliation keep the picture current.
Prioritisation
A score you can explain
Every finding gets a score from 0 to 100. Toggle the factors to see how CVE-2023-44487 (HTTP/2 Rapid Reset) on an exposed nginx container reaches the top of the list.
CVE-2023-44487
Score
100/100
Urgent
Security and control
Built for people who run production
Secrets by reference
The database only holds references. Values live in OpenBao or are encrypted with a key kept outside it.
Roles, OIDC and MFA
Five roles, sign-in through your identity provider and two-factor authentication, mandatory for administrators.
Everything audited
Sign-ins, enrolments, policy changes, password reveals and terminal sessions, with the source IP.
Domains and certificates
Cloudflare zones, RDAP and TLS expiry, dangling DNS records and the service behind each name.
API and dashboards
Customisable dashboards per user and per project, read-only or role-scoped API tokens and exports.
Self-hosted and open source
Your data stays on your servers
InfraWard runs as a handful of containers with Docker Compose or Podman. PostgreSQL, Redis and OpenBao sit on an internal network, every container runs read-only and without privileges, and workers scale out as your estate grows.
Released under the GNU Affero General Public License v3.0. Contributions are accepted under a Contributor License Agreement.
- Docker Compose or Podman
- Horizontal worker scaling
- Agentless, over SSH
- AGPL-3.0
Install InfraWard on your own servers
The code is on GitHub under the AGPL-3.0. Follow the quick start to have it running in a few minutes, or read the installation guide for a production deployment.