Frequently asked questions
View as MarkdownWhat is InfraWard?
Section titled “What is InfraWard?”InfraWard is a self-hosted infrastructure inventory that keeps itself up to date. You enrol a server with one command, and InfraWard discovers what runs on it (Proxmox virtual machines and containers, Docker and Podman containers and images, Plesk sites), scans it for vulnerabilities and reconciles the inventory on a schedule. See the introduction.
Is InfraWard free?
Section titled “Is InfraWard free?”Yes. InfraWard is free and open source, released under the GNU Affero General Public License v3.0. The code is on GitHub. If you offer a modified version as a network service, you must make its source code available to its users.
Does InfraWard need an agent on each server?
Section titled “Does InfraWard need an agent on each server?”No. InfraWard is agentless. It connects over SSH with a dedicated, read-only inventory account that the enrolment script creates, with a restricted sudoers that only allows a closed list of queries. See Adding servers.
What can InfraWard inventory?
Section titled “What can InfraWard inventory?”Linux servers, Proxmox VE nodes (CTs and VMs), Docker and Podman hosts (containers, images, networks and volumes, including rootless Podman) and Plesk servers, with the relationships between them and a topology view. It also inventories domains from Cloudflare, with RDAP data, TLS certificate expiry and dangling DNS records. See Inventory and projects and Domains.
How does InfraWard find and prioritise vulnerabilities?
Section titled “How does InfraWard find and prioritise vulnerabilities?”Trivy scans servers and container images and stores a CycloneDX SBOM for each. Every finding gets a score from 0 to 100 based on CVSS, CISA KEV, EPSS and network exposure, so the list starts with what is exploited and reachable. Stored SBOMs are re-evaluated against new vulnerability data without reconnecting to the servers. See Vulnerabilities.
Where is my data stored?
Section titled “Where is my data stored?”On your own infrastructure. InfraWard runs as a set of containers with Docker Compose or Podman, and the database, Redis and OpenBao sit on an internal network. The worker only reaches the internet to download vulnerability data (the Trivy database, CISA KEV and EPSS) and, if you configure them, the Cloudflare API and RDAP. See Concepts and architecture.
What do I need to install it?
Section titled “What do I need to install it?”A 64-bit Linux host with Docker Engine 24 or later and the Compose v2 plugin (or Podman), 2 vCPU, 4 GB of RAM and 20 GB of free disk. The published images are for linux/amd64. Outside localhost you also need a DNS name and HTTPS. See Requirements.
How long does it take to try it?
Section titled “How long does it take to try it?”About ten minutes. The quick start runs a local instance with Docker Compose to evaluate InfraWard. For a production deployment, follow Install with Docker Compose.
Does InfraWard support single sign-on and two-factor authentication?
Section titled “Does InfraWard support single sign-on and two-factor authentication?”Yes. Users sign in with a local account or through an OIDC provider, and TOTP two-factor authentication is mandatory for administrators. There are five roles, and sign-ins, changes and terminal sessions are recorded in an audit log. See Authentication, MFA and OIDC.
In which language is the interface?
Section titled “In which language is the interface?”The interface is in Spanish. The documentation is in English and Spanish, and quotes each label as it appears on screen followed by its English meaning.
How do I report a security vulnerability?
Section titled “How do I report a security vulnerability?”Privately, through Report a vulnerability in the Security tab of the repository or by email to [email protected]. Do not open a public issue. See Security.