Install the agent

Where the install page is

Sign in, open Companies (or My company), and copy the install link. It looks like this:

https://hub.[yourdomain]/install/inst_…

The link is the credential. Anyone who has it can enrol a machine into that company, so treat it like a password. Rotate it from the company page; the old link stops working immediately and enrolled machines are unaffected.

Windows

Server 2016 and later, Windows 10 and 11. Run in an elevated PowerShell:

irm https://hub.[yourdomain]/install/inst_…/windows.ps1 | iex

Installs to C:\BEAgent, registers the auto-start service BEAgent running as LocalSystem with restart-on-failure recovery, and starts it. Logs go to be-agent.log next to the binary. Manage it with be-agent.exe status|start|stop|uninstall.

Linux

Ubuntu, Debian, CentOS and Rocky, Proxmox, and anything else with systemd. Run as root:

curl -fsSL https://hub.[yourdomain]/install/inst_…/linux.sh | sudo bash

Installs to /opt/be-agent with a systemd unit set to Restart=always. The unit restarts the agent after a self-update on purpose: the agent exits non-zero after swapping its binary.

macOS

Apple silicon and Intel. Run in Terminal:

curl -fsSL https://hub.[yourdomain]/install/inst_…/macos.sh | sudo bash

Installs to /usr/local/be-agent as a LaunchDaemon. No MDM needed; an MDM can push the same command.

OPNsense and pfSense

FreeBSD 13 and 14 on amd64. Run as root from the firewall's shell:

fetch -o - https://hub.[yourdomain]/install/inst_…/freebsd.sh | sh

Installs to /usr/local/be-agent with an rc.d service supervised by daemon(8), so the agent comes back after a self-update. Services and error events are read from rc and /var/log/messages. Keep shell access off on firewalls. A firmware upgrade can remove the files; run the line again afterwards and the machine's history continues.

Teltonika and OpenWrt

ARM routers such as the Teltonika RUTX11 on RutOS, and OpenWrt 21 and later. Run as root over SSH:

wget -O - https://hub.[yourdomain]/install/inst_…/openwrt.sh | sh

Installs to /etc/be-agent with a procd service and registers the files with sysupgrade so firmware upgrades keep the agent. On Teltonika routers the heartbeat also carries cellular signal, operator, connection state and WAN failover. Needs roughly 7 MB of free flash: RUTX and RUTM models, not the 16 MB ones.

Options on the install page

• Allow remote shell. Sets allow_shell: true in the machine's own configuration. Without it, BE AI can propose a command and the machine will refuse it. The hub can never switch this on remotely.
• Heartbeat interval. Default 300 seconds, minimum 30.
• Apply to an already-installed agent. Without it, an existing configuration is left untouched and the machine keeps its identity. With it, the script rewrites the configuration with the chosen settings, keeps the machine's id, and restarts the service. Use it to move a machine to another company or to change the hub address.

Page and script fetches are recorded in the audit trail.

Devices without an agent

Small routers, switches, NAS boxes and anything with SSH but no agent can be watched through a machine that has one. Open the proxy machine in the fleet, go to proxied devices, add the device (host, user, kind), put the proxy's public key on the device, and push the list. The proxy polls it every heartbeat with a fixed read-only command set and the device appears in the fleet as its own machine marked "via" the proxy. The SSH key never leaves the proxy; the hub only knows hostnames and usernames.

Removing a machine

Uninstall the service on the machine (be-agent.exe uninstall on Windows, remove the unit or daemon elsewhere) and delete its folder. Then, as superadmin, forget the machine from its page in the fleet once it is offline; that deletes its heartbeats, events and check results and keeps its runs, proposals and audit records.