Sentinel (Beacon)

Headless daemon for unattended remote access to servers and kiosks. Install with a single command, runs as a system service.

Overview

The Sentinel (also called Beacon) is a minimal headless daemon — approximately 500KB on disk and ~2MB RAM at rest. It requires no GUI and is designed for servers, kiosks, and other unattended machines.

The beacon acts as a "doorbell" — it listens for authenticated, signed wake requests from the Syslok server. When a request arrives, it downloads and launches the ephemeral agent with pre-authorized credentials. The beacon itself cannot control anything on the machine. It only listens and wakes the agent on demand.

Installation

Install the beacon with a single command. There are two registration methods:

Using a pre-registered token (from the dashboard)

Terminal
$ curl -sSL https://your-server/api/v1/beacon/install.sh | sudo bash -s -- --token bkn_xxx --name "server-01"

Using an enrollment code (self-registration)

Terminal
$ curl -sSL https://your-server/api/v1/beacon/install.sh | sudo bash -s -- --enroll DQ-XXXX-XXXX --name "server-01"

--token uses a beacon token that was pre-registered in the Syslok dashboard. The device is already known to the server before installation.

--enroll uses an enrollment code for self-registration. The device registers itself with the server during installation. Useful for bulk deployments where you distribute a shared enrollment code.

What the Installer Does

  1. Detects platform — Identifies the operating system (Linux, macOS, FreeBSD) and CPU architecture (x86_64, aarch64, armv7).
  2. Downloads beacon binary — Fetches the correct binary for the detected platform and verifies its signature.
  3. Creates config file — Writes the configuration to /opt/syslok-beacon/config/config.json with the server URL and credentials.
  4. Creates service user — On Linux, creates a dedicated syslok-beacon user with minimal privileges.
  5. Installs system service — Registers the beacon as a system service (systemd, launchd, or rc.d depending on platform).
  6. Starts and verifies — Starts the service and confirms it is running and connected to the server.

Service Management

Linux (systemd)

Terminal
$ sudo systemctl status syslok-beacon
$ sudo systemctl start syslok-beacon
$ sudo systemctl stop syslok-beacon
$ sudo journalctl -u syslok-beacon -f

macOS (launchd)

Terminal
$ sudo launchctl list | grep syslok
$ sudo launchctl load /Library/LaunchDaemons/com.syslok.beacon.plist
$ sudo launchctl unload /Library/LaunchDaemons/com.syslok.beacon.plist
$ tail -f /var/log/syslok-beacon.log

FreeBSD (rc.d)

Terminal
$ sudo service syslok-beacon status
$ sudo service syslok-beacon start
$ sudo service syslok-beacon stop

Configuration

The beacon configuration file is located at /opt/syslok-beacon/config/config.json.

config.json
{
"server_url" : "https://your-server.syslok.com" ,
"beacon_token" : "bkn_xxxxxxxxxxxxxxxxxxxx" ,
"heartbeat_interval" : 30
}

Configuration can also be set via CLI arguments or environment variables:

Config KeyEnvironment Variable
server_urlSYSLOK_SERVER_URL
beacon_tokenSYSLOK_BEACON_TOKEN
heartbeat_intervalSYSLOK_HEARTBEAT_INTERVAL

How Unattended Access Works

  1. The beacon sends a heartbeat to the server every 30 seconds (configurable) to signal that the machine is online.
  2. When an operator initiates a session from the dashboard, the server sends a signed wake command to the beacon.
  3. The beacon verifies the signature, then downloads and runs the ephemeral agent with pre-authorized credentials.
  4. No consent prompt is displayed — this is unattended access by design. The machine owner authorized it when they installed the beacon.
  5. The ephemeral agent auto-expires based on the session TTL. When the session ends, the agent self-destructs as usual.

Supported Platforms

PlatformArchitecturesService Manager
Linuxx86_64, aarch64, armv7systemd
macOSApple Silicon, Intellaunchd
FreeBSDx86_64rc.d

Uninstall

To completely remove the beacon from a machine, run the installer script with the --uninstall flag:

Terminal
$ curl -sSL https://your-server/api/v1/beacon/install.sh | sudo bash -s -- --uninstall

The uninstaller performs the following steps:

  • Stops the beacon service
  • Removes the service registration (systemd unit, launchd plist, or rc.d script)
  • Deletes the binary and configuration files from /opt/syslok-beacon/
  • Removes the syslok-beacon service user (Linux)

Previous

Tray App

Next

Controller App