System Requirements

---

Applies to SSHepherd 2.0

SSHepherd® Command-and-Control (C3) server

The resources your C3 server needs depend on the size of your environment and how much it’s used. Set up a test environment to find the right size for your workload.

All installations

• CPU with AVX. The C3 database needs AVX. The installer stops if the CPU doesn’t support it. To check, run the command below. If it prints nothing, you need a newer CPU, or, on a virtual machine, a setting that passes AVX through to the guest. grep -m1 -oE 'avx2|avx' /proc/cpuinfo
• Kubernetes with ValidatingAdmissionPolicy support. The installer checks for this.
• MicroK8s 1.35 or later when you install on MicroK8s. The installer uses the Traefik ingress that MicroK8s 1.35 introduced.
• A DNS name for the C3 server, such as c3.example.com. The name must include a subdomain: the first part of the name (c3 in this example) names the server’s Kubernetes namespace.
• A TLS certificate for that name, or a public IP address and open ports 80 and 443 so the installer can get a free certificate from Let’s Encrypt. See Creating the C3 Server SSL Certificate.

Single MicroK8s node (for proof-of-concept environments only)

• CPU: 4 cores recommended. At least 8 cores are advisable for steadier performance with larger workloads.
• Memory: 32 GB or more recommended.
  • The installer stops if the server has less than 16 GB of memory, as reported by free -g. free -g rounds down, so a virtual machine given exactly 16 GB reports 15 GB and is rejected. Give the server at least 17 GB.
  • With less than 32 GB, the installer warns you and asks whether to continue.
• Storage: at least 64 GB free in /var. The installer warns you if there is less. Allow more for session recordings, at least 100 GB for larger workloads.

Multiple MicroK8s nodes (at least 3, for proof-of-concept or small production environments)

• CPU: 2 cores per node minimum; 4 cores per node recommended.
• Memory: 8 GB per node minimum; 16 GB per node recommended.
• Storage: 32 GB per node minimum; at least 64 GB per node to keep many recorded sessions.
• Longhorn storage must be installed and configured on the cluster before you install the C3 server.

Medium and large production environments

We recommend a full Kubernetes cluster, such as Azure AKS. Contact FullArmor for help sizing it.

Network ports

Port	Direction	Purpose
TCP 443	Inbound to the C3 server	Administrator Console, Control App, shepctl and Agent connections.
TCP 80	Inbound to the C3 server	Let’s Encrypt certificate requests. Needed only when you use Let’s Encrypt.
TCP 1935	Inbound to the C3 server, from Windows agents	RDP session recording. Needed when RDP recording is enabled.

Agents and clients connect outbound to the C3 server. Protected hosts need no inbound ports.

SSHepherd® Control App and CLI (shepctl)

---

The Control App and shepctl run on these operating systems:

• Windows 10 and Windows 11, Professional or Enterprise
• Windows Server 2016 +
• Ubuntu 16.04 +
• Debian 11 +
• Red Hat Enterprise Linux 7.9 +

The Linux Control App (shepui) is available for Debian/Ubuntu and RHEL 8 and later. On RHEL 7, only shepctl is available.

SSHepherd® Agent (shepagent)

---

The Agent’s own needs fit within the minimum requirements of each supported operating system. Each open tunnel uses extra CPU and memory, so we recommend at least 2 CPU cores and 4 GB of memory for a host running the Agent.

The Agent runs on:

• Windows 10 and Windows 11, Professional or Enterprise
• Windows Server 2016 +
• Ubuntu 16.04 +
• Debian 11 +
• Red Hat Enterprise Linux 7.9 +

Notes:

The Windows Agent is available for x64 and AArch64; the Linux packages are for x64.

Windows Server 2016 doesn’t include OpenSSH, so SSH sessions to it aren’t available. RDP works normally.

Windows Server 2019 and some Windows 10 builds may need OpenSSH Server installed before registration. See Installing the Agent.

Linux hosts need socat, lxc and OpenSSH from the distribution’s repositories.