Agent

The LEA Platform agent connects to your LEA server, runs the validation (and, where enabled, remedy) commands assigned to its host, and sends back the raw results. It never decides pass or fail itself; the server does.

Builds: Linux amd64/arm64, macOS arm64, Windows amd64/arm64.

The agent ships as two binaries:

In normal use you only start lea-agent. It finds and launches the runner.

Quick start

Put both binaries in one directory with a lea.conf, then run:

./lea-agent

On first start the agent enrolls with the deployment token in lea.conf and receives its client certificate. See Agent enrollment.

Watchdog options (lea-agent)

lea-agent [OPTIONS]

  --help                  Show help and exit
  --version               Show version and exit
  --dry                   Show which runner would be started, without starting it
  --runner-version=X.Y.Z  Use a specific runner version
  --force-cmd=COMMAND     Run one specific server command only
  --privileged            Pass --privileged to the runner (allows running as root)
  --user=USERNAME         Run the runner as this user (Linux/macOS)
  --group=GROUPNAME       Run the runner as this group (Linux/macOS)
  --config=PATH           Use this configuration file
  --install-service       Install as a Windows service (Windows)
  --uninstall-service     Remove the Windows service (Windows)

Runner options (lea-agent-runner)

lea-agent-runner [OPTIONS]

  --help                Show help and exit
  --version             Show version and exit
  --show-config         Print the resolved configuration and exit
  --force-cmd=COMMAND   Run one specific server command, then exit
  --privileged          Allow running as root / SYSTEM
  --config=PATH         Use this configuration file

Debug logging: LEA_DEBUG=1 lea-agent-runner.

Configuration

Priority, highest first:

1. Environment variables
2. Configuration file: ./lea.conf, then conf/lea.conf, then /etc/lea.conf (or --config)
3. Built-in defaults

Example lea.conf:

LEA_SERVER_URL=https://lea.example.com/lea
LEA_ENROLL_TOKEN=<deployment token from Settings>
LEA_SKIP_SSL_VERIFY=false
LEA_DEBUG=0
LEA_INTERVAL=30
LEA_COMMAND_TIMEOUT=60
LEA_USER=lea
LEA_GROUP=lea

Lines starting with # are comments; values may be quoted. Only set LEA_SKIP_SSL_VERIFY=true in test environments.

Running as a service

Linux (systemd)

# /etc/systemd/system/lea-agent.service
[Unit]
Description=LEA Agent
After=network.target

[Service]
ExecStart=/opt/lea/lea-agent
WorkingDirectory=/opt/lea
Restart=on-failure
User=lea
Group=lea
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now lea-agent
sudo journalctl -u lea-agent -f

macOS (launchd)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>             <string>com.lea.agent</string>
  <key>ProgramArguments</key>  <array><string>/opt/lea/lea-agent</string></array>
  <key>WorkingDirectory</key>  <string>/opt/lea</string>
  <key>RunAtLoad</key>         <true/>
  <key>KeepAlive</key>         <true/>
  <key>StandardOutPath</key>   <string>/opt/lea/lea-agent.log</string>
  <key>StandardErrorPath</key> <string>/opt/lea/lea-agent.log</string>
</dict>
</plist>

sudo launchctl load -w /Library/LaunchDaemons/com.lea.agent.plist

Windows (Service Control Manager)

In an elevated PowerShell:

.\lea-agent.exe --install-service    # install, auto-start at boot
Start-Service LEAAgent
Stop-Service LEAAgent
.\lea-agent.exe --uninstall-service

The service appears as LEA Agent in services.msc. As a service, output goes to lea-agent.log next to lea-agent.exe (Get-Content -Wait .\lea-agent.log).

Versions and updates

• The watchdog picks the highest lea-agent-runner* version in its directory. To roll out a new runner by hand, drop it next to the old one; it is used on the next restart.
• If a runner crashes within 30 seconds of starting, the watchdog falls back to the next lower version.
• The agent can also update itself when the server announces a new version: it downloads the binary, checks the SHA-256 hash and only then uses it.

Runner exit codes

Least privilege: lea_priv_wrapper.sh

By default the runner refuses to run as root. For the few checks that need root on Linux, LEA provides lea_priv_wrapper.sh (download: /downloads/lea_priv_wrapper.sh). It is an allow-list gate: the lea service account gets one sudoers entry for the wrapper, and the wrapper only runs named operations with validated arguments.

cp lea_priv_wrapper.sh /usr/local/sbin/lea_priv_wrapper.sh
chown root:root /usr/local/sbin/lea_priv_wrapper.sh
chmod 750 /usr/local/sbin/lea_priv_wrapper.sh
echo 'lea ALL=(root) NOPASSWD: /usr/local/sbin/lea_priv_wrapper.sh' > /etc/sudoers.d/lea
visudo -c

In a rule command:

sudo /usr/local/sbin/lea_priv_wrapper.sh sysctl_get net.ipv4.ip_forward

Run /usr/local/sbin/lea_priv_wrapper.sh --help for the supported operations. Every call, allowed or denied, is logged to syslog with the tag lea_priv_wrapper. Shipped rules that need elevated rights are tagged priv:required.