Prepare the server, access and installation files
Decide what you are installing
Use the new-installation procedure for a server without DerScanner. If DerScanner is already present, use Bring an existing installation under DCP and the appropriate update chapter. Do not delete an existing installation to make the new-installation wizard appear.
Before opening the wizard, agree on the deployment country, the required product version and the licensed modules. Decide whether this server will hold Core and the scanners together or whether modules will run on separate hosts. The preparation below covers the current server; size each remote host separately using the distributed-installation chapters. SAST Builder and additional SAST agents have their own setup procedures.
Prepare the operating system and capacity
- Prepare a supported x86_64 server: Ubuntu 22.04/24.04, Debian 12, or AlmaLinux, RHEL or Rocky Linux 8/9. Four CPU cores and 32 GB of RAM are recommended. Fewer cores are allowed, but scans may be slower. If the server has less memory than the release needs, the Server check reports the shortfall and tells you to add memory and check again. Check memory against the requirements shown for the selected release and modules.
- We recommend 250 GB of disk capacity to leave room for a later update; this is not a fixed installation minimum. The Server check calculates the minimum needed for the selected release and modules. Also allow for images, databases and retained backups when planning capacity.
- Check the filesystem that will hold Docker data, the installation directory and the backup location. Space on a different mounted disk does not automatically provide space to Docker.
- For a virtual machine, also check free space on the underlying datastore and avoid allocating memory that the host cannot supply.
- Confirm that the server clock, name resolution and routing work. Correct these before checking download credentials or signatures.
- Obtain an administrator account with permission to install software and start services. Keep SSH or console access available until installation and first product access are complete.
Docker does not have to be installed beforehand on a new server: the wizard offers Install Docker. If Docker already exists, let the server check evaluate it. Do not remove an existing Docker installation or its data as a troubleshooting shortcut.
Prepare network access
Video walkthrough: Set Up a Proxy in the DerSecur Control Panel for DerScanner Downloads (YouTube).
| Connection | Purpose |
|---|---|
| Browser → server, TCP 9443 by default | HTTPS access to DerSecur Control Panel |
| Browser → product address, TCP 80/443 as configured | DerScanner application; use the actual address displayed after installation |
| Server → delivery services | Online installation, downloading images and preparing a delivery folder |
| Administrator → server | SSH or the console access provided by your infrastructure team |
Allow the required online access, including registry.derscanner.com, and the operating-system package mirrors used to install Docker. Behind a filtering proxy, configure the Docker daemon to use that proxy too; allow the distribution mirrors for AlmaLinux, RHEL and Rocky Linux when using those systems. Use the connection checks to identify blocked destinations. On a new server, ensure the required listening ports are not occupied by unrelated applications. Remote modules require additional inter-server connections described in their own chapters.
If the target cannot access the internet, arrange an internet-connected preparation server and a way to transfer the complete delivery folder. The preparation server, transfer medium and target each need enough free space. Follow Installation without internet.
Keep the three kinds of access clear
- Operating-system access lets the administrator start the panel and maintain the host.
- The registry account issued by DerSecur is used by the installation flow for the registry and panel access; it has nothing to do with the licence. Online, the panel checks this pair with the DerScanner registry. On a server without internet access the first login and password you type become the account of that panel, and later only they work. You can change the panel password in Settings (at least 12 characters); a password cannot start or end with a space. After too many wrong attempts, sign-in is locked for 5 minutes. A one-time startup link is another way to enter the panel; it is private and temporary.
- The DerScanner product administrator is
admin. Its installation-generated password is shown on the completion screen on request. It is not the operating-system password or the registry password.
Have the approved installation command or delivery folder and the registry account issued by DerSecur ready. Use a modern browser from a computer that can reach the displayed panel address. Store passwords and licence files in your approved secure location, not in screenshots or support messages.