RoamSwitch Icon RoamSwitch by Lafine Systems Design

Setup and configuration

Check the state of signed data updates

Check signed-data updates, watch the daemon restart and report an abnormal exit, and uninstall in a reversible way.

  • Level: Intro
  • About 30 min
  • 2026-11-12

#Check the state of signed data updates

Server Edition receives the kernel CVE map, the web rules, the KEV list and more, and checks their signatures first. This is Automatic updates of signed threat data. roamswitch-updater does the work, and roamswitch-update.timer runs it once a day.

The timer first fires 15 minutes after boot, then every 24 hours. It adds up to 3 hours of random delay, so many hosts do not check in at the same moment (OnBootSec=15min, OnUnitActiveSec=24h, RandomizedDelaySec=3h in the timer).

Read the data versions and the doctor line

This is right after a first install. On a first install, the package scripts fetch the signed data once.

ls /var/lib/roamswitch/*.VERSION
systemctl list-timers roamswitch-update.timer --all --no-pager
sudo roamswitch doctor | grep Signed
Output
/var/lib/roamswitch/cve_kernel_map.VERSION
NEXT                            LEFT LAST PASSED UNIT                    ACTIVATES
Thu 2026-11-12 03:40:50 UTC 1h 33min -         - roamswitch-update.timer roamswitch-update.service

1 timers listed.
[ok] Signed data updates have not run yet. The timer's first run is still to come (after that it runs once a day).

Only one *.VERSION file is there yet, and doctor says the updates have not run. The package scripts start the install-time fetch but do not wait for it, so right after apt it was still in progress. A few seconds later all six files were there (see the next step). The timer's LAST is still -, because the package scripts ran that fetch, not the timer.

Run it once by hand.

sudo systemctl start roamswitch-update.service
sudo journalctl -u roamswitch-update.service --no-pager -o cat | grep -E "installed|already"
for f in /var/lib/roamswitch/*.VERSION; do echo "$f: $(cat $f)"; done
sudo roamswitch doctor | grep Signed
Excerpt
2026-11-12T02:07:47.078169Z  INFO cve kernel map installed: 2026-11-09 (7763393 bytes)
2026-11-12T02:07:48.061954Z  INFO Ubuntu package-CVE map installed: 2026-11-09 (8628608 bytes)
2026-11-12T02:07:48.566613Z  INFO Homebrew CVE map installed as package_cve_map_homebrew.json (Linux uses its node, php and gitlab rows for the runtime checks): 2026-11-11 (1973025 bytes)
2026-11-12T02:07:48.884398Z  INFO web rules installed: 2026-11-11 (33126 bytes)
2026-11-12T02:07:49.077575Z  INFO KEV list installed: 2026-11-10.1903 (29654 bytes)
2026-11-12T02:07:49.372153Z  INFO EPSS scores installed: 2026-11-11 (573614 bytes)
2026-11-12T02:08:19.690540Z  INFO web rules already at 2026-11-11
2026-11-12T02:08:19.690590Z  INFO KEV list already at 2026-11-10.1903
2026-11-12T02:08:19.690611Z  INFO EPSS scores already at 2026-11-11
/var/lib/roamswitch/cve_kernel_map.VERSION: 2026-11-09
/var/lib/roamswitch/epss_scores.VERSION: 2026-11-11
/var/lib/roamswitch/kev_catalog.VERSION: 2026-11-10.1903
/var/lib/roamswitch/package_cve_map_homebrew.VERSION: 2026-11-11
/var/lib/roamswitch/package_cve_map_ubuntu.VERSION: 2026-11-09
/var/lib/roamswitch/web_rules.VERSION: 2026-11-11
[ok] Signed data updates are working. Last success: 2026-11-12 02:08 UTC

The first six log lines are the fetch at install time (02:07). The last three are the run you just started. Nothing had changed, so it received nothing and ended with "already at". Even so, doctor's "Last success" moves to 02:08. (On this VM the journal also held lines from an earlier install; the excerpt shows the latest install only.)

Each *.VERSION file holds one line: the version (a date) of that data set. package_cve_map_homebrew.VERSION is the version of the "Homebrew CVE map" in the log. Despite the name, Linux uses its node, php and gitlab rows to check running programs (as the log says).

The doctor time is UTC. In this example it is 11:08 on 12 November in Japan (UTC+9).

The doctor update line depends on the state (from the source strings; the first three also appeared in this lesson's VM).

LineMeaning
ok "updates are working"The last run succeeded
ok "switched off by the operator"cve_kernel_map_updates_enabled is false
ok "have not run yet"No run has succeeded yet: the install-time fetch is still running or did not happen, and the timer's first run is still to come
warn "The last … run failed"Shows the reason and the last success
warn "update timer … is not running"Shows the command that starts it
warn "the last run was …, over a week ago"The timer is on, but runs have stopped

#Check where it connects, turn it off, turn it back on

Updates are receive-only. The only outbound traffic is an HTTPS GET from roamswitch-updater, and nothing listens on a port. Check that in the settings and the logs.

See the destination and the listeners, then stop updates

This changes the machine (it edits a setting and restarts the daemon). The last step puts it back.

First, the destination. Run the updater once by hand with debug logs. Run by hand, it is outside the systemd restrictions, so use this only to check.

sudo RUST_LOG=debug /usr/bin/roamswitch-updater 2>&1 | sed -n "/writing prelude/,/^\$/p" | head -20
sudo ss -ltnupH | grep -c roamswitch
sudo ss -xlpH | grep roamswitch
Excerpt
2026-11-12T02:08:21.161678Z DEBUG writing prelude: GET /updates/v1/manifest HTTP/1.1
Host: lafine.net
User-Agent: RoamSwitch-Updater
Accept: */*
2026-11-12T02:08:21.490916Z DEBUG Streaming body until content-length: 6968
2026-11-12T02:08:21.490936Z DEBUG response 200 to GET https://lafine.net/updates/v1/manifest
2026-11-12T02:08:21.491061Z DEBUG adding stream to pool: https|lafine.net|443 -> Stream(RustlsStream)
2026-11-12T02:08:21.491088Z DEBUG pulling stream from pool: https|lafine.net|443 -> Stream(RustlsStream)
2026-11-12T02:08:21.491093Z DEBUG sending request (reused connection) GET https://lafine.net/updates/v1/manifest.sig
2026-11-12T02:08:21.491101Z DEBUG writing prelude: GET /updates/v1/manifest.sig HTTP/1.1
Host: lafine.net
User-Agent: RoamSwitch-Updater
Accept: */*
2026-11-12T02:08:21.725417Z DEBUG Body entirely buffered (length: 89)
2026-11-12T02:08:21.725434Z DEBUG adding stream to pool: https|lafine.net|443 -> Stream(RustlsStream)
2026-11-12T02:08:21.725438Z DEBUG response 200 to GET https://lafine.net/updates/v1/manifest.sig
2026-11-12T02:08:21.728260Z  INFO web rules already at 2026-11-11
2026-11-12T02:08:21.728301Z  INFO KEV list already at 2026-11-10.1903
2026-11-12T02:08:21.728306Z  INFO EPSS scores already at 2026-11-11
0
u_str LISTEN 0      4096                       /run/roamswitch/events.sock 78571 * 0 users:(("roamswitch-serv",pid=9608,fd=22))

Read it like this.

  • The only destination is lafine.net. It fetches the signed list (manifest) and its signature (manifest.sig) over one connection. When no data version has changed, it stops there
  • The only headers are Host, User-Agent: RoamSwitch-Updater and Accept. There is no query string
  • There are 0 TCP or UDP listeners. The one socket is a UNIX socket, usable only on this machine

Next, stop updates. The key is cve_kernel_map_updates_enabled, true by default. It takes a restart to apply.

sudo roamswitch server config get cve_kernel_map_updates_enabled
sudo roamswitch server config set cve_kernel_map_updates_enabled false
grep -o '"enabled": [a-z]*' /var/lib/roamswitch/updates.json | head -1
sudo systemctl restart roamswitch-server; sleep 5
grep -o '"enabled": [a-z]*' /var/lib/roamswitch/updates.json | head -1
sudo journalctl -u roamswitch-server --since "-30s" --no-pager -o cat | grep -i "CVE data updates"
sudo RUST_LOG=debug /usr/bin/roamswitch-updater 2>&1 | tail -5
grep '"lastSuccess"' /var/lib/roamswitch/updates.json
sudo roamswitch doctor | grep Signed
Excerpt
true
  ✓ Server configuration updated and saved. (cve_kernel_map_updates_enabled = false)
  To apply: sudo systemctl restart roamswitch-server or sudo roamswitch server restart
"enabled": true
"enabled": false
2026-11-12T02:08:22.769609Z  INFO roamswitch_server_daemon: CVE data updates: disabled by the operator — no network contact; using the embedded baseline (kernel CVE map, web rules, KEV list, EPSS scores, Ubuntu package-CVE map)
2026-11-12T02:08:28.030930Z  INFO updates disabled — nothing to do, no network contact
  "lastSuccess": "2026-11-12T02:08:21.728354699+00:00",
[ok] Signed data updates are switched off by the operator (server.conf: cve_kernel_map_updates_enabled = false). No connection is made for updates; the bundled data is used.

Saving alone leaves updates.json at true. The daemon copies the value from server.conf into updates.json when it starts. After that, the updater ended without any network contact. lastSuccess stayed at 02:08, the run made by hand before updates were turned off. doctor says the updates are switched off in the settings.

Put it back.

sudo roamswitch server config set cve_kernel_map_updates_enabled true
sudo systemctl restart roamswitch-server; sleep 5
grep -o '"enabled": [a-z]*' /var/lib/roamswitch/updates.json | head -1
sudo roamswitch doctor | grep Signed
Excerpt
  ✓ Server configuration updated and saved. (cve_kernel_map_updates_enabled = true)
  To apply: sudo systemctl restart roamswitch-server or sudo roamswitch server restart
"enabled": true
[ok] Signed data updates are working. Last success: 2026-11-12 02:08 UTC
Runs while updates are off are not recorded

"Last success: 02:08" after turning updates back on is the time of the run before they were turned off. A run that ends with "nothing to do" while updates are off changes neither lastRun nor lastSuccess in updates.json. An old doctor time can mean that updates were off for a while.

#Check that the daemon comes back after a crash

On Server Edition, Self-monitoring and automatic restart is shared between systemd and the daemon. systemd starts a daemon that exited abnormally again (Restart=always, RestartSec=3). The unit has Type=notify and WatchdogSec=30: a daemon that does not answer for 30 seconds is treated as hung and restarted. The restarted daemon then sends a notification that the previous run ended abnormally.

Kill the daemon and watch it come back

This changes the machine (it stops the daemon). The last step brings it back with systemctl start.

systemctl cat roamswitch-server | grep -E "^(Restart|RestartSec|Type|NotifyAccess|WatchdogSec)="
systemctl show roamswitch-server -p NRestarts -p MainPID
sudo kill -9 $(systemctl show roamswitch-server -p MainPID --value)
sleep 1; systemctl is-active roamswitch-server
sleep 4; systemctl is-active roamswitch-server
systemctl show roamswitch-server -p NRestarts -p MainPID
sudo journalctl -u roamswitch-server --since "-15s" --no-pager -o short-iso | grep -E "systemd\[1\]"
Excerpt
Type=notify
NotifyAccess=main
WatchdogSec=30
Restart=always
RestartSec=3
MainPID=11071
NRestarts=0
activating
active
MainPID=11401
NRestarts=1
2026-11-12T02:09:42+00:00 ubuntu systemd[1]: roamswitch-server.service: Main process exited, code=killed, status=9/KILL
2026-11-12T02:09:42+00:00 ubuntu systemd[1]: roamswitch-server.service: Failed with result 'signal'.
2026-11-12T02:09:42+00:00 ubuntu systemd[1]: roamswitch-server.service: Consumed 1.478s CPU time, 61.8M memory peak, 0B memory swap peak.
2026-11-12T02:09:45+00:00 ubuntu systemd[1]: roamswitch-server.service: Scheduled restart job, restart counter is at 1.
2026-11-12T02:09:45+00:00 ubuntu systemd[1]: Starting roamswitch-server.service - RoamSwitch Server Edition Daemon (eBPF Runtime Guard & FIM)...
2026-11-12T02:09:45+00:00 ubuntu systemd[1]: Started roamswitch-server.service - RoamSwitch Server Edition Daemon (eBPF Runtime Guard & FIM).

The PID changed and NRestarts went up by 1. It was back about 3 seconds after the crash. With Type=notify, the unit stays activating until the daemon reports that it is ready.

Look at the notification history.

sudo roamswitch notifications | sed -n 5,10p
Output
  2026-11-12T02:09:45.382789114+00:00
  RoamSwitch Server ended abnormally and was restarted
    Host: ubuntu (IP: 192.168.64.26)
    RoamSwitch Server ended abnormally and systemd started it again. It is running now.
    See why it ended with `sudo journalctl -u roamswitch-server --since "2026-11-12 02:09:01"`.
    Timestamp: 2026-11-12 02:09:45

One notification arrived at the moment of the restart. A webhook receiver inside the VM got the same notice. The --since time is when the run before the crash started. The history is shown in the reader's language (English with LANG=en_US.UTF-8). The webhook text uses language in server.conf.

A second kill -9 right after added no notification. The daemon log says "told together with the next notice (at most one an hour)". When the daemon keeps crashing, notifications are grouped to one an hour. A systemctl restart produced no notification.

When you stop it with systemctl stop, it does not come back: systemd treats that as the operator's choice.

sudo systemctl stop roamswitch-server; sleep 6; systemctl is-active roamswitch-server
sudo nft list tables | grep -c roamswitch
sudo systemctl start roamswitch-server; sleep 5; systemctl is-active roamswitch-server
Output
inactive
6
active

While it was stopped, all 6 RoamSwitch nft tables were still there. Stopping the service does not remove its network rules. systemctl stop is the operator's action, so no abnormal-exit notification follows the next start.

A long stop raises a different notice. With the log tamper watch on, a stop of 3 minutes or more was reported at the next start as "The RoamSwitch daemon was stopped", with how long it lasted (about 4 minutes on this VM). Nothing can be reported while it is down.

Treating a stopped service as removed

systemctl stop or disable leaves the nft tables in the kernel, with nothing left to update them. To take RoamSwitch off, use roamswitch uninstall from the next sections.

#What to check after apt upgrades it

You upgrade with apt. The package restarts the daemon only if it is running. A service you stopped stays stopped. If the service is not enabled, it prints one line with the command that turns it on (sudo systemctl enable --now roamswitch-server.service). The exception is the update timer, which it starts when updates are on (from the package script).

Read doctor after apt upgrade

This changes the machine (it replaces the package). The repository holds a single version (apt-cache policy roamswitch-server), so apt cannot take you back to an older one and upgrade again. Instead, reinstall the same version with --reinstall. The package scripts take the same path as an upgrade (the output says "was upgraded"). When a new version comes out, check the same things after sudo apt-get update && sudo apt-get upgrade.

sudo apt-get install --reinstall -y roamswitch-server 2>&1 | grep RoamSwitch
systemctl is-enabled roamswitch-server; systemctl is-active roamswitch-server
sudo roamswitch doctor | grep -E "package|daemon|Signed|failed"
Excerpt
RoamSwitch Server Edition was upgraded. Check: roamswitch doctor
enabled
active
[ok] The files of package roamswitch-server match what was installed
[ok] The RoamSwitch daemon is running
[ok] Signed data updates are working. Last success: 2026-11-12 02:08 UTC
Nothing failed (3 warnings)

Look at three things.

  • Package files: the files it replaced match the package
  • Daemon: it is running again on the replaced program
  • Signed data: replacing the package does not delete the data already received. "Last success" was the same as before the reinstall

Wait about a minute and run it again.

sleep 60; sudo roamswitch doctor | grep -E "package|daemon|Signed|failed"
Excerpt
[ok] The files of package roamswitch-server match what was installed
[ok] The RoamSwitch daemon is running
[ok] Signed data updates are working. Last success: 2026-11-12 02:08 UTC
Nothing failed (3 warnings)

A minute later there were still 3 warnings: fail2ban, the empty egress block list, and web rules (this VM has a webhook set, so there is no alert-channel warning). On another reinstall, run in Japanese, there were only 2 warnings right after, and the fail2ban line appeared a minute later, once the SSH guard had started and written its state. The reinstall added no warning.

When the service was disabled before reinstalling, the package did not start it and printed roamswitch-server.service is not enabled, so it does not protect this host. To turn it on: sudo systemctl enable --now roamswitch-server.service.

Read doctor again after a minute

Right after an upgrade or a restart, some items have not written their state yet. Do not stop at the first run. Wait about a minute, run it again and compare. If the count changes, read the lines that are new.

#Compare before and after uninstalling

Uninstall that restores everything is roamswitch uninstall. Before it removes the program, it puts the network back, and removes the decoy files and the configuration files its setup added. It removes a decoy only when the file carries RoamSwitch's mark.

Use --purge or not
  • Without it: /etc/roamswitch (settings) and /var/lib/roamswitch (state, history, received data) stay. Use this when you plan to reinstall
  • With it: those two go as well. Use this when you hand the machine over, or want to start from scratch

Either way, the network rules, the services and the decoys are removed. The apt repository entry and its signing key stay in both cases.

Compare before and after with the same script

This changes the machine (it removes RoamSwitch). Try it in a disposable VM. To undo it, reinstall with apt install.

Prepare a script that prints the state for comparison. To see that a real file survives, put a dummy /root/.aws/credentials next to where decoys go, using AWS's public sample key.

sudo mkdir -p /root/.aws
printf '[default]\naws_access_key_id = AKIAIOSFODNN7EXAMPLE\naws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n' | sudo tee /root/.aws/credentials >/dev/null
cat > /tmp/snap.sh <<'EOF'
echo "## nft"; sudo nft list tables | grep roamswitch
echo "## units"; systemctl list-unit-files 'roamswitch*' --no-legend | awk '{print $1, $2}'
echo "## etc"; sudo ls -A /etc/roamswitch 2>&1
echo "## varlib"; sudo ls -A /var/lib/roamswitch 2>&1 | tr '\n' ' '; echo
echo "## decoys"; sudo find / -xdev -name '.roamswitch_security_canary_do_not_delete.*' 2>/dev/null | sort
echo "## awsdummy"; sudo ls -l /root/.aws/credentials 2>&1
echo "## pkg"; dpkg-query -W -f '${db:Status-Abbrev} ${Package}\n' roamswitch-server 2>&1
EOF
sh /tmp/snap.sh
Before (excerpt)
## nft
table inet roamswitch_server
table inet roamswitch_metadata_watch
table inet roamswitch_egress_block
table inet roamswitch_portscan
table inet roamswitch_dev_guard
table inet roamswitch_dnstunnel
## units
roamswitch-server.service enabled
roamswitch-update.service static
roamswitch-webgate.service disabled
roamswitch-update.timer enabled
## etc
guard.yaml.example
hooks
.roamswitch_security_canary_do_not_delete.pdf
.roamswitch_security_canary_do_not_delete.xlsx
.roamswitch_security_canary_do_not_delete.zip
server.conf
server.conf.example
## varlib
allowlist_clock canary cve_kernel_map.json cve_kernel_map.VERSION ebpf_heartbeat.json epss_scores.json epss_scores.VERSION exec_log fim.db honeytokens_watch.pid incident_timeline.json incident_timeline.json.lock kev_catalog.json kev_catalog.VERSION last_cve_refresh log_tamper_baseline.json notification_history.json package_cve_map_homebrew.json package_cve_map_homebrew.VERSION package_cve_map_ubuntu.json package_cve_map_ubuntu.VERSION port_guard.json quarantine server_abnormal_exit.json server.conf.last-good server_running.json suid_baseline.json updates.json updates.json.lock web_rules.json web_rules.VERSION 
## decoys
/etc/roamswitch/.roamswitch_security_canary_do_not_delete.pdf
/opt/.roamswitch_security_canary_do_not_delete.pdf
/root/.roamswitch_security_canary_do_not_delete.pdf
/srv/.roamswitch_security_canary_do_not_delete.pdf
## awsdummy
-rw------- 1 root root 116 Nov 12 02:06 /root/.aws/credentials
## pkg
ii  roamswitch-server

There were 12 decoys: 3 in each of 4 folders (the excerpt lists only the .pdf ones).

Remove it without --purge.

sudo roamswitch uninstall --yes
sh /tmp/snap.sh
Excerpt (apt output omitted)
  This removes:
    - RoamSwitch's services and timers (stopped and disabled)
    - Every change that can stop traffic (firewall, DNS, isolation)
    - The decoy files it placed (only those carrying RoamSwitch's mark; real files are left alone)
    - Configuration files its setup added (apt hook, Falco, logrotate)
    - The program itself (through the package manager)
    (Settings, state and history are kept. Use --purge to delete them)

  Current state:
    No isolation record (any leftover rules are removed here)
    ✓ Stopping and disabling RoamSwitch's services
    ✓ Isolation records
    ✓ Firewall tables that can stop traffic
    ✓ DNS settings
    ✓ Connection tracking
    ✓ All remaining RoamSwitch firewall tables
    ✓ Decoy files it placed (ransomware and credential)
    ✓ Configuration files it added to the system
  Removing the program...
    ✓ The program (apt)
  ✓ RoamSwitch was removed.
  The apt repository entry (/etc/apt/sources.list.d/roamswitch.list) and its signing key are left in place.
## nft
## units
## etc
hooks
server.conf
## varlib
allowlist_clock canary cve_kernel_map.json cve_kernel_map.VERSION ebpf_heartbeat.json ebpf_status.json epss_scores.json epss_scores.VERSION exec_log fim.db honeytokens_watch.pid incident_timeline.json incident_timeline.json.lock kev_catalog.json kev_catalog.VERSION last_cve_refresh log_tamper_baseline.json notification_history.json package_cve_map_homebrew.json package_cve_map_homebrew.VERSION package_cve_map_ubuntu.json package_cve_map_ubuntu.VERSION package-removed port_guard.json quarantine server_abnormal_exit.json server.conf.last-good suid_baseline.json updates.json updates.json.lock web_rules.json web_rules.VERSION 
## decoys
## awsdummy
-rw------- 1 root root 116 Nov 12 02:06 /root/.aws/credentials
## pkg
rc  roamswitch-server

Here is what changed.

WhereBeforeAfter uninstall
nft tables6 roamswitch_* tablesnone
systemd units4none
Decoys12none
/etc/roamswitchsettings and decoysserver.conf and hooks remain
/var/lib/roamswitchstate and datakept (server_running.json goes, package-removed and ebpf_status.json appear)
Dummy /root/.aws/credentialspresentkept (it has no mark)
Packageiirc (only its config files remain)

The new package-removed in /var/lib/roamswitch is a marker left when the package is removed. On the next install, the package reads it and deletes it. server_running.json, present before, marks a running daemon and was removed because the daemon stopped cleanly. server_abnormal_exit.json records the abnormal-exit notifications.

Reinstall it.

sudo apt-get install -y roamswitch-server
systemctl is-enabled roamswitch-server; systemctl is-active roamswitch-server
sleep 3; systemctl is-active roamswitch-server
Excerpt
Created symlink /etc/systemd/system/multi-user.target.wants/roamswitch-server.service → /usr/lib/systemd/system/roamswitch-server.service.
Created symlink /etc/systemd/system/timers.target.wants/roamswitch-update.timer → /usr/lib/systemd/system/roamswitch-update.timer.
RoamSwitch Server Edition was installed again with the settings kept by the earlier removal; the service is enabled and running. Check: roamswitch doctor
enabled
active
active

With the kept settings, the service is enabled and running again. The last apt line says so too. apt finished in about 6 seconds, and the service was active as soon as it did. The update timer was enabled and active too (it follows cve_kernel_map_updates_enabled in server.conf). The SHA-256 of server.conf was the same before removal and after reinstalling.

Finally, remove it with --purge. This time, run it while another process holds the dpkg lock. For practice, python3 holds it for 25 seconds.

sudo python3 -c 'import fcntl,time; f=open("/var/lib/dpkg/lock-frontend","w"); fcntl.lockf(f, fcntl.LOCK_EX); time.sleep(25)' &
sleep 2
sudo roamswitch uninstall --purge --yes
sh /tmp/snap.sh
Excerpt
    - Settings, state and history (/var/lib/roamswitch, /etc/roamswitch, each user's settings)
    ✓ Settings, state and history
  Removing the program...
    Another package manager run (python3) is in progress. The removal waits for it to finish (up to 5 minutes).
    ✓ The program (apt)
  ✓ RoamSwitch was removed.
  The apt repository entry (/etc/apt/sources.list.d/roamswitch.list) and its signing key are left in place.
## nft
## units
## etc
ls: cannot access '/etc/roamswitch': No such file or directory
## varlib
ls: cannot access '/var/lib/roamswitch': No such file or directory 
## decoys
## awsdummy
-rw------- 1 root root 116 Nov 12 02:06 /root/.aws/credentials
## pkg
dpkg-query: no packages found matching roamswitch-server

While another process was running, it said in one line what it was waiting for, and removed the package once that had finished (it waits up to 5 minutes). With --purge, /etc/roamswitch and /var/lib/roamswitch are gone too, and no package record is left. The dummy key file survived both. After removal, the same VM still fetched https://lafine.net/updates/v1/manifest over HTTPS (status 200).

Check doctor after a reinstall

Right after the reinstall, doctor in this VM printed "[ok] The RoamSwitch daemon is running". A reinstall enables and starts the service (apt's last line says "the service is enabled and running"). On a server you want to keep stopped, run sudo systemctl disable --now roamswitch-server after reinstalling.

#What it cannot see

What was checked, and what was not

In the range checked on a disposable Ubuntu 24.04 (arm64) VM:

  • An ok update line in doctor can mean three things: "have not run yet", "working", or "switched off". Do not stop at the ok mark; read the text and the time
  • "Last success" is not always when data arrived. When no version has changed, a run succeeds without receiving anything (the log says "already at"). Judge freshness from the dates in *.VERSION
  • The destination was read from debug logs. The updater run by hand is outside the systemd restrictions. Run from the timer, it runs inside the unit's restrictions, such as RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
  • Uninstall deletes only nft tables whose name starts with roamswitch (checked in the source). Tables made by other tools are left alone
  • After --purge, /var/log/roamswitch was gone too. The apt repository entry and the signing key stay
Check yourself

After roamswitch uninstall --yes (no --purge), what is still there

Show the explanation

Without --purge, settings, state and history are kept. The network rules and the decoys are removed either way. A reinstall uses the kept settings, and the service is enabled and starts again.

Check yourself

After sudo systemctl stop roamswitch-server, which is true

Show the explanation

Restart=always restarts it after an abnormal exit. When the operator stops it, it stays stopped, and no abnormal-exit notification is sent. The rules stay in the kernel, so use roamswitch uninstall to take it off.

#What to learn next

  • Alert destinations, and how to check that alerts arrive, are covered in "Notifications and event forwarding" (coming soon)
  • Network isolation and how to release it are covered in "Setting your automatic isolation policy" (coming soon)
  • Every setting is listed in the Linux Server operations manual
Features covered

Related techniques (ATT&CK): T1685

What was verified

Verified on 2026-11-12. Target: Linux 1.17.39. On a disposable Ubuntu 24.04 (arm64) VM, purged and reinstalled the published 1.17.39 from apt, then read *.VERSION, doctor and the debug-log destination, toggled cve_kernel_map_updates_enabled, killed the daemon with kill -9 to watch the restart and the abnormal-exit notice (history and a webhook inside the VM), stopped it for over 3 minutes, replaced the package with --reinstall, and compared the host before and after uninstall and --purge (with the dpkg lock held) with a reinstall in between, in Japanese and English.

Command output varies with the product version and the environment. If yours differs, check the version first.