Installation & upgrades

Steward IT Census is a single program, census-server, that contains the web interface, the scanner, the database and the agent endpoint. There's nothing else to install: no IIS, no SQL Server, no Java.

Requirements#

	Minimum	Recommended (500+ assets)
OS	Windows Server 2016+ / Windows 10+, or any 64-bit Linux with systemd	Windows Server 2022 or Ubuntu/Debian LTS
CPU / RAM	2 cores, 2 GB	4 cores, 4–8 GB
Disk	2 GB free	10 GB+ (inventory history, packages, screenshots)
Database	Built-in (SQLite), no setup	Built-in, or PostgreSQL for very large estates
Browser	Any current Edge, Chrome, Firefox or Safari

Sizing#

Measured with a synthetic load test (computers with about 170 programs each on Windows and 1,700 packages on Linux, on a 4-core server with 8 GB RAM):

Assets	Database size (built-in)	Database size (PostgreSQL)	Disk to plan for	Memory
1,000	about 0.2–0.3 GB	about 0.5 GB	5 GB	2 GB
10,000	about 2–3 GB	about 4.5 GB	15 GB	4 GB
20,000	about 4–6 GB	about 9 GB	30 GB	8 GB

Plan disk space for the database twice over: database upgrades, backups and the built-in database's write-ahead log temporarily need about as much again. Computers with many vulnerability findings (unpatched Linux servers) add to the size.

What to expect at 10,000 assets:

Console: asset lists, searches, the Software page and dashboards answer in well under half a second. Slow summaries (vulnerabilities, report counts) are kept up to date in the background. Reports that read every computer's detailed inventory (low disk space, local administrators, software per asset) take a few seconds.
Census agents: 10,000 agents connected at once answer tasks within seconds. Their regular reports (every 4 hours, spread out) take well under a second each.
Rolling out the agent everywhere at once: a computer's first inventory is the expensive one (all its software is new). The built-in database saves about 20 per second, PostgreSQL about 55. Agents that have to wait simply send again a minute later, so 1,000 computers that all install the agent in the same minute are in the console within one to two minutes.

Built-in database or PostgreSQL? The built-in database is fine up to about 10,000 assets. Above that, or when many first inventories arrive at once (large rollouts, frequent reimaging), PostgreSQL saves new computers about 2.5 times faster.

Network ports#

Port	Direction	Used for
8443/TCP (configurable)	Inbound to the server	Web interface and Census agents (HTTPS)
5985 / 5986 TCP	Server → Windows computers	WinRM inventory, deployment, actions
22 TCP	Server → Linux/macOS	SSH inventory, deployment, actions
161 UDP	Server → network devices	SNMP
389 / 636 TCP	Server → domain controller	Active Directory sync
25 / 465 / 587 TCP	Server → mail server	Email alerts
Various TCP	Server → scanned ranges	Discovery probes 47 common ports (see Network scanning)

Firewall: install opens the server's port in the local firewall so other computers can connect: an inbound Windows Firewall rule (Steward IT Census - web interface and agents) on Windows, or a ufw / firewalld rule on Linux when one of them is active. uninstall removes the rules Census added (never ones you made yourself). With another firewall on Linux, install tells you to open the port by hand. Upgrading an older installation with install adds the rule too.

Census agents and remote scanners only make outbound connections to the server (port 8443, or the optional port for remote sites, default 9443). Computers with the agent and remote sites need no inbound firewall rules.

Install on Windows#

With the installer (recommended): run steward-it-census-<version>-x64.msi on the server. The setup wizard walks you through:

License agreement: read it and tick I accept to continue.
Install folder: C:\Program Files\Steward IT Census\ unless you choose another (Change…).
Server settings: the web console's port (8443 unless you choose another) and the data folder for the database, encryption key, certificate and backups (C:\ProgramData\StewardCensus unless you choose another, for example a larger drive). A folder that already holds Census data is used as it is.
Install, then confirm the administrator prompt.

Setup installs the Steward IT Census Server service (started automatically), opens the port in Windows Firewall, adds the Census agent, Remote Scanner and Action Launcher downloads and puts a Steward IT Census link in the Start menu. Leave Open the Census console now ticked on the last page: the first visit shows a certificate warning because the server creates its own certificate (see Using your own certificate). Continue to the site and create your administrator account.

Running the installer of a newer version updates the server: it skips the folder and settings pages and keeps the install folder, port, data folder and database. Running the same installer again offers Repair or Remove.

The console starts in the language of Windows (English, German, French, Spanish, Dutch, Italian or Portuguese; others start in English). Silent install (no wizard; installing silently means you accept the license agreement):

msiexec /i steward-it-census-<version>-x64.msi /qn
msiexec /i steward-it-census-<version>-x64.msi /qn LANGUAGE=de PORT=443 DATADIR="D:\Census" INSTALLDIR="D:\Programs\Census"

Property	Meaning	Default
`LANGUAGE`	Console language: `en`, `de`, `fr`, `es`, `nl`, `it`, `pt`	Windows' language
`PORT`	Web console port (HTTPS)	8443
`DATADIR`	Data folder	`C:\ProgramData\StewardCensus`
`INSTALLDIR`	Program folder	`C:\Program Files\Steward IT Census\`

On an update, leave PORT and DATADIR out: the server keeps what it uses.

The installer is not code-signed yet during the beta: Windows SmartScreen may say it "protected your PC". Choose More info › Run anyway. If the install fails, msi-install.log in the data folder (C:\ProgramData\StewardCensus by default) says why; send it with your report. Setup stops (and changes nothing) when another program already uses the chosen port, for example IIS or SQL Server Reporting Services on 443 or 4443: install again with another port.

Without the installer: copy census-server-windows-amd64.exe to the server, open PowerShell as Administrator in that folder and run .\census-server-windows-amd64.exe install. This copies the program to C:\Program Files\Steward IT Census\, installs and starts the service and adds an entry under Control Panel › Programs and Features; then open https://<server-name>:8443.

Data is stored in C:\ProgramData\StewardCensus (database, settings, keys, certificate, uploaded packages).

Install on Linux#

On Debian, Ubuntu, RHEL, Rocky, AlmaLinux and Fedora the package is the easiest way: your package manager installs, upgrades and removes Census like any other program. On other distributions use the program file. To run Census in a container, see Docker.

Debian/Ubuntu package#

sudo apt install ./steward-it-census_<version>-1_amd64.deb

(_arm64.deb on ARM servers.) The package puts the program in /usr/bin/census-server and the agent, Remote Scanner and Action Launcher downloads in /usr/share/steward-it-census/agents, then creates the StewardCensusServer systemd service, starts it and opens port 8443 in ufw or firewalld when one of them is active. Data is stored in /var/lib/steward-census. Then browse to https://<server>:8443.

Upgrade: install the new .deb the same way. The service restarts with the new version; your data, settings and install options are kept.
Remove: sudo apt remove steward-it-census stops and removes the service and the firewall rules Census added, and keeps your data. sudo apt purge steward-it-census also deletes /var/lib/steward-census.
Logs: journalctl -u StewardCensusServer (add -f to follow).

RHEL/Fedora package#

sudo dnf install ./steward-it-census-<version>-1.x86_64.rpm

(.aarch64.rpm on ARM servers; on older systems yum works the same way.) The package installs the same files and service as the Debian package and opens port 8443 in firewalld when it's active.

Upgrade: sudo dnf install ./steward-it-census-<new version>-1.x86_64.rpm. The service restarts with the new version; data, settings and install options are kept.
Remove: sudo dnf remove steward-it-census removes the service and the firewall rules Census added. Your data stays in /var/lib/steward-census; delete that folder yourself if you no longer need it.
Logs: journalctl -u StewardCensusServer.

Changing install options (port, data folder, PostgreSQL) with a package: run sudo census-server install -pkg with the options, for example sudo census-server install -pkg -listen :443. Package upgrades keep them. A server installed earlier from the program file keeps its options too when you switch to the package; the old program in /usr/local/bin can then be deleted.

With the program file#

sudo ./census-server-linux-amd64 install

This copies the program to /usr/local/bin/census-server, creates the StewardCensusServer systemd service and starts it. Data is stored in /var/lib/steward-census. Then browse to https://<server>:8443.

Use census-server-linux-arm64 on ARM servers (e.g. Raspberry Pi 4/5, Ampere). The steward-it-census-<version>-linux-<arch>.tar.gz download contains the program and an agents folder; run sudo ./census-server install inside the unpacked folder and the agent downloads are set up too (typed without sudo, it asks for your password itself).

Docker#

The container image runs the server as root (license keys are bound to the Server ID, which only root can read in a container, and passive discovery needs it) and keeps everything in the volume /var/lib/steward-census. Load the image from the release download (or your registry):

docker load -i steward-it-census-<version>-docker-amd64.tar.gz
docker run -d --name census --restart unless-stopped \
  --network host --cap-add NET_RAW \
  -e TZ=America/Chicago \
  -v census-data:/var/lib/steward-census \
  steward-it-census:<version>-amd64

Then browse to https://<docker host>:8443. With Docker Compose:

services:
  census:
    image: steward-it-census:<version>-amd64
    restart: unless-stopped
    network_mode: host
    cap_add: [NET_RAW]
    environment:
      TZ: America/Chicago
    volumes:
      - census-data:/var/lib/steward-census
volumes:
  census-data:

Network: use the host network (--network host, Linux only). Scans then see the MAC addresses of the devices on your network, and agents and remote scanners reach the server on the host's own address. On Docker's default bridge network, publish the ports instead (-p 8443:8443, and -p 9443:9443 when you turn on the port for remote sites); scans still work but can't read MAC addresses, so devices without an agent or a login are told apart by IP address only.
Ping and passive discovery need --cap-add NET_RAW (in the examples above).
Time zone: set TZ so schedules, reports and emails use your local time.
Your own data folder instead of a named volume: -v /srv/census:/var/lib/steward-census. Keep it readable by root only (sudo chmod 700 /srv/census): it holds the encryption key for stored credentials.
PostgreSQL: add -e CENSUS_DB=postgres://user:pass@host/db.
Updating: load or pull the new image, then docker rm -f census and run the same docker run command with the new tag (Compose: change the tag, docker compose up -d). The data in the volume is kept and upgraded, and the new agent builds are offered to your agents.
Backups: the nightly backups are written to backups inside the volume. Copy them off the Docker host, or choose a backup folder on a mounted share (see Backups).
Logs: docker logs -f census. Command-line tools run inside the container, for example docker exec -it census census-server reset-password -user admin.

Install options#

Pass options to install; they're remembered by the service.

Option	Default	Meaning
`-listen :8443`	`:8443`	Address and port for the web interface and agents
`-data <folder>`	see above	Data directory
`-db postgres://user:pass@host/db`	built-in	Use PostgreSQL instead of the built-in database (also via the `CENSUS_DB` environment variable)
`-scan-concurrency 64`	64	Hosts scanned in parallel
`-language de`	English	Default language of the web console: `en`, `de`, `fr`, `es`, `nl`, `it` or `pt`. Each login can choose its own under My account; administrators change the default under Configuration › General settings
`-device-listen :9443`	off	Extra address that serves only Census agents and remote scanners. Normally turned on in the web interface (Scanning › Remote scanners › Port for remote sites); this option overrides that

Example: census-server install -listen :443 -data D:\Census

Offering agent and launcher downloads#

The Windows installer does this for you (and again at each upgrade). Otherwise copy the census-agent-*, census-scanner-* and census-launcher-* files from the release download into the agents folder inside the data directory (e.g. C:\ProgramData\StewardCensus\agents). They then appear in the download lists on the Census agents page (agent, Action Launcher and Remote Scanner, each with a platform list), together with ready-made USB installers.

Using your own certificate#

The easiest way to a trusted certificate is Let's Encrypt, built in: see HTTPS certificate (free, renewed automatically, no open ports, no AD needed).

The server creates a self-signed certificate on first start (tls.crt / tls.key in the data directory). To use a certificate from your company CA or a public CA instead:

Stop the service.
Replace tls.crt (PEM, including the intermediate chain) and tls.key (PEM private key).
Start the service.

Agents pin the server's certificate fingerprint. After changing the certificate, reinstall agents with the new fingerprint (shown on the Census agents page), or install them without -fingerprint if the new certificate is trusted by the computers.

Upgrading#

Administrators see a notice when a newer release is out (General settings › Updates).

Update from the console#

When a newer release is out, General settings › Updates › Update now installs it for you. Census:

takes a backup (the same as Backups › Back up now) and stops if that fails,
downloads the release from steward-it.com and checks it against the release information signed by Steward IT. A file that doesn't match is never installed,
installs it: on Windows it runs the release's installer silently; on Linux it puts the new program in place (the old one stays beside it as census-server.previous) and restarts the service.

The console is unavailable for a minute or two while the server restarts, then the page reloads on the new version. The same works from the command line: census-server update (as root or from an administrator prompt; -check only looks, -y skips the question).

Update now isn't offered when the server was installed from the Debian or RPM package (update it with apt or dnf), runs in a container (pull the new image), or runs by hand rather than as its service. The reason is shown under the notice. Installer logs: <data>\updates\msi-update.log on Windows.

To go back on Linux: stop the service, copy census-server.previous over census-server, and restore the backup taken before the update (the database may already have been upgraded).

Update by hand#

Windows installer: run the new .msi. It replaces the old version (one entry stays in Programs and Features).
Linux packages: install the new .deb or .rpm (see Debian/Ubuntu package).
Docker: run the new image with the same volume (see Docker).
Otherwise: download the new census-server program and run install again from an administrator prompt, the same way as the first time.

The service is stopped, the program is replaced, and the service starts again. Your data and settings are kept and the database is upgraded automatically. Upgrade agents the same way (run install again), or push the new agent with Deployment.

Monitoring#

Watch the server with the monitoring tool you already use:

Health check: https://<server>:8443/api/health answers without signing in: {"status": "ok", "version": "…", "db": "ok", "uptime_seconds": …} with HTTP 200, or "status": "degraded" with HTTP 503 when the database doesn't answer. It says nothing else about your server. Point an uptime monitor (Uptime Kuma, PRTG, Zabbix, Nagios…) at it. Signed in as an administrator (or with an administrator's API token), the same address adds details: database type and response time, scans running and waiting, Census agents and remote scanners online, the last backup, vulnerability feed status, whether email is set up, the port for remote sites, and the license state.
Prometheus metrics: turn on Publish Prometheus metrics under Configuration › General settings › Monitoring. Census then serves https://<server>:8443/metrics in the Prometheus text format: assets by state, agents and remote scanners (total and online), scans running and waiting, assets with open vulnerability findings, the average compliance score, open tickets, the last backup, requests answered by status class, and the server process's memory and goroutines. Totals only: no asset names or addresses. Prometheus signs in with a token of its own, shown once when you turn the metrics on (New token makes another; the old one stops working at once). The panel shows a ready scrape_configs entry. While Census uses its self-signed certificate, tell Prometheus to trust it (tls_config with ca_file, or insecure_skip_verify on a network you trust), or set up Let's Encrypt. Neither address is served on the port for remote sites.

Census works out these numbers at most every 30 seconds, so frequent checks cost the server almost nothing.

Backups#

Census backs itself up every night by default (database, encryption key, certificate; optionally your packages). See Backups for the settings, restoring, and moving the server to another computer. With PostgreSQL, also back up the database with your usual tools.

Uninstalling#

Windows: Settings › Apps (or Control Panel › Programs and Features) › Steward IT Census Server › Uninstall. Installed with the MSI, the setup wizard opens on its Remove page: tick Also delete all Census data to delete the database, license keys, settings and backups too (unticked, the data folder is kept so a later install continues where you left off; a PostgreSQL database is never deleted). Silent: msiexec /x <product code> /qn, add PURGEDATA=1 to delete the data. Installed with install, you're asked whether to keep your data (recommended, so a reinstall continues where you left off) or delete it. From an administrator command prompt instead: "C:\Program Files\Steward IT Census\census-server.exe" uninstall (add -purge to also delete the data).
Linux package: sudo apt remove steward-it-census (apt purge also deletes the data) or sudo dnf remove steward-it-census (the data is kept).
Linux, installed with the program file: run
```
sudo census-server uninstall            # keeps the data in /var/lib/steward-census
sudo census-server uninstall -purge     # also deletes the data
```
This stops and removes the systemd service (StewardCensusServer), deletes the program from /usr/local/bin, and removes the ufw / firewalld rules Census added. If you installed with another data folder (-data), give the same -data here so -purge deletes the right folder and the firewall rules are found. The Census agent on the same computer is separate: remove it with sudo census-agent uninstall.
sudo: census-server: command not found means it was never installed with install (nothing in /usr/local/bin). Check with systemctl status StewardCensusServer: if the service exists, run uninstall with the program file you installed from (sudo ./census-server-linux-amd64 uninstall); if it doesn't, see the next point.
A server you only ran by hand (census-server run … without install): stop it (Ctrl+C) and delete the program and its data folder (/var/lib/steward-census when you ran it as root without -data); nothing else was installed.

Keeping the data lets a later install continue where you left off (same database, certificate and agent key, so agents keep working). Delete it only when you're sure: it holds the inventory, settings, license keys and the key that decrypts stored credentials.

Command reference#

census-server install   [options]     install or upgrade the service
census-server uninstall [-purge]      remove the service and program
census-server start | stop | restart | status
census-server grant-hwid [-user NAME]  Linux: let a server you run by hand (not as root) show its Server ID
census-server run       [options]     run in the foreground (testing)
census-server reset-password -user admin   set a new password (or recreate the admin)
census-server reset-mfa -user NAME     turn off two-step sign-in for a login that lost its phone
census-server backup  [-out FILE]      back up now (see Backups)
census-server restore FILE             restore a backup (the service must be stopped)
census-server recover-key -key CODE    unlock stored credentials with the recovery key (see Key protection)
census-server version