Deploy OWASP Amass on Debian VPS

This article provides a guide demonstrating how to deploy OWASP Amass on Debian VPS.

What is OWASP Amass?

OWASP Amass is an open-source, command-line framework used by security professionals to: map attack surfaces, discover external assets, and perform in-depth DNS enumeration. You can explore the source code on the OWASP Amass GitHub Repository or read the official documentation on the OWASP Amass Project Page.

Core Features

How to Deploy OWASP Amass on Debian VPS

This guide walks through a secure, automated, and scalable deployment of OWASP Amass on a Debian VPS, optimized for continuous reconnaissance and integration into your infrastructure.

See Also: Top 5 Best Free VPS Control Panel Alternatives Ranked for 2026

1. System Preparation

   Login via SSH as root and run the following commands to update and install base dependencies:

   apt update && apt upgrade -y
   apt install -y git curl wget unzip jq build-essential
   

   Install Go (required for Amass builds and updates):

   cd /usr/local
   wget https://go.dev/dl/go1.22.3.linux-amd64.tar.gz
   tar -C /usr/local -xzf go1.22.3.linux-amd64.tar.gz
   echo 'export PATH=$PATH:/usr/local/go/bin' >> /etc/profile
   source /etc/profile
   

   Verify:

   go version
   

2. Install OWASP Amass (Production Method)

   Install via Go (recommended for latest version):

   go install github.com/owasp-amass/amass/v4/...@master
   

   Move binary into system path:

   cp ~/go/bin/amass /usr/local/bin/
   chmod +x /usr/local/bin/amass
   

   Verify:

   amass version
   

3. Create Dedicated Service User

   Run Amass under a restricted user:

   useradd -r -m -d /opt/amass -s /bin/bash amass
   mkdir -p /opt/amass/{data,config,logs}
   chown -R amass:amass /opt/amass
   

4. Configure Amass (API + Performance Tuning)

   Switch to service user:

   su - amass
   

   Create config file:

   nano /opt/amass/config/amass.ini
   

   Example production config:

   [general]
   resolvers = 1.1.1.1,8.8.8.8,9.9.9.9
   max_dns_queries = 200
   
   [domains]
   domain = example.com
   
   [bruteforce]
   enabled = true
   
   [alterations]
   enabled = true
   
   [data_sources]
   minimum_ttl = 1440
   
   # API Keys (optional but recommended)
   [apikeys]
   virustotal = YOUR_API_KEY
   securitytrails = YOUR_API_KEY
   shodan = YOUR_API_KEY
   censys = YOUR_API_KEY
   

   Secure it:

   chmod 600 /opt/amass/config/amass.ini
   

5. Directory Structure for Production

   /opt/amass/
   ├── config/
   ├── data/
   ├── logs/
   ├── scripts/
   

6. Create Execution Script

   nano /opt/amass/scripts/run-amass.sh
   

   #!/bin/bash
   
   DOMAIN=$1
   DATE=$(date +%F)
   
   OUTPUT_DIR="/opt/amass/data/$DOMAIN"
   LOG_FILE="/opt/amass/logs/$DOMAIN-$DATE.log"
   
   mkdir -p "$OUTPUT_DIR"
   
   amass enum \
     -config /opt/amass/config/amass.ini \
     -d "$DOMAIN" \
     -o "$OUTPUT_DIR/amass-$DATE.txt" \
     -json "$OUTPUT_DIR/amass-$DATE.json" \
     -log "$LOG_FILE"
   

   Make executable:

   chmod +x /opt/amass/scripts/run-amass.sh
   

7. Systemd Service (Production Automation)

   Create service:

   nano /etc/systemd/system/amass.service
   

   [Unit]
   Description=OWASP Amass Enumeration Service
   After=network.target
   
   [Service]
   Type=simple
   User=amass
   WorkingDirectory=/opt/amass
   ExecStart=/opt/amass/scripts/run-amass.sh example.com
   Restart=on-failure
   Nice=10
   LimitNOFILE=65535
   
   [Install]
   WantedBy=multi-user.target
   

8. Systemd Timer (Scheduled Recon)

   nano /etc/systemd/system/amass.timer
   

   [Unit]
   Description=Run Amass Daily
   
   [Timer]
   OnCalendar=daily
   Persistent=true
   
   [Install]
   WantedBy=timers.target
   

   Enable:

   See Also: Free Website Migration – Hassle-Free & Zero Downtime!

   systemctl daemon-reexec
   systemctl daemon-reload
   systemctl enable --now amass.timer
   

9. Logging & Monitoring

   View logs:

   journalctl -u amass -f
   

   Optional log rotation:

   nano /etc/logrotate.d/amass
   

   /opt/amass/logs/*.log {
       daily
       rotate 14
       compress
       missingok
       notifempty
       create 0640 amass amass
   }
   

10. Firewall + Outbound DNS Optimization

    Allow outbound DNS + HTTP/HTTPS:

    ufw allow out 53
    ufw allow out 80
    ufw allow out 443
    

    (Optional) Install high-performance resolvers:

    apt install -y unbound
    

11. Performance Optimization

    • Increase file descriptors:

    echo "amass soft nofile 65535" >> /etc/security/limits.conf
    echo "amass hard nofile 65535" >> /etc/security/limits.conf
    

    • Kernel tuning:

    sysctl -w net.core.somaxconn=65535
    

12. Optional: Distributed / Scalable Setup

    For larger recon workloads:

    • Use multiple VPS nodes
    • Centralize results via:
    • NFS
    • Object storage (S3-compatible)
    • Queue jobs with:
    • Redis + workers
    • Kubernetes CronJobs

13. Security Hardening

    • Run under non-root user (already done)
    • Restrict API keys to IP
    • Monitor outbound traffic
    • Use fail2ban if exposed externally
    • Consider isolating with:
    • Docker
    • Firejail
    • VM sandbox

14. Test Execution

    sudo -u amass /opt/amass/scripts/run-amass.sh example.com
    

    Check output:

    ls /opt/amass/data/example.com/
    

15. Upgrade Strategy

    go install github.com/owasp-amass/amass/v4/...@latest
    cp ~/go/bin/amass /usr/local/bin/amass
    

    Restart service:

    systemctl restart amass
    

16. Integration Ideas (Advanced)

    • Feed results into:
      • SIEM (Wazuh, ELK)
      • Bug bounty pipelines
    • Automate alerts for new subdomains
    • Combine with:
      • Subfinder
      • Assetfinder
      • HTTP probing (httprobe / httpx)

Final Result

You now have:

• Hardened Amass deployment
• Automated daily enumeration
• Structured output + logging
• Scalable architecture foundation

Conclusion

You now know how to deploy OWASP Amass on Debian VPS.