Link Search Menu Expand Document

Installing packages

SCION Services

Prebuilt SCION packages are available for Ubuntu (or other Debian based systems) for x86, x86-64, arm32 and arm64 platforms.

You can install SCION from our .deb-packages by running:

sudo apt-get install apt-transport-https ca-certificates
echo "deb [trusted=yes] all main" | sudo tee /etc/apt/sources.list.d/scionlab.list
sudo apt-get update
sudo apt-get install scionlab

This will install all the SCION services (which come as individual packages), systemd unit files to run the services as well as a helper script to install the SCION configuration generated by the SCIONLab coordination website.


After creating or modifying your AS in the SCIONLab coordination website, you can deploy the generated configuration to your machine. For this, the recommended approach is to simply run the scionlab-config script that is included in the scionlab package.


This script allows to conveniently fetch and install the configuration for your AS from the SCIONLab website.

sudo scionlab-config --host-id=<...> --host-secret=<...>

The required host-id and host-secret will be displayed on the SCIONLab website. The script will (re-)start all the configured services (and OpenVPN client-scionlab-<attachment point ISD-AS>, if configured). The host-id and host-secret information will be stored in /etc/scion/gen/scionlab-config.json and will not have to be entered again. To update the configuration after modifying your AS, simply run

sudo scionlab-config

Run scionlab-config --force to get the configuration even if the SCIONLab coordination website thinks you’re running the latest version, e.g. in case you’ve locally modified your configuration and want it to be reset.

Unpack configuration manually

As an alternative to running scionlab-config, you can manually download the configuration tarfile from the SCIONLab website and unpack it.

  1. Download the configuration tarfile from the SCIONLab coordination website.

  2. If using VPN, extract the client-scionlab-<attachment point ISD-AS>.conf to /etc/openvpn/ and (re-)start OpenVPN

     sudo systemctl restart openvpn@client-scionlab-<attachment point ISD-AS>
  3. Extract the gen/ subdirectory to /etc/scion/
  4. Enable the systemd units listed in scionlab-services.txt and restart SCION:

     # Stop SCION and disable services referring to old configuration
     sudo systemctl stop
     sudo rm /etc/systemd/system/*
     sudo systemctl daemon-reload
     # Enable each unit listed in the scionlab-services.txt file
     while read line; do
       sudo systemctl enable $line
     done < scionlab-services.txt
     # Start SCION
     sudo systemctl start

Running SCION

If using VPN, ensure that the OpenVPN-client is up before starting the SCION services.

sudo systemctl start openvpn@client-scionlab-<attachment point ISD-AS>

Check that the expected tun0 tunnel-interface is created before continuing. Please refer to corresponding troubleshooting page.

The SCION services are configured as systemd-units that are controlled by the target To start all the configured SCION services, simply run

sudo systemctl start

Check the status of the SCION services using

sudo systemctl list-dependencies

To stop the services, run

sudo systemctl stop

Find the log files of the SCION services in /var/log/scion/.


Most of our applications in scion-apps are available as packages too. Assuming you’ve added the SCIONLab packages list above, to install all applications in one go simply run

sudo apt-get install scion-apps-*

or install them individually, e.g. for bwtester

sudo apt-get install scion-apps-bwtester

Copyright © 2020, Network Security Group, ETH Zurich