minsec

Intrusion prevention · Threat intelligence

Minimalist intrusion prevention with a crowd behind it.

minsec watches your logs and bans attackers, and — if you opt in — pools what it learns with every other participating server so you block tomorrow’s attackers today. One ~2.5 MB binary. About 2 MB of RAM (plus ~30MB if systemd libs are linked for journal ingestion, but the additional memory is shared with all journal users, so it's already paid for on systemd systems).

Install minsec Five-minute quick start
minsec aperture logo

Up and running in one command

Install the package, turn on filters for services you run, start the daemon. Bans live in the kernel firewall, not in a userspace list. minsec doesn't grow over time based on activity.

root@server
# minsec enable sshd postfix-sasl dovecot
enabled sshd, postfix-sasl, dovecot in /etc/minsec/conf.d/
# systemctl enable --now minsec
# minsec status
minsec 0.1.5   uptime 4d 2h   rss 2.1 MiB
filter            watching        matched   banned
sshd              journal:sshd       1,842       57
postfix-sasl      journal:postfix      611       23
crowd4            api.minsec.io    184,203        —

What you get

  • Tiny and boring

    One static binary, ~2 MB resident with ten filters running. No Python or JavaScript runtime, no database. Small enough for very small VMs, while still doing everything you'd expect.

  • The kernel owns the bans

    nftables set elements with timeouts. Bans expire on their own and survive a minsec daemon restart.

  • fail2ban-shaped filters

    Regexes with <HOST> and <F-USER> tokens, so filters you already wrote mostly port over. minsec test shows exactly what would match before anything is banned.

  • Crowd blocklist

    Opt in and pull a curated feed of addresses that other participating servers are already blocking, straight into dedicated crowd4/crowd6 nftables sets.

  • Categorised DNSBL

    The same data, rendered as an rbldnsd zone for your mail stack — mail credential abuse scored separately from web probes, with SpamAssassin rules ready to drop in.

  • Auditable by design

    Reports include a network, a rule name and counters. No log lines, usernames, or anything about your users. Read what leaves the machine.

Multiplayer mode

Your server knows which addresses are attacking it. So does everyone else’s. Multiplayer mode is how we help each other.

  • 1 · Report

    The minsec-sync helper posts your automatic bans — attacker network, rule name, hit count — signed with a per-install key. Manual bans are not reported.

  • 2 · Corroborate

    An address is only listed when multiple installations agree on it, weighted by each reporter’s standing. One noisy or hostile agent cannot corrupt the data.

  • 3 · Pull

    Every hour your firewall picks up the delta. Attackers hitting someone else this morning are dropped at your edge this afternoon.

How multiplayer works What is collected

Manage it however you like

The daemon speaks newline-delimited JSON on a Unix socket, so user interfaces don't need to scrape command output.

  • Virtualmin

    Ships with Virtualmin and replaces its fail2ban integration. Nothing to install separately.

  • Cockpit

    A Cockpit module for status, live bans, unbanning and filter toggles on any systemd distro. Install it.

  • cPanel & Plesk & WordPress planned

    More plugins are on the roadmap.

  • Your own tooling

    --json on every command, or talk to /run/minsec/minsec.sock directly. See minsec(1).

Start here

  • Install

    Packages for EL8/9/10, Debian 11/12, Ubuntu 22.04/24.04, on x86_64 and aarch64.

  • Quick start

    From zero to a first ban, including a dry run.

  • Configuration

    One TOML file and drop-ins. Ban times, escalation, allowlists, IPv6.

  • Manual pages

    The shipped man pages, published verbatim.