Documentation

New here? Install the package, then follow the quick start — about five minutes to a running daemon with a dry run first, so nothing touches your firewall until you say so.

Getting started

• Install

  Beta packages for EL 8/9/10, Debian 11/12 and Ubuntu 22.04/24.04, on x86_64 and aarch64.

• Quick start

  From a fresh install to a first ban, with a dry run that touches nothing.

Using minsec

• Configuration

  One TOML file, plus drop-ins. Everything below has a working default.

• Filters

  Built-in filters for the usual services, and fail2ban-shaped regexes for everything else.

• Firewall & backends

  The kernel owns the ban list. minsec owns exactly one nftables table and nothing else.

• Web UIs

  The daemon speaks JSON on a Unix socket, so user interfaces never scrape command output.

• Troubleshooting

  The five things that actually go wrong, and the command that tells you which one it is.

Multiplayer

• Multiplayer mode

  Report your bans; pull crowd-sourced bans.

• Blocklist feed

  Two tiers, two address families, plain text, delta-capable. What minsec-sync pulls, and what you can pull yourself.

• DNSBL for mail

  The same crowd data, rendered for your mail stack — with mail abuse scored separately from web probes.

Reference

• API

  The v1 wire protocol: enrollment, signed report submission, the feed, and the DNSBL zone.

• Service status

  Every minsec.io service description and live status.

Manual pages

The manual pages installed by the minsec packages, published verbatim.

• minsec(1)

  minimalist log-driven intrusion prevention daemon and control utility

• minsec-sync(1)

  report local minsec bans and maintain the crowd blocklist

• minsec.toml(5)

  minsec daemon configuration and drop-in format

• minsec-filter.toml(5)

  minsec log-source and matching-filter definition format

• minsec-sync.toml(5)

  minsec multiplayer client configuration