Installing minsec
Beta packages for EL 8/9/10, Debian 11/12 and Ubuntu 22.04/24.04, on x86_64 and aarch64.
For the beta, every release attaches a .rpm and a .deb to the
GitHub release page. One package per
architecture serves every supported distribution: the binaries are built against
glibc 2.28, which is the floor across EL 8 and Debian 11, so there is no
per-distro build to pick between. Dependencies are minimal — systemd and, for the
default backend, nftables — so a downloaded package installs with the same one
command a repository would use.
Requirements
- Linux with systemd (the daemon reads the journal and installs a unit).
- nftables for the default backend. If you run firewalld or iptables-nft, minsec composes with them rather than replacing them — see firewall.
- Root, for the install and for the daemon.
A system without nftables can still run minsec with the exec or null
backends.
Install the package
Pick your architecture: uname -m prints x86_64 or aarch64.
Red Hat Enterprise Linux, Rocky, AlmaLinux, Oracle Linux, CentOS Stream.
ARCH=$(uname -m)
VER=0.1.5
curl -fsSLO "https://github.com/minsecio/minsec/releases/download/v${VER}/minsec-${VER}-1.${ARCH}.rpm"
sudo dnf install "./minsec-${VER}-1.${ARCH}.rpm"
dnf pulls in anything missing and the package is tracked like any other, so
dnf remove minsec works normally. Upgrades are manual during the beta: download
the next release and run the same dnf install.
Debian 11 and 12, Ubuntu 22.04 and 24.04.
ARCH=$(dpkg --print-architecture) # amd64 or arm64
VER=0.1.5
curl -fsSLO "https://github.com/minsecio/minsec/releases/download/v${VER}/minsec_${VER}-1_${ARCH}.deb"
sudo apt install "./minsec_${VER}-1_${ARCH}.deb"
apt install ./file.deb resolves dependencies and registers the package with
dpkg, so apt remove minsec works normally. Upgrades are manual during the beta:
download the next release and run the same apt install.
Needs a recent stable Rust toolchain.
git clone https://github.com/minsecio/minsec
cd minsec
cargo build --release
sudo install -m 0755 target/release/minsec /usr/bin/minsec
sudo install -d /etc/minsec
sudo install -m 0644 packaging/minsec.toml /etc/minsec/
sudo install -d /usr/share/man/man1 /usr/share/man/man5
sudo install -m 0644 docs/man/*.1 /usr/share/man/man1/
sudo install -m 0644 docs/man/*.5 /usr/share/man/man5/
sudo install -m 0644 packaging/minsec.service /etc/systemd/system/
sudo install -m 0644 packaging/minsec.sysusers.conf /usr/lib/sysusers.d/minsec.conf
sudo install -m 0644 packaging/minsec.tmpfiles.conf /usr/lib/tmpfiles.d/minsec.conf
sudo systemd-sysusers && sudo systemd-tmpfiles --create
A source build gives you the same layout the packages create, so every other page applies unchanged.
The package installs the minsec binary, the minsec-sync helper for
multiplayer mode, a default /etc/minsec/minsec.toml,
the systemd units, and the manual pages. It does not start the daemon, and no
filters are enabled until you enable them.
The cockpit-minsec module is published the same way, from
its own releases — see
the Cockpit UI.
Verify
minsec --version
minsec filters # the built-in filter set; * marks enabled
man minsec # same text as our /docs/reference pages
Package repositories
Package repositories are not published yet
The COPR and PPA below do not exist yet, and the commands in this section will not work until they do. For the beta, install from the release files on GitHub — see above.
A COPR for EL and a PPA for Ubuntu are planned, so that installs and upgrades arrive with the rest of your system updates. Release files stay supported afterwards, for Debian and for anyone who would rather not add a repository.
sudo dnf install dnf-plugins-core
sudo dnf copr enable minsecio/minsec
sudo dnf install minsec
The COPR will carry both minsec and the cockpit-minsec module, so
the Cockpit UI needs no second repository.
Ubuntu 22.04 and 24.04 only — Debian has no PPA support, so Debian stays on the release files above.
sudo apt install software-properties-common
sudo add-apt-repository ppa:minsecio/minsec
sudo apt update
sudo apt install minsec
The PPA will carry both minsec and the cockpit-minsec module, so
the Cockpit UI needs no second repository.
Next
Continue to the quick start to enable filters and watch a dry run before anything reaches the firewall.