minsec

Quick start

From a fresh install to a first ban, with a dry run that touches nothing.

This assumes minsec is installed and not yet running.

1. See what would happen, first

Before enabling anything, run a filter over a log file you already have. This is pure text matching — no thresholds, no allowlist, no firewall.

minsec test sshd /var/log/secure        # EL
minsec test sshd /var/log/auth.log      # Debian / Ubuntu

Each match prints the extracted address, the pattern number, and the line it came from. -q prints per-address totals instead. If you get no output, either the log is clean or the filter does not match your log format — troubleshooting covers both.

2. Enable the filters for services you actually run

minsec filters                          # what is available
sudo minsec enable sshd
sudo minsec enable postfix-sasl dovecot # if you run mail

enable writes /etc/minsec/conf.d/<name>.toml. Nothing is enabled by default, because a filter watching a log you do not produce is only a way to be surprised later.

3. Validate the configuration

sudo minsec check

This merges minsec.toml with the drop-ins and compiles every enabled filter, offline. Do this after every configuration change — the daemon does not live-reload, and a bad regex should fail here, not at restart.

4. Dry run against the real logs

sudo minsec daemon --backend null

The null backend runs the full engine — thresholds, allowlists, IPv6 aggregation, escalation — and logs what it would ban without touching the firewall. Leave it for a few minutes on a server with real traffic and read what it says. Ctrl-C when you have seen enough.

Check the allowlist before you go live

Loopback and local addresses are implied, but your office IP, monitoring probes and backup host are not. Add them now:

# /etc/minsec/minsec.toml
[defaults]
allow = ["203.0.113.0/24", "198.51.100.10"]

The daemon refuses manual bans that overlap the allowlist, and never issues automatic ones for it.

5. Start it

sudo systemctl enable --now minsec
minsec status

status reports the version, backend, uptime, and per-filter counters. Bans show up in the kernel, not in a userspace list:

minsec list                       # what the daemon sees
sudo nft list set inet minsec ban4

6. Confirm a ban and unban

sudo minsec ban 203.0.113.7 --ttl 10m
minsec list
sudo minsec unban 203.0.113.7
minsec events -n 20               # JSON Lines: starts, bans, unbans

Manual bans are never reported to the crowd, so this is safe to try even with multiplayer mode on.

Where to go next