Security-only Linux updates, SSH lockout guardrails, fail2ban direction, local exposure checks, and read-only advisory TODOs.
Live Docs | Operations | Downloads | Advisory Feed | Threat Model | FreeWebPanel | Security
ZSEC is a small open-source utility for Linux servers that need predictable security maintenance without turning a public feed, web panel, or AI system into a control plane.
It has one clear purpose: keep a real server patched, safer to access over SSH, easier to inspect, and harder to accidentally expose.
The public ZSEC product page now separates the two reviewed lanes clearly: the Linux server updater and the independently released ZSEC Shield endpoint-scanner preview. The live operations documentation is the shortest path from evaluation to safe installation and recovery planning.
Review the installer before running it:
curl -fsSL https://raw.githubusercontent.com/ResearchForumOnline/ZSEC/main/install.sh -o zsec-install.sh
less zsec-install.sh
sudo bash zsec-install.shFast install on a server you control:
curl -fsSL https://raw.githubusercontent.com/ResearchForumOnline/ZSEC/main/install.sh | sudo bashClone install:
git clone https://github.com/ResearchForumOnline/ZSEC.git
cd ZSEC
sudo bash install.shCheck the install:
sudo zsec status
sudo zsec check
sudo zsec audit| Area | Behavior |
|---|---|
| Security updates | Applies operating-system security updates only. |
| Schedule | Runs every 12 hours through a systemd timer with randomized delay. |
| Debian family | Selects apt candidates from security origins on Ubuntu, Debian, Proxmox, and compatible systems. |
| RHEL family | Uses DNF security metadata on AlmaLinux, Rocky Linux, RHEL-like systems, and compatible hosts. |
| SSH safety | Backs up SSH config and authorized keys before guardrail work. |
| Lockout awareness | Records the current admin SSH IP when available. |
| Abuse reduction | Configures fail2ban for SSH when available. |
| Host hardening | Applies conservative kernel/network sysctl hardening. |
| Container hosts | Preserves unprivileged user namespaces on detected container or virtualization hosts. |
| AI/dev exposure | Warns about public ports often used by Ollama, Jupyter, Gradio, Open WebUI, and Node dev services. |
| Advisory TODOs | Reads the public ZSEC feed as data and writes local TODO files for operator review. |
ZSEC is intentionally not a remote administration platform.
| Allowed | Not allowed |
|---|---|
| Read a public advisory feed | Run shell commands from the feed |
| Cache advisory JSON locally | Install packages requested by the feed |
| Create local TODO text and JSON | Change firewall rules from the feed |
| Warn about locally relevant risks | Change SSH config from the feed |
| Use the OS package manager for updates | Let AI perform runtime server actions |
The local package manager remains the authority for security updates. The advisory feed is guidance, not a command channel.
zsec check # dry-run security update and audits
zsec run # apply security updates and hardening
zsec audit # local hardening and exposed-port audit only
zsec lockout-guard # refresh SSH backups and admin IP record
zsec todo # show local advisory feed TODOs
zsec status # show timer, latest log, and TODO preview
zsec version # print version| Need | Link |
|---|---|
| Latest source ZIP | Download ZIP |
| GitHub releases | ZSEC releases |
| ZSEC Shield v0.1.2 prerelease | Release page |
| ZSEC Shield Windows x64 | Download ZIP |
| ZSEC Shield macOS arm64 | Download tar.gz |
| ZSEC Shield Linux x86_64 | Download tar.gz |
| ZSEC Shield checksums | SHA256SUMS.txt |
| Install script | install.sh |
| Operations guide | docs/OPERATIONS.md |
| Advisory feed design | docs/advisory-feed.md |
| Public website | talktoai.org/zsec |
ZSEC Shield v0.1.2 is a separate immutable GitHub prerelease. Its native archives are unsigned preview builds; checksums verify downloaded bytes, not publisher identity.
Primary support:
- Ubuntu 22.04, 24.04, and compatible newer releases
- Debian-like systems
- Proxmox VE hosts
- AlmaLinux 8/9/10 compatible releases
- Rocky Linux 8/9/10 compatible releases
ZSEC should be tested on a spare server, VM, or staging host before wide rollout.
| Path | Purpose |
|---|---|
/usr/local/sbin/zsec |
Runtime command |
/etc/zsec/zsec.conf |
Main config |
/etc/zsec/allowlist.d/admin-ip.conf |
Saved admin SSH IP when available |
/var/log/zsec/zsec.log |
Runtime log |
/var/lib/zsec/todo.txt |
Human-readable advisory TODOs |
/var/lib/zsec/todo.json |
Structured advisory TODOs |
/var/backups/zsec |
SSH backup snapshots |
/etc/systemd/system/zsec.timer |
12-hour systemd timer |
- Operations guide
- Downloads and releases
- Threat model
- Advisory feed design
- FreeWebPanel integration
- Roadmap
- Changelog
- Contributing
- Security policy
Linux servers are attacked constantly by scanners, SSH botnets, exploit chains, and increasingly automated tooling. The highest-value baseline is still disciplined and practical:
- apply security updates quickly;
- avoid SSH lockouts while reducing brute-force exposure;
- warn about public AI and development services;
- keep server hardening deterministic and inspectable;
- avoid remote-control behavior hidden behind a feed or dashboard.
ZSEC is built for that baseline.
ZSEC is for people searching for security-only Linux updates, unattended security updates, SSH lockout protection, fail2ban setup, server hardening scripts, AI server exposure checks, Ollama public port warnings, Proxmox security updates, AlmaLinux security updates, Rocky Linux security updates, and safe Linux update automation.
Open source under the repository license. The code should be visible and auditable. Hiding code is not treated as a security feature.