How it works
Minaki is the security a small team would set up for a Linux server, run for you and reported in plain English. One login, one bill, one report, and you approve every change.
Who this is for
Strong security is built and priced for big companies with their own security teams. If you run a VPS, a side project or a handful of Linux servers, the same protection is usually out of reach, and you end up doing it by hand or not at all.
Every job in Minaki is one you can do yourself with open-source tools. We list them honestly on Do it yourself. What you pay us for is the time and the joining-up: we install these jobs, keep them current, run them across all your servers, and tell you what matters in plain English, with fixes you approve. The price is $1 per server per month from MinakiLabs LLC.
One suite, every job
These are the jobs in the suite. Each is something a security team would do for you — run across every server you have, and reported together in plain English.
Looks for malware, signs of a break-in and risky settings on each server, and gives you the command that fixes each one. This is Minaki Scan, and it runs on your server.
Looks at your server or website from the internet, the way an attacker would: open doors, exposed files, old software that shows its version. Only after you prove the server or site is yours.
Watches for password guessing, a login right after many wrong passwords, new accounts and admin rights, new login keys, new programs in odd places, new things set to start on their own, and connections to known attackers.
Tells you whether an address reaching your server is a known attacker, from MinakiLabs' own sensors, and blocks it on your server.
Send us a file you were sent or found on your server, and get a plain answer: harmful, warning signs, or nothing known found. Zip and Office files are opened and checked inside. We never keep the file.
Finds software on each server that has a known security problem and an update waiting, and gives you the one command that installs them all.
Send us a suspicious email and get a plain answer: very likely fake, warning signs, or no signs found, plus what to do.
Checks whether someone can send email pretending to be you, finds lookalike domains, and gives you the exact records to add.
A light agent on your server, the heavy work on ours
The point: you shouldn't need a powerful, expensive server to be well protected. So the suite runs a small, light program on your server — the agent — that does the watching, while the heavy analysis runs on our servers, not yours. That is what lets the suite protect even a low-cost server with little memory without slowing it down, and it means that when one customer is attacked, what we learn can protect everyone else.
The agent sends findings and summaries — things like a count of failed logins or the fingerprint of a file — never your files, their contents, or your data. See what leaves your server for the exact list. Our service does the thinking and sends back a report you can read.
The malware & server check works the other way around, on purpose. It runs entirely on your server and makes no network connections at all — nothing about your server leaves it. The agent is for the jobs that need our side to do the heavy analysis. Sales open with the first signed release.
What it needs to run
The agent is built to be light. Because the heavy analysis happens on our side, the agent's job on your server is small: watch, summarise, and send findings. It is meant to sit comfortably on the kind of low-cost server people actually run — a single processor and a small amount of memory — without getting in the way of what the server is for.
Measured in our lab and on test servers: the agent uses about 0.15% of one processor core and under 40 MB of memory, and sends under half a megabyte a day — measured, not estimated. That is light enough to sit comfortably on a small, low-cost server without getting in the way of what the server is for.
The malware & server check runs on any 64-bit Linux server, in seconds, and needs no agent and no account.
What leaves your server
When a job in the suite runs through the agent, this is what the agent sends us, and what it never sends. The malware & server check runs on your server and sends nothing; this is about the agent the other jobs use.
What the agent sends — findings and summaries
- Counts and summaries from your logs — for example, how many failed logins and from where — not the log lines themselves, and never your command lines or password hashes.
- A far-end network address only when it matters: when that address is on our list of known attackers, or is scanning your server. Otherwise the agent sends counts only, with no addresses.
- Fingerprints of files and keys — a hash that identifies a file or an SSH key — never the file's contents, and never the key itself.
- Changes to your programs, services and startup items — that something changed and what kind of thing it was, not your data.
- A short summary of network connections, and alerts — never the actual traffic or the packets.
What the agent never sends
- Your files or their contents.
- Your data, your customers' data, or your passwords, keys and credentials — only a fingerprint, never the secret itself.
- Your command lines or password hashes.
- Raw network traffic or packets.
- Anything that identifies you or your business beyond what a single finding needs.
In transit and afterwards. What the agent sends travels encrypted, over HTTPS. We keep findings for 30 days, then delete them together with the reports made from them. The list of your installed software is deleted as soon as it has been checked; only the result is kept, for 30 days. We do not sell customer data to anyone, ever. The formal version lives on our privacy page.
Shared defense is separate, and opt-in. Pooling attack signals across customers so everyone's protection improves is its own feature, off by default, and you choose whether to take part. It is described on its own page: shared defense.
Where the protection comes from
Our own honeypot sensors pose as ordinary servers around the world and record real attacks on Linux every day. A rule-based analyst and published security research turn each attack into a check or a cure, a person reviews and approves it, and it is tested on an isolated machine before it reaches you. The numbers on our home page and on Caught this week are counted from those sensors, not invented. See how we test for the full method.
Why it is safe to let it run
A tool with access to your server has to earn it. Minaki is built so that nothing happens to your machine without your say-so.
- Read-only by default. A scan only reads and reports. It changes nothing on its own.
- You approve every change. A fix is applied only when you choose to, one at a time, and only after you approve that specific change. You can always copy the exact command and run it yourself instead.
- Backups before every change, and a log. Before it edits or removes anything, it keeps a copy on your server, and it records every change it makes, with the command that undoes a setting change.
- Undoable. Setting changes come with their undo command. Removed malware is kept as a copy that cannot run, in a folder only the administrator can open.
Our advice, and the way we build it: test on a server that is not in production first, and keep your own backups of every server. Minaki keeps a copy of what it changes, but that copy is not a backup of your server. You remain responsible for your systems and for the changes you approve.
Getting started
The malware scan is the part you can use first. See what the scanner does, read the honest install notes, and how pricing works. Sales open with the first signed release.