Allowed
Cache public JSON, create local review notes, query package-manager security metadata and report locally observed exposure.
ZSEC operational documentation
Install carefully.
Verify everything.
ZSEC automates security-only Linux updates and local hardening checks with no remote command channel. This guide explains the real operating boundary, not a marketing abstraction.
LINUX UTILITY v0.1.0SHIELD v0.1.2 PRERELEASEREMOTE COMMANDS DISABLED
01 / QUICKSTART
Review-first installation
Run ZSEC only on a server you control. Start on a spare VM or staging host, confirm backups and keep a second administrative session available during SSH-related work.
Download, inspect, install, verify
curl -fsSL https://raw.githubusercontent.com/ResearchForumOnline/ZSEC/main/install.sh -o zsec-install.sh less zsec-install.sh sudo bash zsec-install.sh sudo zsec status sudo zsec check
Do not pipe unfamiliar root scripts blindly. The one-line installer exists for convenience, but the review-first sequence above is the recommended path.
02 / COMMANDS
Small command surface
| Command | Purpose | Mutation |
|---|---|---|
zsec check | Dry-run updates and local audits | Read-only apart from local reporting/cache |
zsec run | Apply OS security updates and configured hardening | Yes—review before use |
zsec audit | Inspect hardening and exposed ports | Local audit only |
zsec lockout-guard | Refresh SSH backups and admin-IP record | Local files |
zsec todo | Show advisory review notes | No privileged remote action |
zsec status | Show timer, log and TODO preview | Read-only |
03 / SECURITY BOUNDARY
The feed is data, never authority
Forbidden
Remote shell commands, feed-requested packages, firewall changes, SSH changes, sample upload or AI-driven runtime actions.
Local authority remains local. APT or DNF decides which packages are security updates. Human operators decide whether advisory TODOs apply to their inventory.
04 / ADVISORY FEED
Public signals, bounded use
The feed normalises CISA Known Exploited Vulnerabilities and selected public security-news signals. It is designed to help an owner create a review queue—not to infer that every CVE applies.
- Schema is
zsec.feed.v1. remote_commands_allowedremainsfalse.- Automatic update scope remains OS security packages only.
- Source attribution is preserved per item.
- Unavailable or malformed feed data fails closed.
05 / ENDPOINT SHIELD
Deterministic scanner preview
ZSEC Shield v0.1.2 is a separate immutable prerelease for Windows x64, macOS arm64 and Linux x86_64. It performs explicit on-demand scanning and returns structured local evidence.
What it provides
SHA-256 and exact-byte rules, signed data-only definitions, read-only inventory and opt-in recoverable quarantine.
What it does not claim
It is not certified antivirus and does not claim real-time prevention, guaranteed detection, silent background scanning or Store approval.
Unsigned prerelease. Verify the checksum through the authenticated GitHub release, test before use and keep the operating system's built-in security enabled.
06 / RECOVERY
Keep rollback boring
- Preserve `/var/backups/zsec` and a provider snapshot before broad deployment.
- Keep a second SSH session open while changing access-related settings.
- Inspect `/var/log/zsec/zsec.log` and `zsec status` after every run.
- Use distribution package-manager history for package rollback decisions.
- Treat exposed-port and CVE TODOs as review signals until applicability is confirmed.
07 / SUPPORT
Evidence before escalation
For bugs, include the ZSEC version, distribution, command used, redacted output and whether the issue reproduces in check mode. Never post secrets, tokens, private keys, recovery keys or confidential host details.