Install and use Minaki Scan

Before you start

Downloads aren't open yet. We haven't published a signing key, a download server or a package repository. Nothing on this page can be installed today.

The install steps below are the exact commands you'll use once we publish signed packages. We've tested them with a stand-in signing key on Debian 12 and 13 and Ubuntu 22.04 and 24.04, and the standalone path on Debian 12 and Fedora 41. They're written to work unchanged once the real key and download server exist. Until then, please don't run them: they won't work.

Minaki Scan needs Python 3.7 or newer and gpgv, a small program that checks digital signatures. On Debian and Ubuntu, apt installs them for you if they're missing.

Why we never use curl ... | sh. Many tools install by downloading a script and piping it straight into a shell. A script can't verify itself: the code that would check the signature is the same thing you just downloaded, over the same connection. So we give you a few short commands you can read, and every download is checked against our key before anything is installed.

Install on Debian or Ubuntu

Not available yet. These are the steps you'll use once signed packages are published.

Step 1. Download our signing key:

curl -fsSLo /tmp/minakilabs-archive-keyring.gpg https://dl.minaki.io/minakilabs-archive-keyring.gpg

Step 2. Check the key file against its checksum before you trust it. We'll publish the exact checking command, with the real checksum, next to the key's fingerprint when we publish the key. Don't skip this step: it's what proves the key came from us.

Step 3. Add our package repository and install:

sudo install -m 0644 /tmp/minakilabs-archive-keyring.gpg /usr/share/keyrings/minakilabs-archive-keyring.gpg
printf '%s\n' 'Types: deb' 'URIs: https://dl.minaki.io/apt' 'Suites: stable' 'Components: main' 'Signed-By: /usr/share/keyrings/minakilabs-archive-keyring.gpg' | sudo tee /etc/apt/sources.list.d/minaki.sources >/dev/null
sudo apt update && sudo apt install -y minaki-scan minakilabs-archive-keyring

This installs two packages: the scanner, and a small package that keeps our signing key up to date on your server.

Install on other Linux

Not available yet. These are the steps you'll use once signed packages are published.

For Linux without apt (Fedora, RHEL-like systems, Arch and others) there's a standalone install. You'll need python3, gpgv (on Fedora and RHEL it comes in the gnupg2 package) and curl. Run the steps in the same terminal, because step 1 sets a value that step 3 uses.

Step 1. Download our signing key:

B=https://dl.minaki.io
curl -fsSLO $B/minakilabs-archive-keyring.gpg

Step 2. Check the key file against its checksum. As with the Debian steps, we'll publish the exact checking command and checksum next to the key's fingerprint.

Step 3. Download the latest release's checksums, signature and installer, check them, then install:

V=$(curl -fsSL $B/releases/latest/SHA256SUMS | sed -n 's/.*minaki-scan-\(.*\)\.tar\.gz$/\1/p')
for f in SHA256SUMS SHA256SUMS.asc minaki-update; do curl -fsSLO $B/releases/$V/$f; done
gpgv --keyring ./minakilabs-archive-keyring.gpg SHA256SUMS.asc SHA256SUMS   # must say "Good signature"
sha256sum -c --ignore-missing SHA256SUMS                                    # minaki-update: OK
sudo sh minaki-update --install --keyring ./minakilabs-archive-keyring.gpg

The installer downloads the release, checks it again, and installs it to /opt/minaki-scan/. It puts minaki-scan on your path, installs itself as /usr/local/sbin/minaki-update, and remembers our key so later updates are checked against it.

Windows Subsystem for Linux

Minaki Scan doesn't support Windows Subsystem for Linux (WSL) yet. One early internal test on WSL2 with Ubuntu 22.04 ran correctly, but we haven't tested the current version there, and we haven't tested WSL1 at all. Minaki Scan doesn't run on Windows itself.

Run your first scan

Run a full scan:

sudo minaki-scan

A scan only reads. It changes nothing on your server and sends nothing anywhere. It needs sudo to see everything, such as account passwords, other users' login keys and the SSH log. Without sudo it still runs, tells you it isn't running as root, and checks less.

Other ways to run it:

minaki-scan --advanced shows every piece of evidence and the checks that couldn't run.
minaki-scan --json prints the results for other programs to read.
minaki-scan --root /mnt/disk checks a disk mounted at that folder instead of the running system. Only file checks run in this mode, because there are no running programs or open ports to look at.
minaki-scan --version prints the version.

Reading the report

The report starts with one line that sums it up, such as "Result: 2 serious problems to deal with". Then it lists each finding, most serious first. Each finding has:

a label and a plain description of what's wrong;
Why: why it matters;
the evidence: the exact file, line or setting it found;
Fix: the exact commands to fix it by hand.

The report ends with "What to do next", which points you at the first item to deal with.

Severity labels

Label	What it means
Serious	Act now. Examples: a known crypto miner is running, an account has no password, or there are signs of a threat that means rebuilding.
Important	A real problem to fix soon. Example: SSH accepts passwords.
Worth a look	Something to check. Example: login keys changed in the last 7 days.
Minor	Small upkeep. Example: updates are waiting for a restart.
Note	For your information; nothing to fix.

What it couldn't check

Minaki Scan never skips a check silently. If some checks couldn't run, the report ends with a line such as "(1 checks couldn't run — see minaki-scan --advanced)". Run minaki-scan --advanced to see a "Not checked:" line that names each one and why, for example "/etc/shadow unreadable without root" or "apt not available". In --json output the same list is under skipped.

A report with nothing in it says "nothing found by these checks", and adds that this is not proof the machine is clean. No scanner can prove that.

Exit codes

For scripts and monitoring, minaki-scan exits with:

Code	Meaning
`0`	Nothing above Minor.
`1`	The worst finding is Worth a look.
`2`	At least one Important or Serious finding.
`3`	The scan couldn't run, for example because the install is incomplete.

After --fix, the exit code reflects your server after the fixes, not before.

Fixing problems with --fix

Run:

sudo minaki-scan --fix

Minaki Scan scans first, shows the report, then offers each fix it knows how to apply safely, one at a time. Nothing happens unless you type yes. Anything else skips that fix. When you've answered every question, it scans again and shows the new result.

It can apply two kinds of fixes:

SSH settings: turn off password logins, allow root to log in with a key only, and refuse empty passwords. It writes these to one file, /etc/ssh/sshd_config.d/00-minaki-scan.conf, tests the new settings with sshd -t, and puts the old file back if the test fails. It refuses to turn off password logins if no account has an SSH key, so it can't lock you out.
Malware removal: for the seven threats it can cure (see the scanner page), it removes only what it has confirmed. Depending on the threat, that means its startup entries, its running processes and its files. Anything it can't confirm, it leaves for you to check by hand. Then it scans again.

After an SSH fix, keep your current session open and test a new login before you close it. For anything a fix doesn't cover, the report shows the commands to run by hand. Read them before you run them.

Undoing a fix

There's no undo command. Instead, Minaki Scan saves a copy of what it changes and writes down what it did, so you can put things back yourself.

The change log. Every fix adds a line to /var/lib/minaki-scan/changes.log, with the time and what was done.
SSH fixes. The exact undo command is printed on screen when the fix is applied and written into the change log. If the settings file was new, the undo deletes it. If it already existed, the undo copies the saved version back from /var/lib/minaki-scan/backup/. A log line looks like this:

2026-10-15T12:51:53Z ssh-no-passwords applied to /etc/ssh/sshd_config.d/00-minaki-scan.conf; undo: sudo rm /etc/ssh/sshd_config.d/00-minaki-scan.conf && sudo systemctl reload sshd

Malware removal. Before it deletes or edits anything, Minaki Scan copies it into a dated folder under /var/lib/minaki-scan/, named after the threat (for example /var/lib/minaki-scan/mirai/). The copies can't be run, and only root can open that folder. The folder's location is printed during the removal. There's no one-step restore, because these files are malware. The copies are there so you can see exactly what was removed. Processes that were stopped stay stopped.

Updates

Updates start with the first signed release.

On Debian and Ubuntu, Minaki Scan updates with the rest of your system. New checks and cures come inside the package, already signature-checked by apt:

sudo apt update && sudo apt upgrade

With the standalone install:

sudo minaki-update updates to the newest signed release;
minaki-update --check only tells you whether there is one;
sudo minaki-update --rollback goes back to the release you had before.

The standalone updater checks the signature and the checksum before it replaces anything. If any check fails, your current version keeps running.

Uninstall

Debian or Ubuntu

sudo apt purge minaki-scan minakilabs-archive-keyring
sudo rm /etc/apt/sources.list.d/minaki.sources
sudo apt update

Standalone install

The standalone updater has no uninstall option. Delete the files it installed:

sudo rm -r /opt/minaki-scan
sudo rm -f /usr/local/bin/minaki-scan /usr/local/bin/minaki /usr/local/sbin/minaki-update

If you created /etc/minaki/update.conf to change the download address, delete that too.

What uninstalling leaves behind

Uninstalling doesn't undo any fixes. SSH settings it applied stay in /etc/ssh/sshd_config.d/00-minaki-scan.conf. The change log and backups stay in /var/lib/minaki-scan/. When you no longer need them, delete them:

sudo rm -r /var/lib/minaki-scan

What's not ready yet

Signed packages, the download server and the package repository.

Buying a license. Sales open with the first signed release. See pricing.

Support for Windows Subsystem for Linux.

Windows, Mac and other devices. These are plans, not features yet.