██████╗ ██╗ ██╗██████╗ ███████╗███████╗ ██████╗ ██╔══██╗██║ ██║██╔══██╗██╔════╝██╔════╝██╔════╝ ██████╔╝██║ ██║██████╔╝███████╗█████╗ ██║ ██╔═══╝ ██║ ██║██╔══██╗╚════██║██╔══╝ ██║ ██║ ╚██████╔╝██████╔╝███████║███████╗╚██████╗ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝ ╚═════╝
ActivityPub Threat Intelligence — federated abuse data, no central authority
Your fail2ban already knows which addresses attack you. So does everyone else's. pubsec shares those observations between your different servers and also other operators over ActivityPub: IPs, prefixes and domains linked to SSH brute force, spam, scanning or command-and-control.
Debian 12 (bookworm) and 13 (trixie), amd64.
sudo apt install -y curl ca-certificates curl -fsSL https://repo.pubsec.net/pubsec-archive-keyring.gpg \ | sudo tee /usr/share/keyrings/pubsec-archive-keyring.gpg > /dev/null sudo tee /etc/apt/sources.list.d/pubsec.sources > /dev/null <<'EOF' Types: deb URIs: https://repo.pubsec.net/debian Suites: stable Components: main Signed-By: /usr/share/keyrings/pubsec-archive-keyring.gpg EOF sudo apt update
sudo apt install -y pubsecd pubsec-fail2ban
sudo nano /etc/pubsecd/config.toml
Set at least these, then let a reverse proxy terminate TLS for
base_url and forward the Host header unchanged:
[instance] base_url = "https://ti.example.net" username = "feed" name = "Example Org threat feed" organization = "Example Org" contact = "abuse@example.net"
sudo systemctl enable --now pubsecd sudo systemctl enable --now pubsec-fail2ban
The hub at stats.pubsec.net accepts any node, ingests
TLP:CLEAR evidence only and publishes
aggregate statistics. Follow it from
the terminal UI — press a on the Following tab:
sudo pubsec-tui # follow: feed@stats.pubsec.net
Publish at TLP:CLEAR if you want your evidence to count on the hub. Anything more restrictive is dropped there. The hub publishes nothing of its own.
| package | what it does |
|---|---|
| pubsecd | the daemon: federation, storage, REST API, plus pubsec-tui to administer it |
| pubsec-fail2ban | reports fail2ban bans, and writes the active list back for fail2ban to ban from |
| pubsec-rspamd | reports spam sources from Rspamd and serves the active list back as multimaps |
| pubsec-allowlist | keeps the local allowlist in sync with a hand-edited file |
| pubsec-dashboard | renders a static world map of where findings come from |
| pubsec-statsd | publishes aggregate statistics over a hub's TLP:CLEAR dataset |