This project documents the creation of a small Security Operations Center (SOC) lab environment focused on Linux security monitoring, system hardening, and incident detection.
The lab uses Wazuh as a Security Information and Event Management (SIEM) platform to collect and analyze security events. Additional security controls were implemented including SSH hardening, firewall configuration, Fail2Ban protection, audit logging, and automated security checks.
- Arch Linux
- KVM virtualization
- Ubuntu 24.04 LTS
- Wazuh Manager
- Wazuh Dashboard
- Wazuh Indexer
- Filebeat
Implemented SSH security improvements:
- Disabled root login
- Prevented empty passwords
- Restricted SSH forwarding features
- Increased SSH logging verbosity
- Reduced authentication attempts
Documentation:
- notes/ssh-hardening.txt
Configured UFW firewall with a default deny incoming policy.
Allowed services:
- SSH (22/tcp)
- HTTPS / Wazuh Dashboard (443/tcp)
- Wazuh Agent Communication (1514/tcp)
- Wazuh Agent Enrollment (1515/tcp)
- Wazuh API (55000/tcp)
Documentation:
- notes/firewall-config.txt
Configured Fail2Ban to protect SSH against repeated authentication failures.
Configuration:
- Jail: sshd
- Maximum retries: 5
- Ban duration: 600 seconds
- Monitoring source: systemd SSH logs
Documentation:
- notes/fail2ban-sshd.txt
Implemented auditd monitoring for security-related events.
Monitored:
- File modifications
- User activity
- Security events
A test modification was performed against sensitive account files to verify event logging.
Documentation:
- notes/auditd.txt
- notes/auditd-test.txt
Additional security improvements:
- Installed debsums for package integrity verification
- Enabled process accounting
- Added login warning banners
- Enabled automatic security updates
Documentation:
- notes/debsums.txt
- notes/process-accounting.txt
- notes/login-banner.txt
- notes/unattended-upgrades.txt
A simulated SSH authentication attack was performed against the SOC server.
Multiple failed SSH authentication attempts were generated. Wazuh detected the activity through PAM authentication logs and mapped the event to MITRE ATT&CK techniques.
Detection evidence:
Alert details:
Security posture was evaluated using Lynis.
Initial assessment:
Hardening Index: 60
After implementing security improvements:
Hardening Index: 69
Result:
+9 point improvement
Screenshots:
Initial assessment:
Final assessment:
Collects system information useful for security assessment, troubleshooting, and documentation.
Collected information:
- Host information
- Operating system details
- Kernel information
- CPU information
- Memory usage
- Disk usage
- Running security services
- Listening network ports
Performs a quick security status assessment.
Checks:
- Firewall status
- SSH service status
- Fail2Ban status
- Wazuh services
- Auditd status
- Listening network ports
Creates backups of important security configuration files before making system changes.
Backed up configurations:
- SSH configuration
- Fail2Ban configuration
- Audit rules
- Firewall configuration
Additional configuration notes can be found in:
- notes/
Evidence screenshots:
- screenshots/
Automation scripts:
- scripts/
- Linux system administration
- SIEM deployment and monitoring
- Security event analysis
- MITRE ATT&CK mapping
- SSH hardening
- Firewall configuration
- Intrusion prevention
- Security automation
- Vulnerability assessment