← All paths

Network security basics

Lock down hosts, write real ACL policy, and finish by catching attacks in logs.

9 challenges · ~6 h · every step earns its own verified proof

0/9 solved
Start: Harden the SSH daemon →
  1. Harden the SSH daemoneasy~20 min

    Close the most attacked door first, the SSH daemon.

  2. Guest Wi-Fi can reach everythingmedium~35 min

    Guests reach the internet and nothing else. The classic first ACL.

  3. Let replies in, keep new connections outmedium~40 min

    Stateless filters need to let replies in without opening the door. Learn established.

  4. Lock down the server subnet without locking yourself outmedium~50 min

    A real policy with ordering pitfalls. Lock the subnet down without locking yourself out.

  5. Lock down a host with nftablesmedium~35 min

    The same flow thinking on a host, with default-drop nftables that still serve traffic.

  6. Harden nginx TLSmedium~25 min

    Modern protocols, strong ciphers, and HSTS on nginx.

  7. Write a detection for an SSH brute-forcemedium~40 min

    Switch to the blue team. Write a detection that catches the brute force.

  8. Catch the port scanner, not the busy hostsmedium~40 min

    Tell a scan from busy-but-benign hosts with a threshold rule, not a flood of false alarms.

  9. Catch DNS-tunneling exfiltrationhard~45 min

    The capstone. Find the DNS tunnel in real log noise without false positives.