Basic security utilities¶
Practical 6.7 Project checklist PDF
A building with every door unlocked and nobody at reception. Anyone can walk in, try every room, and nobody would notice. That is your office server right now: the audit showed open ports, no firewall, and no one watching the logs. How many doors does it really have?
Knowing your three worst risks is only half the job. The other half is closing them with the right tools — and knowing what each tool does not do, so you never feel safer than you are. This page installs five guards on ubu-srv, tests each one, and ends with the checklist that says whether the whole office server is finished.
What you will learn
- Scan your own server with nmap and read the result — and why you never scan anything else
- Configure a host firewall with ufw: deny by default, allow only what the server offers
- Install fail2ban, read the state of a jail, ban and unban an address
- Check that security updates install themselves with unattended-upgrades
- Scan a folder with ClamAV and quarantine a test file
- Evaluate each tool: what it stops, what it does not — and why "I have a firewall, I am safe" is a trap
The rule
You scan and test only your own VMs. Never the school network, never a classmate's machine without asking, never a website. Scanning a machine that is not yours without permission can be a crime.
The before picture: nmap¶
The server is an office building; each port is a door. To see which doors open, knock on all of them.
A port scanner is a program that tries the ports of a machine and reports which ones answer. nmap is the classic one.
On deb-lab (it plays the outsider), install nmap and scan your server. On ubu-srv, start the other installs meanwhile:
sudo apt update && sudo apt install -y fail2ban clamav lynis # on ubu-srv
sudo apt install -y nmap && nmap 192.168.122.10 # on deb-lab
A typical result, before any firewall:
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
631/tcp open ipp
2049/tcp open nfs
2222/tcp open EtherNetIP-1
8080/tcp open http-proxy
- What is
EtherNetIP-1? Nothing of ours. Without the option-sV, nmap names a port by its number, from a list of common uses. 2222 is Tramuntana Git's SSH door. - Which door is missing? 5432: the database has no
portsline in the compose file, so nobody outside can reach it. - Which doors are for the office only? File sharing (139, 445), NFS (2049, 111) and printing (631).
The doorman: a host firewall¶
A host firewall is a doorman with a list, standing inside the server itself. A network firewall stands at the street gate, on the router.
There are two ways to write the doorman's list: "everybody enters except..." or "nobody enters except...". Only the second is safe, because whatever you forgot stays closed. That is deny by default.
ufw (Uncomplicated Firewall) is Ubuntu's simple front end to the Linux kernel's packet filter.
sudo ufw default deny incoming # nobody enters...
sudo ufw default allow outgoing # ...the server itself may go out
sudo ufw allow OpenSSH # ...except SSH (22/tcp) -- BEFORE enabling!
sudo ufw allow from 192.168.122.0/24 to any app Samba
sudo ufw allow from 192.168.122.0/24 to any port 2049 proto tcp comment 'NFS'
sudo ufw allow from 192.168.122.0/24 to any port 631 proto tcp comment 'printing'
sudo ufw allow 8080/tcp comment 'Tramuntana Git web'
sudo ufw allow 2222/tcp comment 'Tramuntana Git ssh'
sudo ufw enable
sudo ufw status verbose
from 192.168.122.0/24 means "only from our LAN": file sharing, NFS and printing are for the office, not for the world. app Samba uses a profile, a named set of ports that comes with the Samba package (sudo ufw app list shows them).
Allow SSH before you enable
Enable a deny-by-default firewall without the OpenSSH line while you are connected by SSH, and you lock yourself out. In a VM you still have the virt-manager console. In a datacentre you have a long drive.
The result (IPv6 lines left out):
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
To Action From
-- ------ ----
22/tcp (OpenSSH) ALLOW IN Anywhere
137,138/udp (Samba) ALLOW IN 192.168.122.0/24
139,445/tcp (Samba) ALLOW IN 192.168.122.0/24
2049/tcp ALLOW IN 192.168.122.0/24 # NFS
631/tcp ALLOW IN 192.168.122.0/24 # printing
8080/tcp ALLOW IN Anywhere # Tramuntana Git web
2222/tcp ALLOW IN Anywhere # Tramuntana Git ssh
Then check from deb-lab that the office still works: ssh srv, ls /mnt/projects and curl -I http://192.168.122.10:8080. A wrong rule? sudo ufw status numbered, then sudo ufw delete N.
Careful: the firewall does not protect the allowed ports
Port 22 stays open. A firewall decides who may knock, not what happens after the door opens. That is why there are more guards.
Containers and ufw
Rootless Podman listens like any other program, so ufw filters ports 8080 and 2222. With Docker it would not: Docker publishes ports with its own rules, in front of ufw. Either way, the best protection is in the compose file: the database has no ports line at all.
Three more guards¶
| Tool | In the building | What it really does |
|---|---|---|
| fail2ban | The doorman remembers faces: three wrong keys and you wait outside for 15 minutes | Reads the logs; after maxretry failures within findtime, adds a firewall rule against that IP for bantime |
| unattended-upgrades | A locksmith who comes every night and fixes broken locks | Installs security updates automatically |
| ClamAV | A bag check with a book of photos of wanted people | Compares files with signatures of known malware |
| lynis | An inspector with a checklist | Audits the system and gives suggestions and a score. It fixes nothing |
A signature is a fingerprint of a known piece of malware: a pattern an antivirus looks for in each file.
fail2ban¶
Create /etc/fail2ban/jail.local with sudo nano:
A jail is one set of rules for one service: which log to read, how many failures, how long the ban lasts. On Ubuntu the sshd jail is already on after the install; this file only changes the numbers.
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd banip ADDRESS-OF-DEB-LAB # then try ssh from deb-lab
sudo fail2ban-client set sshd unbanip ADDRESS-OF-DEB-LAB # and try again
After the manual ban, the end of the status shows:
From deb-lab, ssh now fails; after unbanip it works again. Why ban by hand? Password login has been off since SSH remote access, so there are few "wrong passwords" to count — and fail2ban never bans the machine it runs on.
Updates by themselves¶
Both lines of the file must end in "1": check the package lists daily, and install the upgrades. The dry run lists the allowed origins, the repositories it will take updates from; one of them must end in -security. That is the 59 days of WannaCry, closed every night.
ClamAV¶
The EICAR test file is a harmless 68-character text that every antivirus agrees to detect, made exactly for this kind of test.
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > ~/eicar.com
sudo cp ~/eicar.com /srv/samba/dev/
sudo clamscan -r /srv/samba
sudo mkdir -p /root/quarantine && sudo clamscan -r --move=/root/quarantine /srv/samba
With --move the file leaves the share and lands in /root/quarantine. "Linux has no viruses, so ClamAV is useless"? A file server passes files between Windows PCs: the scan protects them more than the server.
Memory
clamscan loads millions of signatures and needs more than 1 GB of RAM while it does. On a 2 GB server, stop Tramuntana Git during the scan (cd ~/app && podman compose down, then up -d).
The after picture and the verdict¶
Scan again from deb-lab, then let lynis inspect the server:
Only the allowed ports answer; the others now show as filtered (no answer at all) instead of closed. lynis ends with a hardening index: a clean Ubuntu 26.04 test system scored 62, with 1 warning and 47 suggestions. Yours will differ. Pick two suggestions and decide whether they are worth it for Tramuntana.
Evaluating a tool means saying what it is for and what it leaves open:
| Tool | Stops | Does not stop |
|---|---|---|
| ufw | Access to services that should not be public | Attacks through an allowed port; a user with a valid key |
| fail2ban | Password guessing, noisy bots | A stolen key or password used at the first try |
| Automatic updates | Known holes with a published fix | Unknown holes; bad configuration; a bad update |
| ClamAV | Known malware in shared files | New malware; anything that is not a file |
| nmap, lynis | Nothing: they show you the state | — |
That is defence in depth in practice: no single guard covers everything, so you put several in a row.
Is the office server finished?¶
The Tramuntana office server is finished when every line of the project checklist (the second button above) has a tick you can prove. A tick means: I ran the check and saw the result today — not "it worked two weeks ago". You added a firewall today; something that worked yesterday may not work now.
How to use it:
- Run all the checks first, ticks and crosses, before repairing anything.
- Repair the crosses, worst first, starting from the status and the logs.
- Ask a classmate to run the outside checks from your
deb-lab, and sign. - Write today's entry in
~/server-log.mdand take a snapshot.
| Symptom | First check |
|---|---|
| A share that used to work is denied | Is it the firewall? sudo ufw status. Then testparm -s, then the folder's group and mode (ls -ld) |
Tramuntana Git answers on the server but not from deb-lab |
Port 8080 is not allowed in ufw |
| Tramuntana Git does not start | cd ~/app && podman compose logs server |
ssh srv asks for a password, or refuses |
ssh -v srv from the client; on the server sudo sshd -T (look for passwordauthentication) and the permissions of ~/.ssh (700) and authorized_keys (600) |
win11 cannot sign in to the domain |
Is dc1 running? Is the client's DNS 192.168.122.20? |
Careful: it works on the server, so it works?
A network service is checked from another machine, as the user it is meant for. curl localhost proves the program runs; it does not prove marta can reach it.
Key takeaways¶
- nmap shows which doors of a server answer. Scan only your own machines.
- A host firewall like ufw should deny by default and allow only what the server offers; allow SSH before you enable it.
- A firewall decides who may knock; it does nothing about what comes through an allowed port.
- fail2ban reads the logs and bans an IP after too many failures in a jail; unattended-upgrades installs security fixes by itself; ClamAV finds known malware by its signatures.
- lynis and nmap fix nothing: they show you the state. Evaluating a tool means naming what it stops and what it does not.
- A server is finished when every check passes today, run from another machine.
Quick check¶
1. You enable ufw with deny incoming and forget to allow SSH while connected by SSH. What happens?
- You are locked out of the server
- Nothing changes until the next reboot
- ufw refuses to start without an SSH rule
- Only password logins stop working
Deny by default closes every door you did not open, including the one you are using. Always run sudo ufw allow OpenSSH before sudo ufw enable.
2. What does fail2ban read to decide a ban?
- The logs of failed logins
- The files stored in the shares
- The list of open ports
- The list of pending updates
fail2ban reads the logs; after maxretry failures within findtime, it adds a firewall rule against that IP for bantime.
3. How does ClamAV find malware?
- It compares files with signatures of known malware
- It closes the ports that malware uses
- It counts the failed logins of each user
- It asks the user whether each file is safe
ClamAV looks for signatures, fingerprints of known malware. That is why it detects the EICAR test file — and why it cannot detect malware nobody has seen yet.
4. After all your work, nmap still shows port 22 as open. Is that a mistake?
- No, the server offers SSH and keys protect that door
- Yes, a firewall must close every port of a server
- Yes, fail2ban should have closed it after the install
- No, because nmap cannot see through ufw
The server offers SSH, so its door must stay open. The firewall decides who may knock; SSH keys and fail2ban protect what happens next.
5. After the firewall, nmap shows the ports you did not allow as filtered instead of closed. What does that mean?
- The firewall drops the knocks, so those ports give no answer at all
- The services behind those ports have crashed
- nmap needs the option -sV to see those ports
- Those ports are open but only for the LAN
filtered means no answer came back: the doorman ignores the knock. closed means the machine answered "nobody here". Both keep the service unreachable.
6. Tramuntana Git answers with curl on the server itself but not from deb-lab. What do you suspect first?
- The firewall has no rule for port 8080
- The database volume has been deleted
- marta's SSH key is wrong
- The domain controller is switched off
If the program answers locally, it runs. If it fails from another machine, the problem is on the way in: first check sudo ufw status for port 8080.
7. Select the two statements that evaluate the tools correctly.
- Automatic updates close known holes but not unknown ones
- fail2ban slows password guessing but not a stolen key used at the first try
- ufw also blocks attacks that come through an allowed port
- lynis fixes the problems it finds in its audit
Every tool has limits: updates only fix holes with a published fix, fail2ban only counts failures. ufw cannot inspect what enters an allowed port, and lynis only gives suggestions.
The office server is built, shared, joined and guarded. Now it needs a manual that someone else could follow — and that starts with knowing what kinds of software exist. Next unit: Software by licence and purpose.