JL_ / / ENGINEER

Local Two-Bot Security Analysis Lab

This lab functions as a local defensive security analyst and independent reviewer for Debian. It collects system evidence, removes obvious secrets, analyzes the environment with Agent A, challenges the analysis with Agent B, and writes a structured report for human approval.

Its primary purpose is to provide a repeatable defensive security review process for services, network exposure, system configuration, permissions, packages, resource usage, and operational failures. Its most useful purpose is to support safer, repeatable, evidence-based server hardening without allowing the AI system to make unreviewed changes unless you program it to do so.

Reverse Proxy Server

This site uses a reverse proxy that supports PQC (Post-Quantum Cryptography) key exchange

Read more

• Hides the origin IP address: Proxied DNS records return proxy network IP addresses to visitors rather than your web server’s address. This makes it harder for attackers to bypass the proxy.
• DDoS protection: Traffic is absorbed and filtered across the proxy network before reaching your server.
• Web Application Firewall: HTTP requests can be inspected and common attacks such as SQL injection, cross-site scripting, malicious bots, and exploit attempts can be blocked.
• Caching and reduced server load: Static content can be served from edge locations, reducing bandwidth and CPU usage on the origin server.
• TLS handling: Public HTTPS certificates can be provided while maintaining a separate encrypted connection to your origin server.
• Rate limiting and bot controls: Abusive clients, login attempts, scraping, and suspicious traffic can be restricted before reaching the web server.
• Performance features: Compression, HTTP/2 or HTTP/3, image optimization, and global edge delivery can improve page-load times.
• Origin resilience: Traffic spikes can be absorbed, and load balancing or failover configurations can be supported.

Suricata Lab

Using Suricata as an IPS and IDS

Read more

• Cost-effective security: Provides enterprise-style firewall and monitoring features without requiring an expensive proprietary appliance.
• Intrusion detection: Identifies suspicious traffic, exploit attempts, malware communication, network scans, and policy violations.
• Intrusion prevention: Can actively block traffic that matches malicious rules when deployed in IPS mode.
• Deep packet inspection: Examines network traffic beyond basic source, destination, and port filtering.
• Threat signatures: Uses rule sets to detect known attacks and suspicious traffic patterns.
• Protocol awareness: Supports inspection of protocols such as HTTP, TLS, DNS, SMB, SSH, and others.
• Detailed event logging: Generates alerts and metadata that are useful for investigation and incident response.
• Network-wide visibility: Protects multiple internal devices at the network gateway without requiring a security agent on every endpoint.
• Flexible monitoring modes: Allows you to begin with IDS alerting and later enable IPS blocking after reviewing alerts and tuning the rules.
• Practical deployment considerations: Requires adequate CPU and memory. Encrypted traffic may limit inspection, while poorly tuned rules can generate false positives or reduce network throughput.