Server hardening is the art of starting from a system that's accessible by default — so exposed — and turning it into a hard target. This lab tackles it from both ends: first understand how you get in, then understand how you lock it down.
🔓 The intrusion: The power of Rockyou
It all started with the exploitation of a classic flaw: an FTP service wide open to the world. After gathering the first bits of information, the real work was forcing SSH access through a dictionary attack.
Thanks to the Rockyou wordlist, a short and predictable password gave way within seconds. It's a brutal reminder: a simple password, even one that feels personal, doesn't stand up to automated tools.
🧱 The defense plan (Hardening)
The hardening plan directly follows the vectors that were exploited:
Removing unnecessary services: FTP, the intrusion's entry point, is stopped and disabled. Any unjustified service is an attack surface to eliminate.
UFW firewall in deny-by-default: only strictly necessary ports accept inbound traffic — everything else is silently dropped.
Active protection with Fail2ban: To fend off future brute-force attacks, I installed Fail2ban. From now on, every failed attempt gets logged in
/var/log/auth.logand the attacker gets banned after a few tries.
📝 Key takeaways
Security isn't a static state, it's a process. Between wrangling syntax errors in the terminal and the constraints of the lab environment, this day proved that in cybersecurity, persistence matters just as much as technique.