Three Layers of Security: My Journey with UFW, Fail2Ban, and Logwatch
Strengthening an Existing SIEM Environment with UFW, Fail2Ban, and Logwatch 1.1 "Teaser" Overview For this project, I wanted to improve the security of an existing Ubuntu server and strengthen how our Wazuh SIEM monitored security activity. My goal was to add three security tools and observe how they worked together. First, I configured UFW to control incoming network traffic and block unwanted…
In this project, I aimed to enhance the security of an existing Ubuntu server by incorporating three security tools and observing their interactions. The first tool, UFW (Uncomplicated Firewall), was configured to regulate incoming network traffic and block unwanted connections. I allowed SSH traffic while blocking port 8088, verifying its effectiveness using Nmap scans and firewall logs.
The second tool, Fail2Ban, was installed to automatically ban IP addresses after repeated failed SSH login attempts, which was tested by attempting multiple incorrect logins from Kali Linux. Finally, Logwatch was added to organize system logs into readable reports, making it simpler to review suspicious activity. Throughout the project, I tested each tool's interaction with the existing environment, learning that different security tools respond to various threats and that multiple tests are necessary to accurately evaluate their effectiveness.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
