Skip to content

Commit d0d7275

Browse files
fidpafidpa
committed
v1.0.0
1 parent 3bdb69f commit d0d7275

File tree

9 files changed

+1986
-5
lines changed

9 files changed

+1986
-5
lines changed

‎README.md‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
Production-ready security configurations for Ubuntu servers.
88

9-
**The Problem**: Security tools are powerful but complex to configure. Default settings generate noise, integrations are missing, and credentials are stored in plaintext. After weeks of hardening production servers to 100% CIS Benchmark compliance, I've extracted 12 battle-tested security components.
9+
**The Problem**: Security tools are powerful but complex to configure. Default settings generate noise, integrations are missing, and credentials are stored in plaintext. After weeks of hardening production servers to 100% CIS Benchmark compliance, I've extracted 13 battle-tested security components.
1010

1111
## Components
1212

@@ -23,11 +23,12 @@ Production-ready security configurations for Ubuntu servers.
2323
| **[apparmor/](apparmor/)** | Mandatory Access Control profiles (PostgreSQL, Docker) |
2424
| **[vaultwarden/](vaultwarden/)** | Credential management via Bitwarden CLI (no plaintext secrets) |
2525
| **[fail2ban/](fail2ban/)** | Brute-force protection (GeoIP filtering, Telegram alerts) |
26+
| **[security-monitoring/](security-monitoring/)** | Unified security event monitoring with smart deduplication |
2627
| **[lynis/](lynis/)** | Security auditing & hardening recommendations (CIS compliance) |
2728

2829
## Features
2930

30-
- ✅ **Defense-in-Depth** - 12 complementary security layers (boot → network → detection → logging → audit)
31+
- ✅ **Defense-in-Depth** - 13 complementary security layers (boot → network → detection → logging → audit → monitoring)
3132
- ✅ **CIS Benchmark Compliance** - 40+ controls across all components
3233
- ✅ **Drop-in Configuration Pattern** - Modular configs for all components
3334
- ✅ **Docker-Compatible** - All hardening tested with containerized workloads
@@ -92,10 +93,11 @@ sudo rkhunter --propupd
9293
| **Kernel** | kernel-hardening | Harden kernel parameters, /tmp isolation |
9394
| **Network** | ssh-hardening | Secure remote access |
9495
| **Firewall** | ufw / nftables | Control network traffic |
95-
| **Detection** | aide, rkhunter | Detect intrusions and rootkits |
96+
| **Detection** | aide, rkhunter, fail2ban | Detect intrusions and rootkits |
9697
| **Logging** | auditd | Kernel-level event logging |
9798
| **Access Control** | apparmor | Mandatory Access Control |
9899
| **Credentials** | vaultwarden | Eliminate plaintext secrets |
100+
| **Monitoring** | security-monitoring | Unified security event monitoring |
99101
| **Audit** | lynis | Comprehensive security auditing |
100102

101103
### Firewall Selection Guide
@@ -108,16 +110,18 @@ sudo rkhunter --propupd
108110
| Docker host (simple) | **UFW** | With Docker-aware patterns |
109111
| Docker host (advanced) | **nftables** | Chain preservation, custom rules |
110112

111-
### Detection Components
113+
### Detection & Monitoring Components
112114

113115
| Component | Method | Best For |
114116
|-----------|--------|----------|
115117
| **AIDE** | Integrity-based | Detecting file changes |
116118
| **rkhunter** | Signature-based | Detecting known rootkits |
117119
| **auditd** | Event-based | Real-time "who did what when" |
120+
| **fail2ban** | Pattern-based | Blocking brute-force attacks |
121+
| **security-monitoring** | Aggregation-based | Unified event monitoring with smart deduplication |
118122
| **Lynis** | Audit-based | Comprehensive security posture assessment |
119123

120-
**Recommendation**: Use all four for defense-in-depth.
124+
**Recommendation**: Use all six for defense-in-depth.
121125

122126
## Key Concepts
123127

‎security-monitoring/README.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Security Monitoring
2+
3+
Unified security event monitoring with smart deduplication and aggregated Telegram alerts.
4+
5+
## Features
6+
7+
- ✅ **Multi-Tool Monitoring** - fail2ban, SSH, UFW, auditd, AIDE, rkhunter in one script
8+
- ✅ **Smart Deduplication** - Alert only on new events (state-based)
9+
- ✅ **Aggregated Alerts** - Single Telegram message per run
10+
- ✅ **Configurable Thresholds** - Customize when to alert
11+
- ✅ **15-Minute Interval** - Real-time security awareness
12+
- ✅ **Production-Ready** - Built on bash-production-toolkit
13+
14+
## Quick Start
15+
16+
```bash
17+
# 1. Install bash-production-toolkit (if not already installed)
18+
git clone https://github.com/fidpa/bash-production-toolkit.git
19+
cd bash-production-toolkit
20+
sudo make install
21+
22+
# 2. Deploy security-log-monitor script
23+
sudo cp security-monitoring/scripts/security-log-monitor.sh /usr/local/bin/
24+
sudo chmod +x /usr/local/bin/security-log-monitor.sh
25+
26+
# 3. Configure Telegram credentials
27+
sudo nano /etc/default/security-log-monitor
28+
# Add: TELEGRAM_BOT_TOKEN="your-token"
29+
# TELEGRAM_CHAT_ID="your-chat-id"
30+
31+
# 4. Deploy systemd units
32+
sudo cp security-monitoring/systemd/security-log-monitor.* /etc/systemd/system/
33+
sudo systemctl daemon-reload
34+
35+
# 5. Enable timer
36+
sudo systemctl enable --now security-log-monitor.timer
37+
38+
# 6. Verify
39+
sudo systemctl status security-log-monitor.timer
40+
```
41+
42+
**Full guide**: See [docs/SETUP.md](docs/SETUP.md)
43+
44+
## Documentation
45+
46+
| Document | Description |
47+
|----------|-------------|
48+
| [SETUP.md](docs/SETUP.md) | Installation, configuration, systemd setup |
49+
| [CONFIGURATION.md](docs/CONFIGURATION.md) | Environment variables, thresholds, state management |
50+
| [TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) | Common issues and debugging |
51+
52+
## Requirements
53+
54+
- Ubuntu 22.04+ / Debian 11+
55+
- systemd (for timer automation)
56+
- Root/sudo access
57+
- bash-production-toolkit (logging, alerts, secure file utils)
58+
- Optional: ausearch (auditd), aide, rkhunter
59+
60+
## Use Cases
61+
62+
- ✅ **Security Operations Center** - Centralized security event monitoring
63+
- ✅ **Compliance** - Track security events for audit trails
64+
- ✅ **DevOps** - Real-time security awareness for development servers
65+
- ✅ **Production Servers** - Automated intrusion detection and alerting
66+
- ✅ **Multi-Server Environments** - Deploy to multiple hosts with consistent monitoring
67+
68+
## Monitored Components
69+
70+
| Component | Events Monitored | Alert Trigger |
71+
|-----------|------------------|---------------|
72+
| **fail2ban** | Ban/Unban events | Any new ban |
73+
| **SSH** | Failed login attempts | >5 failures + new IPs |
74+
| **UFW** | Blocked external IPs | >10 blocks from same IP |
75+
| **auditd** | Security policy violations | Any new denied event |
76+
| **AIDE** | File integrity changes | Exit code ≥1 |
77+
| **rkhunter** | Rootkit detection | Any warnings |
78+
79+
## How It Works
80+
81+
1. **Check Phase**: Script queries journalctl for events in last 15 minutes
82+
2. **Deduplication**: Compare current events with saved state
83+
3. **Aggregation**: Collect all new events into single message
84+
4. **Alerting**: Send Telegram notification with rate limiting (30min)
85+
5. **State Persistence**: Save current state for next run
86+
87+
**Why Deduplication?** Prevents alert fatigue by only notifying on new events, not recurring ones.
88+
89+
---
90+
91+
**See also**:
92+
- [bash-production-toolkit](https://github.com/fidpa/bash-production-toolkit) - Required dependency
93+
- [ubuntu-server-security](https://github.com/fidpa/ubuntu-server-security) - Full hardening suite

0 commit comments

Comments
 (0)