ILLUSTRATIVE TERMINAL DEMO — NOT LIVE SYSTEM DATA anthony@secure-server:~$ nmap -sV --script vuln 192.168.1.0/24
Starting Nmap 7.94 ( https://nmap.org ) at 2025-12-10 09:14 CST
Discovered open port 22/tcp on 192.168.1.1
Discovered open port 443/tcp on 192.168.1.1
Discovered open port 80/tcp on 192.168.1.5
Nmap scan report for 192.168.1.0/24
Host is up (0.0012s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1
443/tcp open ssl/http nginx 1.24.0
80/tcp open http nginx 1.24.0
Discovered 47 hosts up in 3.24 seconds
anthony@secure-server:~$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 3
| |- Total failed: 1,293
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 23
|- Total banned: 1,847
`- Banned IP list: 103.41.124.xx 185.224.xx.xx 45.227.xx.xx ...
anthony@secure-server:~$ sudo ufw status numbered
Status: active
To Action From
-- ------ ----
[ 1] 22/tcp ALLOW IN 10.0.0.0/8
[ 2] 443/tcp ALLOW IN Anywhere
[ 3] 80/tcp ALLOW IN Anywhere
[ 4] 51820/udp ALLOW IN Anywhere
anthony@secure-server:~$ wireguard-tools show wg0
interface: wg0
public key: aB3dEf7GhI9jKlMnOpQrStUvWxYz...
private key: (hidden)
listening port: 51820
peer: xY9zAbCdEfGhIjKlMnOpQrStUvWx...
endpoint: 73.162.xxx.xxx:51820
allowed ips: 10.0.0.2/32
latest handshake: 47 seconds ago
transfer: 2.34 GiB received, 847.23 MiB sent
anthony@secure-server:~$ certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: anthonybahn.com
Domains: anthonybahn.com www.anthonybahn.com
Expiry Date: 2025-03-10 04:23:17+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/anthonybahn.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
anthony@secure-server:~$ docker ps
NAMES STATUS PORTS
nginx-proxy Up 47 days 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp
n8n Up 47 days 127.0.0.1:5678->5678/tcp
redis-cache Up 47 days 6379/tcp
anthony@secure-server:~$ sudo lynis audit system --quick
[ Lynis 3.0.9 ]
################################################################################
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License.
################################################################################
* System hardening index: [84/100]
* Tests performed: 247
* Plugins enabled: 2
* Warnings: 3
* Suggestions: 12
anthony@secure-server:~$ systemctl status crowdsec --no-pager
● crowdsec.service - CrowdSec Agent
Loaded: loaded (/lib/systemd/system/crowdsec.service; enabled)
Active: active (running) since Mon 2025-10-24 08:45:12 CST; 47 days ago
Main PID: 1234 (crowdsec)
Tasks: 12 (limit: 4915)
Memory: 124.5M
CPU: 2h 34min 12.847s
CGroup: /system.slice/crowdsec.service
└─1234 /usr/bin/crowdsec -c /etc/crowdsec/config.yaml
Dec 10 09:14:52 secure-server crowdsec[1234]: Blocked 847 threats today
anthony@secure-server:~$ sudo aide --check
AIDE 0.18.6 found NO differences between database and filesystem.
Checked 142,847 entries.
Number of files: 89,234
Number of directories: 12,847
Total size of files: 45.2 GiB
anthony@secure-server:~$ speedtest-cli --simple
Ping: 12.34 ms
Download: 487.23 Mbit/s
Upload: 238.91 Mbit/s
anthony@secure-server:~$ htop --no-color
CPU[|||||||||||| 28.4%] Tasks: 142, 847 thr; 2 running
Mem[|||||||||||||||||||||| 4.23G/16.0G] Load average: 0.12 0.08 0.05
Swp[ 0K/2.00G] Uptime: 47 days, 03:22:47
PID USER PRI NI VIRT RES SHR S CPU% MEM% TIME+ Command
1234 root 20 0 847M 124M 12.3M S 2.1 0.8 2h34:12 crowdsec
2345 www-data 20 0 234M 89M 8.2M S 1.2 0.6 1h12:34 nginx
3456 node 20 0 1.2G 234M 34.2M S 0.8 1.5 12h34:56 node n8n
anthony@secure-server:~$ tail -f /var/log/auth.log | grep -E "(Accepted|Failed)"
Dec 10 09:14:31 secure-server sshd[12345]: Failed password for invalid user admin from 185.224.xx.xx
Dec 10 09:14:32 secure-server sshd[12346]: Failed password for invalid user root from 45.227.xx.xx
Dec 10 09:14:33 secure-server sshd[12347]: Accepted publickey for anthony from 10.0.0.5 port 52847
Dec 10 09:14:35 secure-server sshd[12348]: Failed password for invalid user test from 103.41.xx.xx
Dec 10 09:14:36 secure-server sshd[12349]: Failed password for invalid user ubuntu from 185.224.xx.xx
anthony@secure-server:~$ kubectl get pods -A --no-headers | head -10
default web-app-7b9f8c6d5-x2h4j 1/1 Running 0 12d
default api-server-5c8f7d6e4-k9m2 1/1 Running 0 12d
monitoring prometheus-6d7f8e9c2-j3k4 1/1 Running 0 47d
monitoring grafana-4e5f6d7c8-m2n3 1/1 Running 0 47d
kube-system coredns-5d78c9869-h7g2f 1/1 Running 0 89d
anthony@secure-server:~$ trivy image nginx:latest --severity HIGH,CRITICAL
nginx:latest (debian 12.2)
============================
Total: 2 (HIGH: 2, CRITICAL: 0)
┌───────────────┬────────────────┬──────────┬─────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Title │
├───────────────┼────────────────┼──────────┼─────────────────────────────────┤
│ libssl3 │ DEMO-ISSUE-001 │ HIGH │ illustrative package finding │
│ libcrypto3 │ DEMO-ISSUE-002 │ HIGH │ illustrative package finding │
└───────────────┴────────────────┴──────────┴─────────────────────────────────┘
anthony@secure-server:~$ git log --oneline -5
a3b2c1d (HEAD -> main) Update security hardening guide
f4e5d6c Add NordVPN review article
7g8h9i0 Fix mobile navigation responsive issues
j1k2l3m Optimize hero images for performance
n4o5p6q Add new glossary terms for zero-day
anthony@secure-server:~$ npm audit --audit-level=moderate
found 0 vulnerabilities in 847 scanned packages
anthony@secure-server:~$ uptime
09:15:03 up 47 days, 3:22, 1 user, load average: 0.12, 0.08, 0.05
anthony@secure-server:~$ _
anthony@secure-server:~$ nmap -sV --script vuln 192.168.1.0/24
Starting Nmap 7.94 ( https://nmap.org ) at 2025-12-10 09:14 CST
Discovered open port 22/tcp on 192.168.1.1
Discovered open port 443/tcp on 192.168.1.1
Discovered open port 80/tcp on 192.168.1.5
Nmap scan report for 192.168.1.0/24
Host is up (0.0012s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1
443/tcp open ssl/http nginx 1.24.0
80/tcp open http nginx 1.24.0
Discovered 47 hosts up in 3.24 seconds
anthony@secure-server:~$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 3
| |- Total failed: 1,293
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 23
|- Total banned: 1,847
`- Banned IP list: 103.41.124.xx 185.224.xx.xx 45.227.xx.xx ...
anthony@secure-server:~$ sudo ufw status numbered
Status: active
To Action From
-- ------ ----
[ 1] 22/tcp ALLOW IN 10.0.0.0/8
[ 2] 443/tcp ALLOW IN Anywhere
[ 3] 80/tcp ALLOW IN Anywhere
[ 4] 51820/udp ALLOW IN Anywhere
anthony@secure-server:~$ wireguard-tools show wg0
interface: wg0
public key: aB3dEf7GhI9jKlMnOpQrStUvWxYz...
private key: (hidden)
listening port: 51820
peer: xY9zAbCdEfGhIjKlMnOpQrStUvWx...
endpoint: 73.162.xxx.xxx:51820
allowed ips: 10.0.0.2/32
latest handshake: 47 seconds ago
transfer: 2.34 GiB received, 847.23 MiB sent
anthony@secure-server:~$ certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: anthonybahn.com
Domains: anthonybahn.com www.anthonybahn.com
Expiry Date: 2025-03-10 04:23:17+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/anthonybahn.com/fullchain.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
anthony@secure-server:~$ docker ps
NAMES STATUS PORTS
nginx-proxy Up 47 days 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp
n8n Up 47 days 127.0.0.1:5678->5678/tcp
redis-cache Up 47 days 6379/tcp
anthony@secure-server:~$ sudo lynis audit system --quick
[ Lynis 3.0.9 ]
################################################################################
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License.
################################################################################
* System hardening index: [84/100]
* Tests performed: 247
* Plugins enabled: 2
* Warnings: 3
* Suggestions: 12
anthony@secure-server:~$ systemctl status crowdsec --no-pager
● crowdsec.service - CrowdSec Agent
Loaded: loaded (/lib/systemd/system/crowdsec.service; enabled)
Active: active (running) since Mon 2025-10-24 08:45:12 CST; 47 days ago
Main PID: 1234 (crowdsec)
Tasks: 12 (limit: 4915)
Memory: 124.5M
CPU: 2h 34min 12.847s
CGroup: /system.slice/crowdsec.service
└─1234 /usr/bin/crowdsec -c /etc/crowdsec/config.yaml
Dec 10 09:14:52 secure-server crowdsec[1234]: Blocked 847 threats today
anthony@secure-server:~$ sudo aide --check
AIDE 0.18.6 found NO differences between database and filesystem.
Checked 142,847 entries.
Number of files: 89,234
Number of directories: 12,847
Total size of files: 45.2 GiB
anthony@secure-server:~$ speedtest-cli --simple
Ping: 12.34 ms
Download: 487.23 Mbit/s
Upload: 238.91 Mbit/s
anthony@secure-server:~$ htop --no-color
CPU[|||||||||||| 28.4%] Tasks: 142, 847 thr; 2 running
Mem[|||||||||||||||||||||| 4.23G/16.0G] Load average: 0.12 0.08 0.05
Swp[ 0K/2.00G] Uptime: 47 days, 03:22:47
PID USER PRI NI VIRT RES SHR S CPU% MEM% TIME+ Command
1234 root 20 0 847M 124M 12.3M S 2.1 0.8 2h34:12 crowdsec
2345 www-data 20 0 234M 89M 8.2M S 1.2 0.6 1h12:34 nginx
3456 node 20 0 1.2G 234M 34.2M S 0.8 1.5 12h34:56 node n8n
anthony@secure-server:~$ tail -f /var/log/auth.log | grep -E "(Accepted|Failed)"
Dec 10 09:14:31 secure-server sshd[12345]: Failed password for invalid user admin from 185.224.xx.xx
Dec 10 09:14:32 secure-server sshd[12346]: Failed password for invalid user root from 45.227.xx.xx
Dec 10 09:14:33 secure-server sshd[12347]: Accepted publickey for anthony from 10.0.0.5 port 52847
Dec 10 09:14:35 secure-server sshd[12348]: Failed password for invalid user test from 103.41.xx.xx
Dec 10 09:14:36 secure-server sshd[12349]: Failed password for invalid user ubuntu from 185.224.xx.xx
anthony@secure-server:~$ kubectl get pods -A --no-headers | head -10
default web-app-7b9f8c6d5-x2h4j 1/1 Running 0 12d
default api-server-5c8f7d6e4-k9m2 1/1 Running 0 12d
monitoring prometheus-6d7f8e9c2-j3k4 1/1 Running 0 47d
monitoring grafana-4e5f6d7c8-m2n3 1/1 Running 0 47d
kube-system coredns-5d78c9869-h7g2f 1/1 Running 0 89d
anthony@secure-server:~$ trivy image nginx:latest --severity HIGH,CRITICAL
nginx:latest (debian 12.2)
============================
Total: 2 (HIGH: 2, CRITICAL: 0)
┌───────────────┬────────────────┬──────────┬─────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Title │
├───────────────┼────────────────┼──────────┼─────────────────────────────────┤
│ libssl3 │ DEMO-ISSUE-001 │ HIGH │ illustrative package finding │
│ libcrypto3 │ DEMO-ISSUE-002 │ HIGH │ illustrative package finding │
└───────────────┴────────────────┴──────────┴─────────────────────────────────┘
anthony@secure-server:~$ git log --oneline -5
a3b2c1d (HEAD -> main) Update security hardening guide
f4e5d6c Add NordVPN review article
7g8h9i0 Fix mobile navigation responsive issues
j1k2l3m Optimize hero images for performance
n4o5p6q Add new glossary terms for zero-day
anthony@secure-server:~$ npm audit --audit-level=moderate
found 0 vulnerabilities in 847 scanned packages
anthony@secure-server:~$ uptime
09:15:03 up 47 days, 3:22, 1 user, load average: 0.12, 0.08, 0.05
anthony@secure-server:~$ _
