Mark Malinowski Contact
← Home

[ Updates ]

Updates and activity

This is what is new: progress on my home lab, new writing, and other activity, newest first. Each entry links to its project and to the change on GitHub.

[ Home lab score ]OpenSCAP score for the Ubuntu 24.04 server, in the order I posted the work. Each point links to its entry.
OpenSCAP score over time A line chart. The score rises from 51.38 percent on Oct 18 to 60.03 and 61.22 percent on Oct 20, 62.02 on Oct 21, 68.60 in late October, 68.73 on Nov 2, and 75.3 percent on Nov 3. 50%60%70%80% 51.38Oct1860.03Oct2061.22Oct2062.02Oct2168.60LateOct68.73Nov275.3Nov3
  1. [ Lab ]

    Three scans in one evening, ending at 75.3%

    What I did
    I fixed rules in three batches and rescanned after each one.
    • About 5:07 PM68.74%Every SSH rule passes, after adding audit rules for ssh-agent and ssh-keysign.
    • About 5:34 PM72.15%59 audit rules for privileged commands, file watches and system calls.
    • About 5:54 PM75.3%Stronger passwords, password age, private-by-default new files, a cap of 10 logins at once, and audit disk-space alerts.
    Result
    178 of 214 rules now pass.
    Lesson
    Settings affect each other. Changing the audit log group required tighter folder permissions, and the strict file default blocked copying root-owned reports until their owner was changed.
    • auditd
    • PAM
    • login.defs
    • OpenSCAP
    • Git

    [ Skills shown ] Systems and hardening, Identity and access

    See the project cardView the merged change on GitHub

  2. [ Lab ]

    SSH encryption settings fully hardened

    What I did
    I turned root login off and limited SSH to approved ciphers, message authentication codes and key exchange methods.
    Result
    The score is 68.73%.
    Lesson
    The scanner expects its own exact ordered lists, not the ones in a rule’s description.
    • OpenSSH
    • OpenSCAP

    [ Skills shown ] Systems and hardening

    See the project cardOpen the repo on GitHub

  3. [ Writing ]

    A Navy heritage essay is now in Writing

    The On-the-Roof Gang were radiomen trained on a Washington rooftop starting in 1928. My essay covers their background and why it still matters to enlisted leaders today.

    Read the essaySee the project

  5. [ Lab ]

    Fixes 12 to 16: SSH sessions, kernel, firewall, time and logs

    What I did
    I hardened SSH sessions (timeouts, no empty passwords, X11 forwarding off), tightened kernel settings, turned on the ufw firewall with rate limiting, set up chrony time sync, and tightened log permissions.
    Result
    The score went from 62.02% to 68.60%.
    Lesson
    A command that discarded all of its output hid a wrong file path. Now I discard normal output only and let errors show.
    • ufw
    • sysctl
    • chrony
    • journald
    • OpenSSH

    [ Skills shown ] Systems and hardening

    See the project cardView the commit on GitHubView the merged write-up on GitHub

  7. [ Lab ]

    Fixes 7 to 10: audit folder permissions and three packages

    What I did
    I tightened permissions on the audit rules folder, and added the password quality, console lock and smart card packages.
    Result
    The score went from 60.03% to 61.22%.
    Lesson
    Package installs carry little weight in the score, so the bigger gains come from high-severity rules.

    [ Skills shown ] Systems and hardening

    See the project cardView the merged write-up on GitHub

  8. [ Lab ]

    First fixes, and the project goes public

    What I did
    Fixes 1 to 6: a login consent banner, Ctrl+Alt+Del reboot off, lock after 3 failed logins, a 10-minute idle timeout, and auditd on. I also published the README, runbook, lab notes and results summary. The raw scan reports stay private because they contain host details.
    Result
    The score went from 51.38% to 60.03%.
    • auditd

    [ Skills shown ] Systems and hardening, Identity and access

    See the project cardView the commit on GitHub

  9. [ Lab ]

    Lab built and first scan

    What I did
    I built a Proxmox home lab with an Ubuntu 24.04 server on an isolated network, with rollback snapshots, then ran a first OpenSCAP scan against the DISA STIG.
    Result
    The score was 51.38%, with 54 of 119 rules passing.
    • Proxmox
    • Ubuntu 24.04
    • OpenSCAP
    • SCAP Security Guide

    [ Skills shown ] Systems and hardening

    See the project cardView the results on GitHub

← Back to home