The Great Silence

Frame Lab / The Dark Forest

The Silent Server

Harden a Linux server until an external scan finds nothing.

A hands-on lab for 02. The Dark Forest.

This lab turns the Dark Forest into a network defence exercise. You will take a normal Linux server, see how much it announces to the internet, then harden it until an external scan finds nothing.

The scenario

The internet is a dark forest. Automated bots, script kiddies and state-sponsored scanners sweep the address space continuously, looking for servers that are foolish enough to broadcast their location.

You are the sysadmin for a civilisation: one Linux web and SSH server. You must keep serving your one known ally, your own laptop, but to the rest of the universe you must not exist.

If a hunter scans your address, they should see nothing. No open ports. No operating system details. No ping response. Absolute silence.

Prerequisites

  • A Linux virtual machine, Ubuntu Server 22.04 recommended. This is your civilisation.
  • A second machine, your laptop or a Kali VM. This is the hunter.
  • nmap installed on the hunter machine.

Phase 1: the loud civilisation

Before applying the Dark Forest protocols, look at what a naive civilisation looks like to a hunter.

  1. On the server, ensure SSH and a web server are running.

    sudo apt update && sudo apt install openssh-server nginx -y
sudo systemctl start ssh nginx

  2. On the hunter machine, run an aggressive scan against the server’s address.

    nmap -A -T4 <SERVER_IP>

  3. Record the findings. Did it find the host? Did it identify the OS? Did it find the service versions? You have just broadcast your coordinates and your technology level. A hunter now knows which vulnerabilities to try.

Phase 2: going dark

Stop the broadcasting

By default, Linux answers ICMP echo requests. That confirms existence. In the Dark Forest, if someone shouts “is anyone there?”, you do not answer.

Edit /etc/ufw/before.rules and find the line:

-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT

Change ACCEPT to DROP. The server will discard pings without sending an unreachable error, which would reveal that something is there.

Move the coordinates

Standard ports are the first place hunters look. Move SSH from port 22 to a high port, for example 49222.

Edit /etc/ssh/sshd_config, change Port 22 to Port 49222, then restart SSH.

sudo systemctl restart ssh

Add the force field

Trust no one. Block all inbound traffic by default and open a wormhole only for your ally.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from <YOUR_LAPTOP_IP> to any port 49222
sudo ufw enable

Phase 3: the hunter’s pass

Now hunt your own server.

  1. Ping it. Expect 100% packet loss. It should look like empty space.

  2. Scan all ports, telling nmap to skip the ping test and try harder.

    nmap -Pn -p 1-65535 -T4 <SERVER_IP>

    Expect all 65535 scanned ports to be filtered.

  3. Test the ally route. SSH from the allowed address on the new port. It should work.

Discussion

  1. You whitelisted one address. Move your laptop to a coffee shop and you are locked out of your own server. What does that tell you about maintaining alliances in a dark forest?
  2. The full scan took much longer than the first one because the server dropped packets instead of rejecting them, forcing nmap to wait for timeouts. How does that relate to wasting a hunter’s energy?
  3. If the server is broken, you will not know, because you disabled ping. How do you monitor a system that is not allowed to speak? This is the observability problem, and it is the next essay.

Advanced challenge

Implement port knocking with knockd. The server stays closed to everyone, including you, until it receives a specific sequence of connection attempts. Only then does the firewall open for a short window.

The metaphor is a coded transmission that reveals the hidden planet only to those who know the frequency.