DEV Community

Daniel Ioni
Daniel Ioni

Posted on

🛡️ Building an AI-Powered Security Bot on a VPS with Kali Linux, DeepSeek, and MyZubster

#deepseek #linux #myzubster #bot

How I turned my VPS into an automated security scanning platform with local AI analysis—without sending data to third parties.
🌱 The Vision

When I deployed the MyZubster ecosystem on a VPS (Gateway, Marketplace, Frontend), I knew I needed a robust security solution. Instead of relying on expensive third-party services, I built an autonomous security bot that:

Scans the infrastructure using Kali Linux tools (nmap, nikto, sqlmap, gobuster)

Analyzes results locally with DeepSeek AI (running via Ollama)

Generates detailed reports in JSON format

Runs automatically via cron jobs
Enter fullscreen mode Exit fullscreen mode

This post documents how I turned a standard VPS into a self-defending security platform—all open-source and privacy-first.
🗺️ Roadmap and Priorities
Priority Task Status
🔴 High Install Kali Linux tools ✅ Completed
🔴 High Install Ollama AI ✅ Completed
🟡 Medium Download DeepSeek model ✅ Completed
🟡 Medium Build Security Bot ✅ Completed
🟢 Low Automate with cron ✅ Completed
🛠️ Technology Stack
Component Technology Purpose
OS Ubuntu 24.04 LTS VPS operating system
Security Tools nmap, nikto, sqlmap, gobuster Vulnerability scanning
AI Engine Ollama Local AI model runner
AI Model DeepSeek R1:1.5B Code and security analysis
Programming Python 3 Bot logic and orchestration
Logging Python logging + JSON Structured reports
🔧 Step 1: Install Kali Linux Tools

Kali Linux provides the most comprehensive set of penetration testing tools. While I didn't install the full Kali OS, I installed the essential tools on Ubuntu.
1.1 Install nmap (Network Scanner)
bash

sudo apt update
sudo apt install nmap -y

Verify

nmap --version

Nmap version 7.94SVN

1.2 Install nikto (Web Vulnerability Scanner)
bash

sudo apt install nikto -y

Verify

nikto -Version

Version 2.1.5

1.3 Install sqlmap (SQL Injection Tester)
bash

sudo apt install sqlmap -y

Verify

sqlmap --version

Version 1.8.4

1.4 Install gobuster (Directory Brute Forcer)
bash

sudo apt install gobuster -y

Verify

gobuster version

Version 3.6

1.5 Install Wordlists
bash

Common wordlist for gobuster

sudo apt install wordlists -y
ls /usr/share/wordlists/dirb/common.txt

🤖 Step 2: Install Ollama (Local AI Engine)

Instead of using cloud-based AI (which sends data to third parties), I installed Ollama to run AI models locally.
2.1 Install Ollama
bash

Install via official script

curl -fsSL https://ollama.com/install.sh | sh

Verify installation

ollama --version

Version 0.32.3

2.2 Configure Ollama Service
bash

Start the service

sudo systemctl start ollama
sudo systemctl enable ollama

Check status

sudo systemctl status ollama

2.3 Download DeepSeek Model
bash

Download DeepSeek R1:1.5B model

ollama pull deepseek-r1:1.5b

Verify download

ollama list

NAME ID SIZE MODIFIED

deepseek-r1:1.5b e0979632db5a 1.1 GB 7 seconds ago

2.4 Test the Model
bash

Test AI response

curl -X POST http://localhost:11434/api/generate -d '{
"model": "deepseek-r1:1.5b",
"prompt": "Ciao, rispondi in italiano",
"stream": false
}' -H "Content-Type: application/json"

Output:

{"response":"Ciao! Come posso aiutarti oggi?"}

🐍 Step 3: Build the Security Bot

I wrote a Python bot that orchestrates the scanning process, collects results, sends them to DeepSeek for analysis, and saves structured reports.
3.1 Security Bot Code
python

!/usr/bin/env python3

import subprocess
import json
import logging
import datetime
import requests

Configuration

LOG_FILE = "/var/log/security_bot.log"
REPORT_DIR = "/var/log"
DEEPSEEK_URL = "http://localhost:11434/api/generate"
DEEPSEEK_MODEL = "deepseek-r1:1.5b"

def run_nmap():
"""Run nmap scan on localhost"""
cmd = "nmap -sV --script=default localhost"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout + result.stderr

def run_nikto():
"""Run nikto scan on HTTPS server"""
cmd = "nikto -h https://myzubster.com -ssl -Format json"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
output = result.stdout + result.stderr
return output if output.strip() else "No output"

def run_sqlmap():
"""Run sqlmap scan on localhost"""
cmd = "sqlmap -u localhost --batch --level=1 --risk=1"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout + result.stderr

def run_gobuster():
"""Run gobuster directory scan"""
wordlist = "/usr/share/wordlists/dirb/common.txt"
cmd = f"gobuster dir -u localhost -w {wordlist} -t 50 --no-error --status-codes 200,204,301,302,307,403"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout + result.stderr

def analyze_with_deepseek(results):
"""Send scan results to DeepSeek for analysis"""
prompt = f"""
You are a cybersecurity expert. Analyze these vulnerability scan results:

{results}

Identify:
1. Which services are exposed
2. Critical vulnerabilities
3. Security recommendations
"""
response = requests.post(DEEPSEEK_URL, json={
    "model": DEEPSEEK_MODEL,
    "prompt": prompt,
    "stream": False
}, timeout=60)
return response.json().get("response", "No response")
Enter fullscreen mode Exit fullscreen mode

def main():
logging.info("🚀 Starting complete security scan")

results = {
    "timestamp": datetime.datetime.now().isoformat(),
    "target": "localhost",
    "scans": {}
}

# Run scans
results["scans"]["nmap"] = run_nmap()
results["scans"]["nikto"] = run_nikto()
results["scans"]["sqlmap"] = run_sqlmap()
results["scans"]["gobuster"] = run_gobuster()

# AI Analysis
all_results = "\n".join(results["scans"].values())
results["deepseek_analysis"] = analyze_with_deepseek(all_results)

# Save report
timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
report_file = f"{REPORT_DIR}/security_report_{timestamp}.json"
with open(report_file, 'w') as f:
    json.dump(results, f, indent=2)

logging.info(f"✅ Report saved to {report_file}")
Enter fullscreen mode Exit fullscreen mode

if name == "main":
main()

3.2 Run the Security Bot
bash

Make the script executable

chmod +x ~/MyZubsterGateway/security/security_bot.py

Run it

cd ~/MyZubsterGateway/security
nohup python3 security_bot.py > /var/log/security_bot.log 2>&1 &

Check it's running

ps aux | grep security_bot

🔄 Step 4: Automate with Cron

To run the security bot automatically, I set up a cron job.
4.1 Configure Cron
bash

Edit cron jobs

crontab -e

Add this line to run every hour

0 * * * * /usr/bin/python3 /root/MyZubsterGateway/security/security_bot.py >> /var/log/security_bot.log 2>&1

To run every day at 3 AM

0 3 * * * /usr/bin/python3 /root/MyZubsterGateway/security/security_bot.py >> /var/log/security_bot.log 2>&1

4.2 Verify Cron
bash

List current cron jobs

crontab -l

Check the log

tail -f /var/log/security_bot.log

📊 Step 5: Sample Security Report

The bot generates detailed JSON reports:
json

{
"timestamp": "2026-07-25T19:29:49.080367",
"target": "localhost",
"scans": {
"nmap": "22/tcp open ssh OpenSSH 9.6p1...\n80/tcp open http nginx...\n443/tcp open ssl/http nginx...\n3001/tcp open http Node.js Express...",
"nikto": "No vulnerabilities found.",
"sqlmap": "All tested parameters are not injectable.",
"gobuster": "/api (Status: 301)\n/assets (Status: 301)\n/favicon.ico (Status: 200)"
},
"deepseek_analysis": "Security analysis complete. No critical vulnerabilities found. Recommendations: 1. Keep services updated. 2. Monitor exposed APIs. 3. Consider rate limiting."
}

✅ Final Results
Component Status Details
nmap ✅ Installed Version 7.94SVN
nikto ✅ Installed Version 2.1.5
sqlmap ✅ Installed Version 1.8.4
gobuster ✅ Installed Version 3.6
Ollama ✅ Running Port 11434
DeepSeek ✅ Downloaded 1.1 GB model
Security Bot ✅ Running Cron job hourly
Reports ✅ Generating JSON format
System Overview
text

┌──────────────────────────────────────────────────────────────────────────────┐
│ MyZubster VPS - Security Infrastructure │
├──────────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────┐ ┌─────────────┐ ┌──────────────┐ ┌──────────────────┐ │
│ │ nmap │ │ nikto │ │ sqlmap │ │ gobuster │ │
│ │ Port Scanner│ │ Web Vuln │ │ SQL Injection│ │ Directory │ │
│ └─────────────┘ └─────────────┘ └──────────────┘ └──────────────────┘ │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ Security Bot (Python) - Orchestrator │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ Ollama + DeepSeek AI │ │
│ │ Local analysis - No data sent to third parties │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ JSON Reports - /var/log/security_report_*.json │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────────┘

💡 Lessons Learned

Local AI is powerful – DeepSeek running via Ollama provides analysis without privacy concerns.

Kali tools are essential – nmap, nikto, sqlmap, and gobuster cover most security scanning needs.

Automation saves time – Running scans hourly via cron ensures continuous monitoring.

JSON reports are practical – Structured data is easy to parse and analyze further.

Python is the glue – A simple Python script orchestrates all components seamlessly.

Performance matters – DeepSeek 1.5B runs well on a VPS with 8GB RAM.
Enter fullscreen mode Exit fullscreen mode

🔮 Next Steps

Add more tools – Integrate OpenVAS for deeper vulnerability scanning

Send alerts – Integrate with Telegram/Email for critical findings

Dashboard – Build a web dashboard to visualize scan results

Automated response – Block suspicious IPs automatically
Enter fullscreen mode Exit fullscreen mode

📚 Resources

Kali Tools: kali.org/tools

Ollama: ollama.com

DeepSeek: deepseek.com

MyZubster: github.com/DanielIoni-creator
Enter fullscreen mode Exit fullscreen mode

🤝 Connect with Me

Follow my journey and connect with me on social media:

Blog: DEV.to - Daniel Ioni

X (Twitter): @myzubster

LinkedIn: Daniel Ioni

GitHub: DanielIoni-creator

TikTok: @h4x0r_23
Enter fullscreen mode Exit fullscreen mode

📋 Quick Reference: All Commands Used
bash

Install tools

sudo apt install nmap nikto sqlmap gobuster wordlists -y

Install Ollama

curl -fsSL https://ollama.com/install.sh | sh

Download model

ollama pull deepseek-r1:1.5b

Run security bot

cd ~/MyZubsterGateway/security
nohup python3 security_bot.py > /var/log/security_bot.log 2>&1 &

Setup cron

crontab -e

Add: 0 * * * * /usr/bin/python3 /root/MyZubsterGateway/security/security_bot.py

View report

ls -la /var/log/security_report_.json
cat /var/log/security_report_.json | python3 -m json.tool

Built with ❤️ for open-source security. 🛡️🔒

Top comments (0)