Three Layers of Security: My Journey with UFW, Fail2Ban, and Logwatch

jose jimenez — Thu, 29 Oct 2026 23:54:51 +0000

Strengthening an Existing SIEM Environment with UFW, Fail2Ban, and Logwatch

1.1 "Teaser" Overview

For this project, I wanted to improve the security of an existing Ubuntu server and strengthen how our Wazuh SIEM monitored security activity. My goal was to add three security tools and observe how they worked together.

First, I configured UFW to control incoming network traffic and block unwanted connections. Next, I installed Fail2Ban to automatically block IP addresses after repeated failed SSH login attempts. Lastly, I added Logwatch to organize system logs into readable reports, making it easier to review suspicious activity.

Throughout the project, I tested each tool to see how it interacted with the existing environment. I also learned that different security tools respond to different threats, and that multiple tests are needed to properly evaluate their effectiveness.

1.2 Introducing Myself to the Cyber Community

I am new to cybersecurity and currently work as a full-time teacher. I have always enjoyed learning, especially when it comes to technology, coding, and understanding how computer systems work. My interest in cybersecurity has motivated me to develop new technical skills and learn what it takes to become a security professional.

As a teacher, I understand the importance of patience, problem-solving, and continuous learning. I hope to bring those same skills into cybersecurity as I continue gaining hands-on experience with Linux, network security, and security monitoring tools.

Projects like this one are helping me build confidence and better understand how cybersecurity professionals protect systems from potential threats.

2. Project Setup

For this project, I used an existing virtual machine (VM) environment from my Sprint 11 classwork. My main points of interest were the Ubuntu Play Server, Blue-Team Workstation, and Wazuh SIEM.

My goal was to add three security tools to the existing environment and observe how they interacted with the server and our SIEM.

My first modification was UFW (Uncomplicated Firewall). I installed and configured UFW on the Ubuntu Play Server to control incoming traffic while allowing necessary connections. I allowed SSH traffic and blocked incoming connections on port 8088.

To verify that UFW was working, I used Nmap from Kali Linux to scan the server. The results showed port 8088 as filtered, and the firewall logs confirmed that the incoming traffic was blocked. Wazuh also generated an alert for the event.

My second modification was Fail2Ban. I wanted to add an automated response to repeated failed SSH login attempts. I configured Fail2Ban to ban an IP address for ten minutes after five failed login attempts within a ten-minute period.

During testing, I attempted multiple incorrect SSH logins from Kali Linux. Fail2Ban successfully detected the attempts and banned the attacking IP address. Wazuh also recorded the event.

My third modification was Logwatch. I wanted to make reviewing security logs easier by organizing important system activity into readable reports.

I configured Logwatch to summarize events such as failed SSH login attempts and Fail2Ban activity. During testing, Logwatch successfully generated a report and delivered it to the server's root mailbox.

After setting up these tools, I used MITRE ATT&CK technique T1046 – Network Service Discovery as the basis for my main firewall test. I manually ran an Nmap scan from Kali Linux to see how UFW and Wazuh responded.

I also performed a separate SSH password-guessing simulation to test Fail2Ban and reviewed the resulting activity using Logwatch.

This setup allowed me to see how different security tools could work together to improve protection, automated response, and security monitoring.

3. Experiment #1 – UFW Firewall

For my first experiment, I wanted to see how adding UFW would affect the existing security environment. My goal was to control incoming network traffic and determine whether Wazuh could detect blocked connections.

I configured UFW to allow SSH connections while blocking incoming traffic on port 8088.

To test the firewall, I used Nmap from Kali Linux to perform a network service discovery scan aligned with MITRE ATT&CK technique T1046.

The scan showed that port 8088 was filtered, indicating that the traffic was being blocked. I also checked the UFW logs and confirmed that Wazuh generated an alert for the blocked connection.

This experiment showed me how a host-based firewall could add another layer of protection while allowing the existing SIEM to monitor security events.

3.2 Experiment #2 – Fail2Ban

For my second experiment, I added Fail2Ban to see how it would interact with our existing SIEM and provide an automated response to suspicious activity.

My goal was to automatically block an IP address after five incorrect SSH login attempts within ten minutes. Once that limit was reached, Fail2Ban would ban the IP address for ten minutes and record the event in its logs.

To test this, I attempted multiple incorrect SSH logins from Kali Linux against the Ubuntu Play Server.

After five failed attempts, Fail2Ban successfully banned the attacking IP address. I verified the ban through the Fail2Ban logs and confirmed that Wazuh generated an alert.

This experiment demonstrated how Fail2Ban could help protect against password-guessing attacks while allowing the SIEM to monitor the activity.

3.3 Experiment #3 – Logwatch

For my third experiment, I wanted to see whether Logwatch could make reviewing security logs easier.

Before installing Logwatch, I had to manually search through different log files to find important security events. This process could be time-consuming, especially when trying to identify specific activity.

I installed and configured Logwatch to summarize system events, including failed SSH login attempts and Fail2Ban activity.

During testing, Logwatch successfully generated a security report and delivered it to the server's root mailbox. The report presented the information in a much more readable format, making it easier to identify suspicious activity.

This experiment showed me how Logwatch could complement Wazuh. While Wazuh provided centralized security monitoring and alerts, Logwatch helped summarize local system activity for further review.

4.1 Summary of Experimental Findings

I originally expected that I could install all three security tools and use one Atomic Red Team test, T1046 – Network Service Discovery, to see how they would respond to a potential threat.

However, I quickly learned that although all three tools worked and complemented each other, they did not necessarily respond to the same type of attack. Each tool was designed for a different purpose, meaning that multiple tests were needed to evaluate their effectiveness.

During my first experiment, I used Nmap to simulate network service discovery. UFW successfully blocked traffic on port 8088, and Wazuh generated an alert.

For my second experiment, I simulated repeated failed SSH login attempts. After five incorrect attempts, Fail2Ban automatically banned the attacking IP address for ten minutes. Wazuh also recorded the event.

Lastly, Logwatch summarized security activity into readable reports, making it easier to review failed login attempts and other important system events.

One of my biggest takeaways was learning that not every security tool responds to every threat.

UFW focuses on controlling network traffic, Fail2Ban automatically responds to repeated failed login attempts, and Logwatch organizes security information for further analysis.

Although these tools serve different purposes, using them together provided a wider range of protection and monitoring than I originally expected.

Overall, this project helped me better understand how different security tools can complement an existing SIEM and contribute to a stronger defense-in-depth security strategy.

4.2 Advice on Avoiding Mistakes

One of the biggest lessons I learned was the importance of practicing Linux commands and carefully reviewing configuration files before making changes.

Small mistakes, such as incorrect syntax, missing characters, or improperly formatted configuration files, can prevent security tools from working correctly. Double-checking commands and understanding what they do can save a lot of troubleshooting time.

Another important lesson was to test each modification individually before moving on to the next experiment.

For example, I initially had trouble enabling UFW and had to troubleshoot the command before successfully activating the firewall. I also learned that different connection results, such as "connection refused" and "filtered," can tell us important information about how a system is responding.

I also recommend paying close attention to timestamps, log formats, and security alerts when working with monitoring tools like Wazuh. During this project, finding the correct log events was sometimes challenging, which showed me the importance of carefully reviewing how logs are recorded and displayed.

My biggest advice is to be patient, document your progress, and verify that each tool works before adding another.

Troubleshooting is part of learning, and understanding why something does not work can be just as valuable as successfully completing the experiment.

5.1 The Coolest Thing I Learned

One of the coolest things I learned during this project was how much troubleshooting is involved in cybersecurity.

Although troubleshooting was extremely time-consuming, I found it surprisingly fun and rewarding. I enjoyed learning new Linux commands, reviewing configuration files, and searching through logs to find the source of a problem.

At times, it felt like looking for a needle in a haystack, especially when one small mistake prevented something from working correctly.

One of my favorite moments was finally getting UFW to work properly and seeing the blocked traffic appear in our Wazuh alerts.

That experience showed me how important patience, attention to detail, and problem-solving are in cybersecurity.

I learned that troubleshooting is not just about fixing problems. It is also about understanding how systems work and why they behave the way they do.

5.2 One Piece of Advice

Always, and I mean always, double-check or even triple-check your commands and configuration files before running them.

Make sure your syntax is correct, your commands are properly written, and any required opening and closing characters are in place. Even the smallest mistake can cause errors that take a long time to troubleshoot.

I also recommend testing one modification at a time and making sure it works before moving on to the next step.

A few extra minutes of reviewing your work can save you hours of frustration later.

5.3 My Favorite Resource

Fail2Ban Official GitHub Repository:
https://github.com/fail2ban/fail2ban

One of my favorite resources throughout this project was the official Fail2Ban GitHub repository.

It provided straightforward information that helped me understand how Fail2Ban works and how to configure it on my Ubuntu server.

I found it especially useful when learning how to monitor failed SSH login attempts and automatically ban suspicious IP addresses.

Having access to documentation and configuration examples made troubleshooting easier and helped me understand the purpose of the commands I was using.

This resource was helpful because it encouraged me to understand what I was doing instead of simply copying commands.

5.4 Thank You (Gratitudes)!

I would like to give a special thank you to my career coach, Sergio, for continuously pushing and motivating me to finish this project.

Learning cybersecurity while balancing my responsibilities as a full-time teacher has not always been easy. There were moments when troubleshooting became frustrating and time-consuming, but his encouragement helped me keep moving forward.

I am grateful for Sergio's support and motivation throughout this learning experience.

I am excited to continue learning, improving my technical skills, and working toward becoming a cybersecurity professional.

References

Ubuntu Server – Firewall Documentation
https://ubuntu.com/server/docs/firewalls/

MITRE ATT&CK – T1046: Network Service Discovery
https://attack.mitre.org/techniques/T1046/

Fail2Ban – Official GitHub Repository
https://github.com/fail2ban/fail2ban

MITRE ATT&CK – T1110.001: Password Guessing
https://attack.mitre.org/techniques/T1110/001/

Logwatch – Official Project Page
https://sourceforge.net/projects/logwatch/

DEV Community: jose jimenez