🛡️ SysAdmin Core: Linux Administration, Virtual Networking & Penetration Testing Labs

A comprehensive, multi-stage enterprise infrastructure engineering and cybersecurity laboratory.
Demonstrating real-world hypervisor hardware provisioning, headless server OS deployment, kernel namespaces, multi-node virtual subnet routing, SSH daemon firewall hardening, and network vulnerability reconnaissance with Nmap.

Modules Overview • Network Topology • Reconnaissance Flow • Detailed Modules • Modular Guides

---

📋 Table of Contents

• Architectural Overview
• Virtual Network Topology
• Security Reconnaissance Workflow
• Modular Lab Breakdown
  • Module 01: Hypervisor Provisioning & Virtual Hardware Architecture
  • Module 02: Headless Debian Linux OS Installation & Base Hardening
  • Module 03: Linux User Administration, Terminal Signals & Kernel Namespaces
  • Module 04: Virtual Subnet Topologies, Gateway Routing & Inter-Node Networking
  • Module 05: Headless Remote Administration, SSH Port Forwarding & UFW Firewall
  • Module 06: Subnet Host Discovery, Network Auditing & Penetration Testing
• Core Command Reference
• Key Security Insights & Best Practices
• Environment & Tech Stack Specifications
• License & Author

---

🏗️ Lab Curriculum & Architecture

This laboratory simulates an enterprise systems deployment pipeline, advancing from bare-metal hypervisor provisioning to full network security auditing:

flowchart TD
    subgraph Provisioning ["Phase 1: Compute & Virtualization"]
        M1["Module 01: Hypervisor Provisioning<br/>(UTM / QEMU Virtual Hardware & Snapshots)"]
        M2["Module 02: Minimal OS Installation<br/>(Debian 12 Netinstall, Zero-GUI Headless Server)"]
    end

    subgraph Administration ["Phase 2: Core System Administration"]
        M3["Module 03: User Administration & Namespaces<br/>(POSIX Signals, Multi-TTY, UID/Inode/PID Mapping)"]
        M4["Module 04: Virtual Subnet & Routing<br/>(Gateway Routing, ARP Collision Diagnostics, DHCP)"]
    end

    subgraph DefenseAndOffense ["Phase 3: Security Hardening & Penetration Testing"]
        M5["Module 05: SSH Port Forwarding & Firewall<br/>(Custom Socket Binding 2222/tcp & UFW Filtering)"]
        M6["Module 06: Network Recon & Penetration Testing<br/>(ARP Host Discovery, Full Nmap Port Audit, Port 4223 Breach)"]
    end

    M1 --> M2 --> M3 --> M4 --> M5 --> M6

    classDef blue fill:#1E293B,stroke:#3B82F6,stroke-width:2px,color:#F8FAFC;
    classDef gold fill:#1C1917,stroke:#EAB308,stroke-width:2px,color:#FEF08A;
    classDef red fill:#1F1214,stroke:#EF4444,stroke-width:2px,color:#FCA5A5;

    class M1,M2 blue;
    class M3,M4 gold;
    class M5,M6 red;

Loading

---

🌐 Virtual Network Topology

Modules 04 and 05 model an isolated segmented datacenter environment with public upstream access, private subnet routing, and NAT port redirection:

graph LR
    Host["macOS Host Workstation<br/>(Terminal Client)"]

    subgraph HypervisorNAT ["UTM Hypervisor Virtual Switch (NAT)"]
        PortMap["Port Forwarding Table<br/>Host: 2022 ➔ Guest: 2222<br/>Host: 10122 ➔ Guest: 22"]
    end

    subgraph PrivateSubnet ["Internal Private Subnet (192.168.0.0/24)"]
        Router["Net-Router (Gateway)<br/>NIC 1: NAT Upstream<br/>NIC 2: 192.168.0.1 (DHCP)"]
        Node1["Node-01<br/>Static IP: 192.168.0.2"]
        Node2["Node-02<br/>Static / DHCP: 192.168.0.3"]
    end

    Host <--> PortMap
    PortMap <--> Router
    Router <--> Node1
    Router <--> Node2

    classDef hostStyle fill:#0F172A,stroke:#64748B,stroke-width:2px,color:#E2E8F0;
    classDef routerStyle fill:#14532D,stroke:#22C55E,stroke-width:2px,color:#DCFCE7;
    classDef nodeStyle fill:#1E1B4B,stroke:#818CF8,stroke-width:2px,color:#E0E7FF;

    class Host hostStyle;
    class Router routerStyle;
    class Node1,Node2 nodeStyle;

Loading

---

🎯 Security Reconnaissance Workflow

Module 06 demonstrates an end-to-end internal network penetration test conducted from an isolated auditor client (Sec-Laptop) against a secured target (Sec-Control):

sequenceDiagram
    autonumber
    actor Admin as SysAdmin / Pentester
    participant Client as Sec-Laptop (Auditing Client)
    participant Network as Host-Only Subnet (192.168.23.0/24)
    participant Target as Sec-Control (Target Server)

    Admin->>Client: Connect via Host Port Forward (127.0.0.1:10122)
    Client->>Network: Broadcast ARP Sweep (arp-scan -I enp0s1 --localnet)
    Network-->>Client: Active Host Responding: 192.168.23.42
    Client->>Target: Full Range Port Scan (nmap -T4 -p- 192.168.23.42)
    Note over Target: Port 22/tcp Closed<br/>Port 4223/tcp OPEN (SSH Daemon)
    Target-->>Client: Open Port Detected: 4223/tcp (SSH Service)
    Client->>Target: Authenticate over Discovered Port (ssh -p 4223 root@192.168.23.42)
    Target-->>Client: Access Granted: RRF-CONTROL> Management Console
    Admin->>Target: Elevate Verification & Remediate Passwords (passwd root)

Loading

---

📦 Modular Lab Breakdown

---

Module 01: Hypervisor Provisioning & Virtual Hardware Architecture

📖 Step-by-Step Lab Guide: docs/guides/01-hypervisor-provisioning.md

• Objective: Provision, tune, and snapshot a headless Linux guest appliance within the UTM hypervisor on Apple Silicon (ARM64) architecture.
• Key Accomplishments:
  • Configured virtual CPU topology (2 vCPUs) and optimized RAM allocation (1024 MB).
  • Provisioned high-throughput virtio virtual disks (/dev/vda) with QCOW2 sparse allocation.
  • Implemented pre-boot snapshot checkpoints (baseline-clean) allowing non-destructive lab iterations and instant point-in-time recovery.
  • Validated kernel startup parameters, active IP bindings (ip addr), memory pressure (free -h), and mount points (df -h).

Lab Artifacts & Evidence:

Virtual Machine Inventory & Snapshot Baseline	Memory & Virtual Disk Allocations	Network Interface & Address Inspection
UTM hypervisor dashboard establishing pristine baseline snapshot	Kernel memory audit verifying 1GB RAM budget and disk limits	Console verification of network interface link state and addresses

---

Module 02: Headless Debian Linux OS Installation & Base Hardening

📖 Step-by-Step Lab Guide: docs/guides/02-debian-headless-install.md

• Objective: Perform an enterprise-grade netinstall of Debian GNU/Linux 12 (Bookworm), explicitly stripping desktop GUI dependencies to maximize server performance and minimize attack surface.
• Key Accomplishments:
  • Automated partition layout configuration (/dev/vda1 ext4 root partition with swap reservation).
  • Executed custom software selection: explicitly stripped desktop environments (GNOME/X11) and bundled core OpenSSH and standard administrative daemons.
  • Configured localized timezones, UTF-8 keymaps, and separated unprivileged user accounts from the root superuser.
  • Completed GRUB bootloader installation to MBR/EFI partitions with post-install ISO media unmounting.

Lab Artifacts & Evidence:

Virtual Machine Profile	Minimal Software Selection	Installation Progress
UTM architecture profile for Debian 12	Stripping X11/GNOME; keeping only SSH and base tools	Debian base package extraction and kernel build

Console Login Verification	Root Authentication Shell	Graceful ACPI Poweroff
Headless TTY text console boot banner	Elevated superuser access confirmation	Clean filesystem unmount and power state termination

---

Module 03: Linux User Administration, Terminal Signals & Kernel Namespaces

📖 Step-by-Step Lab Guide: docs/guides/03-user-management-namespaces.md

• Objective: Audit identity security, explore Linux POSIX signal handlers, navigate multi-teletype virtual consoles (TTYs), and examine how the Linux kernel maps abstract human names to numeric namespaces.
• Key Accomplishments:
  • Administered user and root credentials via cryptographic PAM hashing using passwd.
  • Mastered essential console terminal control signals:
    • Ctrl + L: Terminal display buffer reset.
    • Ctrl + D: End-of-File (EOF) signal cleanly closing shell sessions.
    • Ctrl + C: SIGINT interruption halting running foreground processes.
  • Explored multi-TTY virtual consoles (navigating from primary TTY1 to virtual console TTY3).
  • Investigated core operating system namespaces:
    • Security UID Namespace: Proved root maps to integer 0 while non-root users map to integers $\ge 1000$ (id -u).
    • Filesystem Inode Namespace: Demonstrated that file paths are human aliases for filesystem index nodes (ls -i /etc/fstab).
    • Process Scheduling PID Namespace: Identified unique integer identifiers for active shell execution threads (echo $$, pgrep bash, pidof bash).

Lab Artifacts & Evidence:

Credential Administration	Multi-TTY3 Navigation & Ping Diagnostic	Filesystem Inode & UID Queries	Shell Process ID (PID) Inspection
Updating user and superuser passphrases	Active TTY3 session with SIGINT packet trace	File index node and numeric UID inspection	Process scheduling queries via pgrep and pidof

---

Module 04: Virtual Subnet Topologies, Gateway Routing & Inter-Node Networking

📖 Step-by-Step Lab Guide: docs/guides/04-virtual-subnet-routing.md

• Objective: Architect a private multi-node virtual network segment (192.168.0.0/24), diagnose Layer 2 ARP collisions, and implement both static IP re-addressing and dynamic DHCP negotiation.
• Key Accomplishments:
  • Configured a dual-homed gateway router node (Net-Router) with NAT upstream Internet and internal subnet routing (192.168.0.1).
  • Attached two private nodes (Node-01 and Node-02) to an isolated Host-Only broadcast domain.
  • Replicated a realistic Layer 2 network failure: both nodes initialized on 192.168.0.2, triggering severe ARP cache thrashing and 20%–60% ICMP packet loss.
  • Remediated network instability via:
    • Method A (Static Re-Addressing): Reconfigured /etc/network/interfaces on Node-02 to 192.168.0.3 and flushed interface tables, restoring 0% packet loss.
    • Method B (Dynamic DHCP Leasing): Reconfigured interface to negotiate automated dynamic leases from the router's DHCP daemon.

Lab Artifacts & Evidence:

Multi-Node Network Topology	IP Collision Diagnostic (Packet Loss)	Static IP Remediation (/etc/network/interfaces)	Dynamic DHCP Binding & 0% Packet Loss
Three-node virtual network architecture	Diagnosing erratic routing and packet loss	Re-addressing client to static 192.168.0.3	Dynamic IP acquisition and 0% loss verification

---

Module 05: Headless Remote Administration, SSH Port Forwarding & UFW Firewall

📖 Step-by-Step Lab Guide: docs/guides/05-ssh-port-forwarding-ufw.md

• Objective: Configure headless remote administration through hypervisor NAT port forwarding, harden the OpenSSH server daemon by binding to a non-standard port, and establish stateful packet filtering using Uncomplicated Firewall (ufw).
• Key Accomplishments:
  • Established initial host-to-guest NAT port forwarding mapping host port 2022/tcp to guest port 22/tcp.
  • Reconfigured the OpenSSH server daemon (/etc/ssh/sshd_config) to bind to custom port 2222/tcp, defeating automated port scanning bots and brute-force scripts targeting port 22.
  • Deployed and configured Uncomplicated Firewall (ufw):
    • Whitelisted incoming traffic on 2222/tcp.
    • Enforced default deny inbound policy.
  • Realinked hypervisor NAT forwarding rules (2022 ➔ 2222) and verified persistent remote terminal access.

Lab Artifacts & Evidence:

Hypervisor Port Forward (Initial)	Initial Remote SSH Authentication	SSH Daemon Rebinding (/etc/ssh/sshd_config)	Stateful UFW Firewall Rules	Hardened Connection & Remote Poweroff
Mapping Host 2022 to Guest 22	Authenticating over initial forwarded port	Rebinding OpenSSH daemon to port 2222	Enabling UFW with explicit 2222/tcp permit	Remote shell verification and orderly ACPI poweroff

---

Module 06: Subnet Host Discovery, Network Auditing & Penetration Testing

📖 Step-by-Step Lab Guide: docs/guides/06-network-recon-pentesting.md

• Objective: Execute an offensive and defensive cybersecurity assessment within an isolated subnet (192.168.23.0/24), performing Layer 2 ARP sweeps, comprehensive TCP port scanning with Nmap, discovering an obscured management port, and executing remediation.
• Key Accomplishments:
  • Initialized auditing client node (Sec-Laptop) on host forwarding port 10122/tcp.
  • Discovered local network interface (enp0s1) and initiated an ARP broadcast sweep across the local network segment using arp-scan -I enp0s1 --localnet.
  • Successfully located target server at IP 192.168.23.42.
  • Performed a full-range port audit (nmap -T4 -p- 192.168.23.42):
    • Detected default SSH port 22 was filtered/closed.
    • Discovered an obscured administrative OpenSSH daemon listening on custom port 4223/tcp.
  • Connected via ssh -p 4223 root@192.168.23.42, bypassing surface security and escalating directly into the privileged RRF-CONTROL> console interface.
  • Remediated the exposed target machine by updating the root administrative password to a hardened credential.

Lab Artifacts & Evidence:

Auditing Client SSH Session	Network Interface Identification	ARP Subnet Discovery (arp-scan)
Connecting to security client over 10122/tcp	Querying active virtual interfaces on enp0s1	Discovering active target server at 192.168.23.42

Full-Spectrum Nmap Scan (Port 4223)	Target Exploitation & Root Access	Security Remediation (passwd)
Comprehensive Nmap port scan identifying port 4223	Logging into target RRF-CONTROL console	Remediating administrative credentials

---

⚡ Core Command Reference

# ==========================================
# 1. HARDWARE & STORAGE DIAGNOSTICS
# ==========================================
ip addr                         # List all IP addresses and interface states
free -h                         # Inspect RAM and Swap utilization in human units
df -h                           # Display mounted storage filesystem consumption
uname -a                        # Display Linux kernel version and CPU architecture

# ==========================================
# 2. USER & PROCESS NAMESPACES
# ==========================================
passwd <username>               # Update user authentication passphrase
id -u <username>                # Query numeric User ID (UID)
ls -i <file_path>               # Query filesystem index node (Inode)
echo $$                         # Print Process ID (PID) of current shell
pgrep <process_name>            # Find running process IDs by pattern

# ==========================================
# 3. NETWORK CONFIGURATION & ROUTING
# ==========================================
systemctl restart networking    # Restart Debian network subsystem
ip addr flush dev <iface>       # Clear active IP leases and routes on interface
ifdown <iface> && ifup <iface>  # Cycle network interface state

# ==========================================
# 4. FIREWALL & SSH HARDENING
# ==========================================
ufw status verbose              # Check active firewall enforcement and rules
ufw allow <port>/tcp            # Whitelist incoming TCP port traffic
ufw --force enable              # Enable firewall with persistent boot policy
systemctl restart ssh           # Reload OpenSSH daemon socket bindings

# ==========================================
# 5. SECURITY RECONNAISSANCE & PENTESTING
# ==========================================
arp-scan -I <iface> --localnet  # Layer 2 ARP broadcast discovery on local subnet
nmap -T4 -p- <target_ip>        # Full 65,535 TCP port security assessment
ssh -p <port> user@<target_ip>  # Authenticate over targeted non-standard SSH port

---

🔒 Key Security Insights & Best Practices

Domain	Vulnerability / Failure Mode	Hardening Best Practice	Lab Demonstration
System Footprint	Bloated GUI desktops introduce excessive packages, background Daemons, and unmonitored attack vectors.	Deploy minimal headless server OS builds (netinst) with only strictly essential system packages.	Module 02
Terminal Access	Leaving unattended root consoles active allows unauthorized physical/TTY access.	Utilize standard session exit signals (Ctrl+D), enforce idle session timeouts, and isolate TTYs.	Module 03
Subnet Routing	Duplicate static IP configurations cause ARP collision thrashing, flapping routes, and service denial.	Enforce centralized DHCP server reservations or maintain strict static IP allocation IPAM ledgers.	Module 04
Remote Access	Exposing default SSH port 22/tcp attracts automated credential stuffing bots and scanning engines.	Rebind SSH to non-standard high ports ($\ge 1024$), enforce UFW default-deny incoming firewall policy.	Module 05
Network Exposure	Obscurity alone (security through obscurity) does not prevent discovery by network scanning tools.	Non-standard ports (4223/tcp) are trivially located by comprehensive scans (nmap -p-); enforce strong keys and network segmentation.	Module 06

---

💻 Environment & Tech Stack Specifications

• Host Workstation: macOS (Apple Silicon ARM64)
• Virtualization Hypervisor: UTM (v4.x) running QEMU 7.x+ via Apple Hypervisor.framework
• Guest Operating Systems: Debian GNU/Linux 12 (Bookworm) ARM64 / minimal server
• Networking Stack: UTM Virtual Shared NAT & Isolated Host-Only Subnets
• Security & Analysis Tooling: nmap, arp-scan, ufw, openssh-server, iproute2, net-tools

---

📄 License & Author

Crafted and maintained by Sayed Ahmed Husain.
Released under the MIT License.