Zero-Trust Adversarial Linux Lab

Secure, headless Linux infrastructure hardening and adversarial simulation range deploying a text-based Debian target server and a Kali Linux attack node over an isolated software-defined switch fabric. This architecture completely eliminates automated user-space deployment layers or pre-configured security templates to build, secure, and stress-test a Linux environment directly from the bare hardware abstraction layer up.

System Demonstration

• Targeted Ingress Scan (Left) – Nmap verifies the absolute containment profile of the perimeter, registering targeted server ports (22, 80) as completely filtered.
• High-Velocity Profiling (Center) – Forcing a zero-retransmission parameter cap (--max-retries 0) confirms the stateful default-deny posture under a rapid 100-port scanning array executed in 1.16 seconds.
• Netfilter Active Registers (Right) – Live kernel telemetry tables mathematically validate the interception and destruction of exactly 12,640 raw attack frames at the master INPUT gate.

Repository Layout

C:\labs\zero-trust-adversarial-linux-lab\
│
├── Assets/
│   ├── 11-fast-scan-telemetry.png
│   ├── 11-targeted-scan-audit.png
│   └── 12-firewall-drop-proof.png
│
├── Documents/
│   ├── Phase 1/
│   │   ├── Step 1 - Install VMware Workstation Pro.md
│   │   ├── Step 2 - Configure Isolated Virtual Switches.md
│   │   └── Step 3 - Restrict Network DHCP Ranges & Custom Subnets.md
│   ├── Phase 2/
│   │   ├── Step 4 - Download Minimal Debian ISO.md
│   │   ├── Step 5 - Provision Bare-Bones VM Profile.md
│   │   └── Step 6 - Install Text-Only Debian Operating System & Initialize 
│   ├── Phase 3/
│   │   ├── Step 7 - Disable Remote Root Account Logins & Privilege Escalation 
│   │   ├── Step 8 - Enforce Cryptographic SSH Public-Private Key Pairs.md
│   │   └── Step 9 - Write Strict Netfilter Firewall Rules Using a Default-Drop 
│   └── Phase 4/
│       ├── Step 10 - Provision an Offensive Security Node on the Isolated 
│       ├── Step 11 - Launch Adversarial Port Sweeps and Stealthy Network Scans.md
│       └── Step 12 - Analyze Raw Debian System Journal Logs and Authentication 
│
├── Scripts/
│   └── hardened-iptables.sh
│
└── README.md

---

Architectural Design

The core value proposition of this engineering range is the absolute elimination of third-party protective abstractions. Modern automated security wrappers run heavy automation daemons that continuously poll hardware buffers and aggressively manage networking states, leaving blind spots if a software flaw triggers an unhandled exception. This deployment forces system control down to the physical host silicon layers and raw kernel memory boundaries, establishing self-sufficient knowledge that adapts natively as new adversarial vectors surface.

Virtualization is mastered beyond standard application limits by interfacing natively with the host motherboard via hardware-assisted virtualization extensions (Intel VT-x and AMD-V). The Type-2 hypervisor relies on the host operating system kernel to manage underlying hardware thread execution loops, manipulating physical CPU registers to enforce absolute memory partition isolation. This configuration ensures that when an adversarial payload or high-velocity packet sweep executes, the processing instructions remain strictly trapped within an independent sector of the physical silicon chips, enabling full-stack security auditing that bridges software, firmware, and underlying hardware boundaries.

Bypassing all graphical display managers shifts the target server to a pure, text-only prompt, dropping the idle kernel memory footprint to a lean 100 MB and exposing the raw, unshielded kernel landscape. To enforce total access isolation, directory permissions are locked down via POSIX Index Node (Inode) security bitmask enforcements to octal 700 (111 000 000) and cryptographic keys to octal 600 (110 000 000). If a single bit in the group or world fields evaluates to a binary 1, the application daemon identifies it as an unhardened boundary exposure and immediately severs the network socket.

This clean environment forces the manual configuration of stateful Netfilter firewall tables row by row. Every active thread running in the host RAM is an essential system primitive controlled, analyzed, and secured out of memory queues instantly without wasting CPU cycles writing log lines or returning an ICMP response.

---

Tools

• VMware Workstation Pro: Functions as the hardware-assisted isolation interface to spin up distinct network switches and map guest resource consumption limits natively down to host silicon registers.
• Text-Based Debian GNU/Linux Stable: Serves as the minimal target environment, stripping all background graphical services to force the manual deployment of all system defense structures from the command line up.
• Kali Linux Rolling Framework: Deployed as the offensive scanning agent over the software-defined switch fabric to launch hostile TCP/IP frames and measure network policy rule execution resilience.

---

12-Step Blueprint

Phase 1: Hypervisor Optimization & Virtual Networking

1. Install & Configure: Deploy VMware Workstation Pro utilizing free personal-use licensing frameworks.
2. Network Setup: Isolate VMnet1 (Host-Only) and VMnet8 (NAT) to sever the host routing table pathway.
3. Subnetting: Map static 192.168.99.0/24 and 10.10.10.0/24 CIDR blocks to mitigate network collisions.

• Read Phase 1 Logs ➔

Phase 2: Bare-Bones Instance Provisioning

4. Download Image: Anchor minimal Debian Netinst amd64 compilation ISO to prevent name-drift paths.
5. Provision Hardware: Restrict hardware limits to 1 vCPU and 2 GB RAM to prevent host resource starvation.
6. Minimal Install: Terminate graphical desktop environments to preserve a 100 MB idle memory footprint.

• Read Phase 2 Logs ➔

Phase 3: Kernel-Space Hardening & Netfilter

7. Secure Root: Enforce multi-tiered entry vectors via audited sudo modifications and block remote root access.
8. SSH Hardening: Compute high-density Ed25519 elliptic-curve cryptographic key pairs under memory-hard bcrypt algorithms.
9. Firewall Rules: Deploy a stateful default-drop Netfilter table to render the system completely invisible to sweeps.

• Read Phase 3 Logs ➔

Phase 4: Adversarial Simulation & Analysis

10. Attack Node: Flush Netlink registers to inject static local configurations (10.10.10.20/24) on the Kali attack node.
11. Simulate Attack: Launch comprehensive multi-threaded TCP stealth scans targeting all 65,535 service gates.
12. Analysis: Target the centralized systemd-journald compressed binary telemetry layer to execute forensic incident audits.

• Read Phase 4 Logs ➔