The problem.
A personal server exposing SSH and services to the Internet is scanned constantly. I wanted to see what really happens, learn to tune an IDS without drowning in noise, and industrialise the analysis.
What I built.
01
Detection
- Suricata 8 in a container on the host network, IPv4 and IPv6, automatic weekly rule updates.
- EveBox to triage alerts, reachable only through an SSH tunnel.
- Noise tuning versioned in git: precise pass rules rather than global disabling, hot reload.
02
Hardening
- fail2ban: 5 failures in 10 minutes, one-hour ban that grows with each repeat.
- Technical accounts without passwords, log rotation, admin password changed after it appeared in logs.
03
Assisted analysis
- Read-only account for the AI agent and an /analyse-ids command: triage into probable incident, to investigate, expected or noise, then investigation of suspicious items.
- Agent admin access closed by default, opened only with explicit approval.
The architecture.
Internetscans · SSH
Linux servernetwork interface
Suricata53,500 rules
EveBoxSSH tunnel
AI agentread-only · /analyse-ids
Security & guardrails.
- Monitoring only: the IDS blocks nothing, it receives a copy of the traffic.
- Personal network only.
- Least privilege for the AI agent: read-only by default.
The results.
- End-to-end detection tested and validated, SSH bots banned from day one.
- Limits documented honestly: without a port-mirroring switch, the IDS only sees the server's own traffic.
