Detecting and Neutralizing a Brute-Force Attack: A Hands-On Lab with Splunk, Hydra, and UFW

Introduction

In modern cybersecurity, visibility is the difference between a minor incident and a total breach. For my latest project, I built a "Lab Environment" to simulate a real-world brute-force attack on a Linux server. My goal was to experience the full lifecycle of an incident: from the initial vulnerability to the final remediation.

The Architecture

Victim Server: An Ubuntu instance hosted on Google Cloud Platform (GCP).

Attacker Hub: A Kali Linux/Ubuntu instance used to launch the simulation.

SIEM: Splunk Enterprise, ingesting logs via the Splunk Universal Forwarder.

Step 1: Creating the Vulnerability (Hardening in Reverse)

Most secure servers use SSH keys, but to simulate a password-guessing attack, I intentionally enabled PasswordAuthentication in the sshd_config .

Lesson Learned: Within 10 minutes of opening the server, real-world bots from global IPs began hitting the server—reminding me how…