01The base
A Raspberry Pi 4B with an SSD, running Raspberry Pi OS Lite 64-bit, headless. The goal: a portable lab I can take with me and use remotely.
02Hardening first
Before hosting vulnerable targets, you protect the machine that hosts them:
- UFW firewall, opening only the ports that are needed;
- Fail2ban, banning addresses that attempt brute force;
- key-only SSH, no passwords.
03Targets and monitoring
- DVWA and OWASP Juice Shop as targets, behind Nginx Proxy Manager;
- Prometheus, Node Exporter and Grafana to monitor the machine;
- Portainer to manage the containers.
04What's next
Remote access through Tailscale, a Cowrie honeypot, Gitea, Vaultwarden, a Wazuh SIEM, then an Active Directory lab.