Security
The security model separates public service exposure from private administration. WireGuard provides the private network path, while SSH and NoMachine apply independent authentication policies for terminal and graphical access.
Host controls include firewalld and SELinux, while USBGuard blocks USB devices without an explicit allow rule. CrowdSec adds detection from ingress logs, while detection and firewall response remain independently verifiable layers.
Start with the question
| Question | Reading route |
|---|---|
| How do I reach and authenticate to the host? | Follow WireGuard to SSH for terminal access or NoMachine for graphical access. |
| What needs attention now? | Start with the security report and doctor, check freshness and findings, then follow the affected control. |
| Does a configuration change match the intended work? | Follow Maintenance into AIDE review and available Linux Audit attribution. |
| How do we know a firewall decision blocked traffic? | Follow K3s ingress into CrowdSec's controlled test. |
| Could a device-policy change affect access? | Read USBGuard's network recovery boundary before maintenance. |
Host security evidence
Configuration activity, file integrity and control health have separate owners:
| Capability | Responsibility |
|---|---|
| Linux Audit (auditd) | Attribute selected configuration operations to processes and available login identities. |
| AIDE | Detect file-content and attribute differences against an explicitly approved baseline. |
| Security report and doctor | Collect recurring reports with missed-run catch-up and provide fresh diagnosis. |
A file change can be legitimate maintenance or something to investigate. Linux Audit supplies activity evidence, AIDE establishes a difference from approved state, and reporting helps an operator assess those observations alongside control health. The meaning of a healthy result depends on each control's coverage and the freshness of its evidence.
Scheduled collection keeps that review available without an operator starting each run. A successful report can contain security findings or collection errors: publication success establishes that the report was produced and saved, while the findings still require interpretation and any baseline change requires explicit approval.