Ubuntu in Your Home Lab: Desktop, Server, SSH Hardening and Docker

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker (you are here)
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

Why Ubuntu belongs in every lab

Most servers you will defend at work run Linux, and Ubuntu is one of the most common distributions in cloud and enterprise. In this series it is also the base for the SIEM (part 9), the Docker host for vulnerable web apps (part 7) and the OpenPLC controller (part 11). Learning to build and harden one properly is a lab exercise in itself - and it is what Linux+, Security+ and CySA+ hardening questions describe.

Desktop or Server?

• Ubuntu Server has no GUI, boots fast and needs little RAM (2 GB is plenty for most lab roles). Use it for anything that runs services.
• Ubuntu Desktop is useful as an analyst workstation or for tools that need a browser. It needs 4 GB or more.

Pick the current LTS (long-term support) release for both - LTS versions get five years of standard security updates.

Step 1: Install Ubuntu Server in a VM

1. Download the Ubuntu Server ISO from the official site.
2. Create a VM: 2 CPUs, 2-4 GB RAM, 25 GB disk, network on your NAT/LabNAT network for now.
3. Boot the ISO and follow the installer. Accept the default storage layout, create your user, and tick "Install OpenSSH server" when offered.
4. Reboot, remove the ISO, and log in at the console.
5. Patch it straight away:

sudo apt update && sudo apt full-upgrade -y

Step 2: Connect with SSH keys, not passwords

From your host or Kali, generate a key pair and copy the public key to the server:

ssh-keygen -t ed25519
ssh-copy-id youruser@<server-ip>
ssh youruser@<server-ip>

Step 3: Harden SSH

Once key login works, disable password and root login. Recent Ubuntu releases read drop-in files from /etc/ssh/sshd_config.d/, which survive upgrades better than editing the main file:

sudo tee /etc/ssh/sshd_config.d/50-lab-hardening.conf <<'EOF'
PasswordAuthentication no
PermitRootLogin no
EOF
sudo sshd -t && sudo systemctl restart ssh

sshd -t checks the configuration first, so a typo does not lock you out. Keep your current session open and test a new login in a second window before closing it.

Step 4: Firewall with ufw

sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Add rules only for the services each VM actually runs - for example sudo ufw allow 443/tcp on the SIEM.

Step 5: Keep it patched automatically

Ubuntu Server usually ships with unattended-upgrades enabled for security updates. Confirm it:

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Step 6: Logs you should know

• journalctl -u ssh - SSH service logs, including failed logins.
• /var/log/auth.log - authentication events and sudo use.
• last and lastb - successful and failed login history.

Try failing an SSH login on purpose from Kali, then find it in the logs. That is the same evidence an analyst looks for during a brute-force investigation.

Step 7: Make it a Docker host

Docker lets you run vulnerable apps (part 7) and tools such as MobSF (part 10) without cluttering the OS. Ubuntu's own package is the quickest start:

sudo apt install -y docker.io
sudo usermod -aG docker $USER   # log out and back in afterwards
docker run --rm hello-world

For the latest features, install Docker Engine from Docker's own repository using their Ubuntu guide instead. Remember that membership of the docker group is effectively root on that host - a privilege-escalation path worth practising in its own right.

Practice ideas

• Create a user with a weak sudo rule and practise finding it with sudo -l.
• Install auditd and write a rule that logs every change to /etc/passwd.
• Scan the server from Kali before and after hardening and compare the open ports.

Want to practise Linux commands without a VM? Our Linux terminal lab and file permissions lab run in the browser.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Next step

Part 6 builds an Active Directory domain - the environment most real-world attacks target.