Building a Minimal Open Source Security Stack for Infrastructure Protection
Full protection of corporate infrastructure today is difficult to achieve without commercial security tools. However, startups, small organizations, and budget-constrained companies often turn to open source solutions as a compromise. This guide focuses on building a minimal security stack that addresses core information security tasks using freely available tools.
A basic stack must cover several key areas: protection of endpoints to detect malware and workstation compromise, network perimeter defense and traffic control, centralized collection and analysis of security events, and user access management through proper authentication and rights separation. The recommendations are intended as a starting point for small infrastructures rather than a complete substitute for enterprise products.
Antivirus Protection
ClamAV is one of the best-known open source antivirus engines with cross-platform support for Linux, Windows, and macOS. On Windows, the graphical frontend ClamWin is available. It is frequently used to scan mail traffic and file repositories in addition to endpoint protection. Other options include the OpenAntiVirus Project and KicomAV.
Installation on Linux uses the commands: apt-get update followed by apt-get install clamav clamav-daemon. Services clamav-freshclam and clamav-daemon handle signature updates and scanning. On Windows, the standard installer is used, and recursive scans are performed with clamscan --recursive.
Network Perimeter Protection
Popular open source firewalls include pfSense, built on FreeBSD with the PF packet filter, its fork OPNsense, and the proxy server Squid. pfSense supports installation of Snort and Suricata for intrusion detection and prevention, as well as Squid for web traffic filtering. Key features encompass multi-WAN load balancing, VPN servers (IPsec, OpenVPN, L2TP, TINC), DHCP services, HAProxy publishing, captive portal support, and log forwarding to external SIEM systems.
Rules for Snort or Suricata can be loaded from ET Open or official VRT feeds. The system can operate in IDS mode for logging only or IPS mode for active blocking. Logs are forwarded via the Status → System Log → Settings section.
Security Event Collection and Analysis
The ELK Stack (Elasticsearch, Logstash, Kibana) enables custom SIEM construction. Logstash and Ingest Pipelines normalize events, while threshold and EQL rules support correlation of authentication failures or suspicious sequences. Wazuh offers a more integrated platform with built-in vulnerability scanning, file integrity monitoring, EDR-like capabilities, and direct mapping to the MITRE ATT&CK framework for threat hunting and IOC enrichment.
Access Management and Authentication
Keycloak provides single sign-on using OAuth2, OIDC, and SAML standards. It authenticates users, issues JWT tokens, and supports integration with LDAP or Telegram. Configuration involves creating an OpenID Connect client, setting valid redirect URIs, and mapping roles in the target application such as Kibana.
These open source components together form a functional baseline for small environments, but they must be tuned to the specific infrastructure, kept updated, and sourced only from active, reputable projects.
Related articles
Telegram Experiences Outage in Kazakhstan as International Peering Points Show Traffic Drop
Users across Kazakhstan reported widespread issues accessing Telegram, with the Ministry of Artificial Intelligence and Digital Development confirming the problems. Monitoring data revealed a sharp decline in Telegram traffic at major international peering points in Frankfurt and Moscow, while Kazakhtelecom reported no internal network faults, outages, or disruptions within its infrastructure. The operator confirmed that its systems continue operating normally and has contacted Telegram's technical team for clarification on the root cause. No information is yet available regarding the exact scale of the outage, affected regions within Kazakhstan, or expected recovery timeline. Separately, authorities noted that a database allegedly containing personal data of approximately 15 million Kazakh residents, or about three-quarters of the population, has been offered for sale on a shadow forum.
Russian Researchers Achieve First Qubit Operations on Planar Ion Traps
Scientists from Rosatom’s Quantum project have for the first time in Russia performed qubit operations using planar ion traps. The technology replaces traditional three-dimensional electromagnetic traps with flat electrode chips that can hold more than 100 ions while integrating optical readout components. Two independent teams demonstrated the approach: one at the Physical Institute of RAS led by Ilya Semerikov using ytterbium-171 ions, and another at the Quantum Center under Kirill Lakhmansky using calcium ions. Both groups successfully captured, moved, and performed single-qubit gates on the trapped ions. Rosatom views the planar architecture as a key step toward scalable industrial ion-trap quantum computers capable of solving practical problems. The teams now aim to advance from individual operations to high-fidelity, multi-zone systems with over 100 controllable qubits by 2030.
OSINT for the Lazy Part 17: Versatile Framework Acts as Swiss Army Knife for Investigators
The article continues the series on tools for lazy OSINT practitioners by reviewing a multifunctional online toolkit hosted at htdark.com. This minimalistic yet powerful platform aggregates data across usernames, email addresses, phone numbers, IP addresses, cryptocurrency, social networks, and media files. It wraps Censys search capabilities into a more convenient interface while adding features such as JSON report export and basic relationship graphing. The tool checks 20 social platforms including Reddit and Spotify but omits Chinese and Russian resources, marking absent accounts in red and requiring manual verification for others. An Advanced section functions as a dork builder supporting Baidu and Naver with time-range filters and exclusion operators. While no single toolkit replaces specialized solutions, this framework provides broad initial visibility and helps analysts choose focused follow-up directions based on accumulated data rather than random checks.
AS2 in .NET Without Separate Java Gateway: Native EDI Exchange Directly in Application Routes
redb.Route.AS2 introduces native AS2 protocol support for .NET applications, eliminating the need for separate commercial gateways or Java-based servers like OpenAS2. The library integrates AS2 handling as a standard step in Apache Camel-style routes, allowing signed and encrypted S/MIME exchanges with partners such as Walmart directly within a single .NET process. It supports both synchronous and asynchronous MDN receipts for non-repudiation, using MimeKit and Bouncy Castle for cryptography. Developers can configure partners via As2ConnectionFactory objects that define certificates, AS2 identifiers, algorithms, and MDN modes. The solution handles X12 and EDIFACT documents with compression, signing, and encryption while exposing metadata like MIC values and signature validation results to the routing pipeline. This approach consolidates deployment, observability, and processing compared to external gateways or JVM processes.