Security Setup (eleven tabs)
Overview. How exposed the box is, read in one pass as cards: firewall, Fail2Ban, SSH, passwords, WAF, integrity, MAC, kernel, scheduled, time — each carrying the live state of its area and opening to what the tool actually said, with the two or three worst findings named in one verdict line. Root reads happen only while the screen is on screen; coming back reads again.
Firewall. ufw or firewalld (iptables/nftables read and judged): on/off with the defaults explained, the rules folded (a v4 rule and its v6 twin are one line), "What is reachable" (every listening port judged against the rules), "Open to the world" (the named services), who may reach SSH, "Who is knocking" (refused connections folded by address) and the log. One dialog for a preset ("Open MongoDB"), a new rule, or "Who may reach SSH" — "to whom" as allow/deny rows, denies before allows, a preview, and the invariant that the operator's own address stays allowed. The SSH port is allowed before the firewall is turned on, cannot be removed while it is the only cover, and a rule that would deny it is refused in Go.
Fail2Ban. Which doors are watched (SSH, web logins, mail, FTP, databases) as jails switched on click, the rule (findtime/bantime/maxretry in words, per jail or global), who is banned right now and why, who is never banned, who is refused for good, the activity folded over a window, the log, and alerts by mail through the box's own Postfix. Lens owns only /etc/fail2ban/jail.d/zz-lens.local.
SSH. Hardening as a draft proven as one batch: Lens writes its drop-in, sshd validates it, sshd reloads, then Lens opens a FRESH login from this computer on the port now in force; if that fails the previous file comes back and the screen says reverted. Root off is refused unless somebody else can get in and become root; password logins go off only once the key alone has proven a fresh login. "Who can log in" lists every account's door (keys, password, AllowUsers/AllowGroups); "Your login" switches Lens's own login to one of your keys already on the door; "Who logged in" reads the sshd log folded by address with key names by fingerprint. Lens makes no key and holds none.
Passwords. Password policy: what a password must be, how long it lives, what happens after too many wrong ones — and which accounts break the rules right now. Installing the policy packages asks first and says what they do.
WAF. Two layers: INSIDE THE WEB SERVER, ModSecurity with the OWASP Core Rule Set in nginx or Apache (one form per engine, paranoia level, anomaly thresholds); AT THE DOOR, CrowdSec, which reads the logs, bans at the firewall for every port and shares reputations. CrowdSec's three levers a person actually pulls: what it reads (acquisition sources — a log file, a container's output, a unit's journal, each a Lens-owned file in acquis.d), alerts by mail through the box's Postfix, and scenarios switched between watch-only and banning. Your own address is allowed in one and whitelisted in the other, and neither can be told to block it. "What it saw" is the activity.
Integrity & rootkits. Three checks, each a job you watch with its report saved on the server: packages against what the distro shipped (debsums/rpm -V), files against a baseline (AIDE), rootkits (rkhunter and chkrootkit). A schedule of timers Lens owns and a mail when something changed; the two "accept the current state" actions carry a sentence before, because they are the only ones that can hide an intruder. Findings are explained in words.
AppArmor / SELinux. The kernel's second opinion: the denials first (a refusal is far more often a wrong label than an attack, and the screen says which, with the fix when Lens knows it from the meaning), SELinux booleans and labelling, AppArmor profiles, and what is listening with nothing confining it.
Kernel. The standard sysctl switches against spoofing, probing and escalation, grouped Network / Kernel / Filesystem, read as they are and set through one Lens file live and at boot, every changed value remembered so Remove puts the box back exactly as it was.
Scheduled. Everything the box runs on its own — cron in all its places, systemd timers, at jobs — with who runs it and from where, and the shapes persistence takes called out (this is the list a responder asks for first). An entry of the operator's own goes in /etc/cron.d/lens, the one file Lens writes and deletes lines from.
Time & entropy. Is the clock right and who keeps it so (NTP on, the source); does the box have a real source of randomness. Informative, never a verdict on the screen.