Most of what's below runs before you'd ever notice something was wrong. This page walks through each layer in the order traffic actually hits it — what it catches, what it deliberately lets through, and why.
The first line is boring on purpose: narrow the attack surface before any detection logic ever runs.
| Control | Setting | Why |
|---|---|---|
| Password auth | PasswordAuthentication no | Removes credential-stuffing and brute-force as categories entirely — there's nothing to guess. |
| Connection rate | 30/minute burst 15 on new SSH connections | Caps raw connection volume at the packet level, before sshd even forks. |
| Per-source cap | nftables meter, 10 concurrent | One source can't exhaust connection slots on its own. |
| Auth attempts | MaxAuthTries 3, LoginGraceTime 10 | Short, bounded window per connection attempt. |
| Repeat offenders | fail2ban: 2 fails / 10 min → 24h ban; recidive jail → 7 days | Escalating cost for an IP that keeps coming back. |
A single rate limit misses two realistic attack shapes: spread across many sources, or paced just under the line. Eiciel runs three counters per signal (SSH failures, unexpected inbound connections) to cover all three.
| Tier | Catches | Logic |
|---|---|---|
| Per-source burst | One IP hammering fast | Short window, grouped by busiest single source |
| Distributed burst | A botnet spread across many IPs | Same short window, but counted globally with a minimum-distinct-source floor |
| Sustained / paced | An attacker staying just under the burst threshold, for a long time | A separate long window (default one hour) with its own, higher total threshold |
Any tier crossing its threshold triggers full containment — not a ban, not a log line. The whole point is that you don't have to be watching.
Behavioral counters are for noisy, probing attacks. Some actions don't need a pattern to be suspicious — a single occurrence is enough.
| Audit key | Fires on |
|---|---|
sudoers | Any write to /etc/sudoers or /etc/sudoers.d/ |
module_load | A kernel module load |
ssh_keys | A change to the SSH host keys |
eiciel_scripts / watcher_tamper | Tampering with Eiciel's own scripts or watcher process |
eiciel_secrets_read | Opening the sealed-secrets file, successful or not |
isolation_lift | Running nft to undo containment itself |
Each of these runs under auditd, which reports from the kernel — not something a compromised userland process can quietly skip.
Entering the box and controlling it are two different events, gated by two different secrets on two different channels.
A 95-second replay cache sits behind the check itself, so a captured valid code can't be reused even once.