Max Anderson
First-year cybersecurity student at Victoria University of Wellington. I run a public-facing Ubuntu server on a campus network I do not control. One disclosure to the university, acknowledged and reviewed. Detection tooling in Python, running from cron.
Findings and tooling.
VLAN segmentation disclosure
Two segments of the campus network enforce different egress policy. Which segment a device lands in follows the switch port, not the user or the device. Verified by re-testing the same port under DHCP instead of static addressing, then recording permitted and dropped protocols from each segment with Wireshark and tcpdump. Reported to VUW network engineering, escalated to the university cybersecurity team.
SSH brute-force alerter
Python, standard library only. Runs from cron, reads auth.log, aggregates failed logins by source IP and posts to Discord above a threshold. Records the set of usernames tried per IP, which separates untargeted scanners from attempts against real accounts. Alerts only, does not ban. fail2ban handles banning at three failures per hour.
Home lab hardening
Ubuntu Server 24.04 on an HP EliteDesk 800 G1, on a shared campus network with no router under my control. Key-only SSH, root login disabled, over 15 unused services turned off. UFW default-deny inbound, plus a DOCKER-USER chain rebuilt at every boot because published Docker ports bypass UFW. fail2ban at three failures per hour. All public traffic over an outbound Cloudflare Tunnel.
The server.
HP EliteDesk 800 G1, Ubuntu Server 24.04, in service since 2025. No cloud host. nginx listening on localhost only, reached through an outbound Cloudflare Tunnel, with no inbound ports open to the internet. A+ on securityheaders.com. Five Docker Compose services, monitored by Uptime Kuma, with drive health checked on a schedule by smartctl.
Reading for a Bachelor of Engineering with Honours, majoring in Cybersecurity at Victoria University of Wellington. Class representative for all four first-trimester papers (COMP102, ENGR101, ENGR121, CYBR171) and for three of the four this trimester (ENGR110, ENGR123, CGRA151). Placed 1st in New Zealand in the 2024 International Bebras Computational Thinking Challenge.
This trimester.
First year, second trimester, four papers. Class rep for three of them. The server runs year round.
this trimester
- COMP103 data structures and algorithms
- ENGR110 class rep
- ENGR123 class rep
- CGRA151 class rep
last trimester
- COMP102 class rep
- ENGR101 class rep
- ENGR121 class rep
- CYBR171 class rep
on the lab
- ssh alerting armed
- 6 segmented vlans
- outbound-only tunnel
- this page served from it
What I use.
Everything below runs on the server, not only in coursework. This page is plain HTML, CSS and JavaScript with a hand-written canvas renderer. No frameworks, no libraries, no trackers.
security
traffic analysis, hardening, intrusion detection, disclosure practice, fail2ban
networking
VLANs, firewalls, DNS, reverse proxies, Cloudflare Tunnel
systems
Linux daily driver, KVM/virt-manager, Docker Compose, Forgejo, self-hosting, hardware & soldering
code
Python, Java, vanilla JS/canvas · COMP103 · ENGR110 · ENGR123 · CGRA151
Get in touch.
Looking for a cybersecurity internship or part-time technical work in Wellington. Email is fastest.