The tower that defends itself

How the tower watches, closes, locks down — and refuses an unknown key.

Why the tower learned to defend itself

On the internet, machines are scanned constantly. Every day, unknown addresses try to connect, to test a password, to find an open door. You do not notice it until you look at the logs. The tower has been watching its own for weeks. What it saw settled the rest: building is not enough. You also have to defend.

One night, the tower counted 199 unwanted connections from unknown addresses and closed them at the firewall, without touching a single legitimate one.

The gestures of defence

Defending yourself is not one big door. It is five simple gestures:

• Watch — the tower notes who connects, at what time, from which address;
• Close — addresses that have no business there are blocked at the firewall, with one replayable command;
• Lock — in case of alert, the tower cuts all access except its pilot's session, in about thirty seconds;
• Isolate — a machine on the network that raises questions can be cut off from the rest without cutting the others;
• Remember — every step is dated and kept: you know who did what, when.

The emergency lock is the most striking gesture: in about thirty seconds, the site cuts itself off from the rest of the world, leaving only the working session open. It was tested: while everything was going down, the pilot's session stayed intact.

When an unknown key knocks at the door

One day, an SSH key was added to the tower's keyring without going through the pilot's decision. It carried a read-only restriction, but the night watch had never seen it. From the first connections with that key, the tower wrote in its journal:

Eight close readings, all dated and kept. The tower did not play down what it did not recognise: it flagged every connection as unusual and told its pilot — probably through connexions-ssh.sh, the guard-rail « every SSH connection is reported ». The exact confirmation rests with Victor, the team's security agent.

The lesson of the incident is simple. The key was legitimate — but legitimate is not approved. The tower soon gave itself a rule: every unknown key creates a decision to be made, carrying the detail « ALERTE cle SSH inconnue », and stays refused until someone validates it. The pilot decides, never the machine alone.

How we test the guard-rail that guards the door

A door you never opened is not a door: it is a set decoration. The tower checks its own with a red-first test: we add a test key and wait for the tower to refuse it — the red test, which shows the guard-rail is missing or can be bypassed. Then we install the guard-rail and rerun the same test: it must fail for the key, not for the tower — the green test. Refuse before building, then prove: the two go together.

Since then, every key in the keyring is write-locked (mode 400, immutable files): nobody — not even the pilot — can add a key by hand before the decision is approved. The door is closed by the rule, and the rule is tested.

And all the other doors

A key only protects one door. The tower has several, and each one has its own guards:

• Passwords have been cut off. Connections are made only with a public key (SSH), never with a password. Password login is disabled, and connecting as root is forbidden. Try to connect with a password: the tower refuses.
• fail2ban watches the attempts to get in. Three jails (remote control and two doors of the internal management) ban the addresses that try too often without success. A password tried again and again is only noise that ends up banned.
• Almost no door is open to the Internet. The tower leaves only what it needs to be visited and administered — and nothing else. Everything else is closed, and the closure is checked twice over: the host on one side, and the passage through which applications could open without permission on the other. A container that published a port at night would fall into the void.
• The sentinel keeps watch when everything else sleeps. The lockdown cuts the site — but who watches the tower if all its watchers are dead? The sentinel sends a backup email directly, without going through the services it watches. A tower that can no longer alert is no longer a control tower.
• Confidentiality mode is everywhere. Before being displayed, every tool output passes through a filter that masks sensitive-data keywords (listed in a hand-maintained register, fed by GDPR and the CNIL): a command output does not show an API key or personal data. If an agent wants to show a raw output, the unlock is written in black and white in the rules — and it expires by itself.
• The surveillance cockpit. Who is working? Who connected? Which circuit is stuck? Doors of the cockpit show the state of the agents, the circuits, the tests — and who came to the site. Surveillance is not a journal nobody reads: it is a board you look at.

How to test without cutting yourself

Before locking down, the tower simulates it: it reproduces exactly what would happen. It says which connections would survive and which would be cut. It concludes clearly: « your session would survive » or « careful, you would be cut ». You can repeat the exercise safely, as often as you like.

What we do not promise

No machine can promise perfect security, and neither can the tower. It does not promise to block absolutely everything, nor to protect what is not connected to it. What it promises is a method: watch, measure, close, remember. And a pilot who keeps the hand on the decisions that matter.

How to verify it yourself

The tower's demo is open, and the way it works shows in a few minutes: look at the state of the services, see who connected, run a check. If you wonder how a machine can defend itself without cutting its own head off, now is the time to ask for the demo.