MICROS training center
Purple Team training lab across 15 workstations
A 15-seat teaching lab where every station is both attacker and defender — Kali on bare metal hosting an Ubuntu Suricata sensor, rolled out entirely by script over SSH.
- Security
- Deployment
- Linux
01 Problem
The MICROS training center needed a repeatable, self-contained lab for its "Purple Team — Offensive & Defensive Security" course: 15 identical student stations, each able to both launch and detect attacks, isolated from the production network.
02 Approach
Designed and deployed a two-layer environment on 15 machines. Each station runs Kali Linux with KDE Plasma on bare metal — chosen over a VM because the desktop rendered poorly virtualized — hosting an Ubuntu VM that acts as a Blue Team sensor.
The Ubuntu sensor runs Suricata IDS/IPS plus DVWA/bWAPP for SQL-injection practice and a Flask dashboard; the Kali host acts as the attacker with an interactive attack-generator script used to verify Suricata rules fire.
The hypervisor runs in bridged mode so machines can see each other, defaulting to a host-only 192.168.56.0/24 range, with a server hosting Windows Server and Windows 11 targets for service enumeration.
After installing Kali on all 15 machines, I rolled out the Ubuntu VMs and provisioning entirely over SSH using deployment scripts, including a KDE-provisioning script I wrote, tuned to run in ~4 GB RAM.
03 Stack
- Kali Linux (KDE)
- Ubuntu
- Suricata
- DVWA / bWAPP
- Flask
- Windows Server
- Windows 11
- Bridged / host-only virtual networking
- SSH-based scripted deployment
- VMware
04 Result
A 15-seat lab where every seat is both attacker and defender, deployed by script rather than by hand, using VMware as the hypervisor for the Ubuntu sensor VMs.
05 What broke, and what fixed it
-
Bare metal over VM
Kali runs on the host because KDE Plasma rendered poorly virtualized.
-
Scripted rollout
15 sensor VMs provisioned over SSH, not clicked through 15 times.
-
Memory budget
KDE provisioning script tuned to run inside ~4 GB RAM.