Defensive › Module 1 › Lesson 2
RoE Written Scope
If it is not written, it is not in scope — draft YOUR defensive RoE for $LAB_HOST.
Visual · defense_roe_written_scope
RoE = written who / what / when / stop. $LAB_HOST only. Original Cyberlium.
Opening
Curiosity is not authorization. A file you chmod 600 is.
Rules of Engagement for defensive labs answer: which host ($LAB_HOST you control), which operator (you on your hardware), which actions (read config, apply baseline, enable logging per brief), where notes live ($HOME/cyberlium-lab), and stop conditions (any host not $LAB_HOST, production employer assets without ticket, stranger LANs, café gateways). Original Cyberlium. You draft RoE before hardening commands touch a shell. You do not copy a bug-bounty scope and aim it at a school network. Next: Your Hosts Only.
1. Four RoE lines: who, what, where, stop
Who: the host owner (you) on hardware you control. What: read/harden/log on $LAB_HOST only per lab brief. Where: notes under $HOME/cyberlium-lab, mode 600. Stop: any hostname or IP not $LAB_HOST, employer production without ticket, dorm LAN sweeps, café router admin pages.
Written scope is how you refuse 'harden my roommate's PC' in Discord. Their machine needs their RoE — not your admin session.
Command guide
Try these commands — Four RoE lines: who, what, where, stop
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
ss — https://man7.org/linux/man-pages/man8/ss.8.html
journalctl — https://www.freedesktop.org/software/systemd/man/journalctl.html
═══ INSTALL ═══
Linux (Debian/Ubuntu): Built-in (iproute2)
macOS: Use: netstat
Windows: Use: netstat
═══ LINUX / macOS ═══
Command — copy this
ss -tulpn | head -30 journalctl -n 15 --no-pager 2>/dev/null | head -20 || dmesg | tail -15 mkdir -p "$HOME/cyberlium-lab/t16-defense" ss -tulpn > "$HOME/cyberlium-lab/t16-defense/baseline-ports.txt"
Primary tools to practice this lesson: ss, journalctl. Reference sites: ss (https://man7.org/linux/man-pages/man8/ss.8.html); journalctl (https://www.freedesktop.org/software/systemd/man/journalctl.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authorization is not 'I have admin on my laptop'
Local admin on your box does not grant permission on networks you do not operate. Scope is host-level: $LAB_HOST is in; everything else is out until a signed engagement says otherwise — this course is not that engagement.
Professional defenders attach RoE to change tickets and contracts. Steal the habit (write scope, respect stop) and leave stranger hosts alone.
3. Stop conditions you can say out loud
If the target is not $LAB_HOST in your file, stop. If someone asks you to scan the dorm subnet, stop. If a tutorial hardens a public cloud IP you do not own, stop and rewrite to $LAB_HOST.
Next lesson locks the host boundary: YOUR lab VM or workstation only, not bridged stranger LANs.
4. What you ship: four written RoE lines for defensive work
who/what/where/stop on disk. $LAB_HOST named. NEVER stranger hosts, LAN sweeps, café routers. chmod 600.
5. What you record before the next lesson
Date. Four RoE lines. $LAB_HOST named. File t16-m01-l02-roe-scope.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Keep RoE 'in your head.' nmap the dorm hallway subnet because it is 'defensive recon.'
Right
Write four lines and stop conditions. Next: Your Hosts Only.
Mission: freeze defensive RoE before hardening
1) Write who/what/where/stop in $HOME/cyberlium-lab. 2) Name $LAB_HOST as the only in-scope host. 3) List stop conditions including stranger LANs and employer production. Never scan visible neighbor devices.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for a RoE template shape — not for a list of dorm IPs to scan.
Knowledge Check
APPLY: A classmate shares their laptop IP and says 'practice hardening.' Your RoE lists only $LAB_HOST. You:
Multiple choice
Knowledge Check
APPLY: True or False: Owning admin on your PC authorizes hardening any reachable host.
True or False
Knowledge Check
APPLY: RoE 'stop' should include:
Multiple choice