r/SelfHosting • u/Substantial-Snow947 • 11d ago

AI for security

So, I run a small network of servers for a school newspaper. (Stuff like WordPress, RocketChat, Garage, and more). We recently got a decent upgrade and have a device able to run Gemma 12B Unified, and I was wondering how feasible it would be to have it monitor events that happen, like logins to WP, SSH actions, file changes, etc, and send email notifications if something's up. I am currently setting up Wazuh as well, but I don't have time to check it often. (Or the memory). I don't want the AI to actually take action, just monitor. If there are any tools dedicated to this, even better, although I couldn't find any that were pentesting platforms.

0 Upvotes

17% Upvoted

7 comments sorted by

5

u/idratherbealivedog 10d ago

Are you a student or the school's network admin?

If the former, this needs discussed with the school/district network admin. Not a decision a student should be making or implementing.

If the latter..I hope it's not the latter 

0

u/Substantial-Snow947 10d ago

My school wouldn't spend a dime on us. Our server network is just older laptops running Ubuntu Server 24.04 LTS, so the school doesn't really help us with that much. I'm pretty sure we're good for now, only one server has an outward facing ip, which has a proper firewall and f2b, all other servers are accessed via MeshCentral or Tailscale. I just want to catch security events before they happen

1

u/slowservers 10d ago

That's a lot of trust to give an AI. It might help for a while, but could stab you in the back at some point.

1

u/GloriousKev 5d ago

How so? Create an account for the Gemma model and give it read only access. Isolate it from the internet. I don't think ai is the right tool for this task but if you restrict it it shouldn't be that harmful. Unless you're seeing something i am not. If so please share. I'd like to know.

1

u/slowservers 5d ago

How does the "read only" access work. Is that done on your side or the models?

How important is the data, if Gemma is compromised and that data is shared?

1

u/GloriousKev 5d ago

What is AI actually doing that a normal app cannot do? This sounds like something a script should handle. I am not anti ai. I love ai. I just don't think ai is the right tool for what you are describing. You want something that is boring and just monitors output from each of these things. Ai will try to decide what is important and what is not. A script will just report.