Building a Certification Homelab — Part 2: Security+ Lab and Beyond

What This Part Covers

By the end of Part 2 you'll have a fully functional security operations lab running on the same Proxmox host as your Network+ environment:

• Security Onion — a real SIEM/IDS platform watching your lab traffic
• Kali Linux — a fully equipped attacker workstation
• Metasploitable 2 — a safe, intentionally vulnerable target
• Windows Server with Active Directory — enterprise authentication lab
• OpenVAS — a real vulnerability scanner

More importantly, you'll run actual attack scenarios and watch your detection tools catch them in real time — the same workflow a SOC analyst uses every day.

Part 4 — Security+ Lab

Architecture

The Security+ lab lives on its own isolated bridge (vmbr2) — completely separate from your home network and your Network+ lab. Nothing on vmbr2 can reach the internet or your home devices unless you explicitly route it through pfSense, and for this lab you won't.

+----------------------------------------------+
|         Security+ Lab (vmbr2 - isolated)      |
|                                              |
|  +-------------+    +---------------------+  |
|  |  Kali Linux |--->|  Metasploitable 2   |  |
|  |  (attacker) |    |  (vulnerable target) |  |
|  +-------------+    +---------------------+  |
|         |                    |               |
|         +--------+-----------+               |
|                  |                           |
|         +--------v----------+                |
|         |  Security Onion   |                |
|         |  (watches it all) |                |
|         +-------------------+                |
|                                              |
|  +--------------------------+                |
|  |  Windows Server (AD)     |  < vmbr3       |
|  |  Windows 10 Client       |                |
|  +--------------------------+                |
+----------------------------------------------+

Security Onion has two network interfaces: one on vmbr0 so you can access its web dashboard from your host machine, and one on vmbr2 in promiscuous mode — meaning it silently captures and analyzes every packet on the bridge without participating in the traffic. This is exactly how a real network tap or SPAN port works in a SOC environment.

Step 1 — Plan Your IP Scheme

Before creating anything, decide on an IP scheme for the Security+ lab. A clear plan prevents confusion when you have multiple VMs talking to each other. Here's a sensible starting point:

Step 2 — Install Security Onion

What is Security Onion?

Security Onion is a free, open source Linux distribution purpose-built for network security monitoring, intrusion detection, and log management. It bundles several professional security tools into a single platform:

• Suricata — a real-time intrusion detection/prevention system (IDS/IPS) that analyzes network traffic and fires alerts when it detects known attack signatures
• Zeek (formerly Bro) — a network analysis framework that logs detailed records of every connection, DNS query, HTTP request, and more
• Elastic Stack — Elasticsearch, Logstash, and Kibana for storing, processing, and visualizing all this data
• SOC Dashboards — pre-built views for alert triage, threat hunting, and incident investigation

In a real SOC, a platform like this might be running on a rack of servers processing gigabits of traffic. In your lab, it runs on a single VM and watches your virtual lab network — but the interface and workflow are identical. This is hands-on preparation for real SOC analyst work.

Download: Go to securityonionsolutions.com/software and download the ISO.

Create the Security Onion VM:

Network interfaces — this is important:

After creating the VM, add two network interfaces:

• Interface 1 (vmbr0) — management: this is how you access the web UI from your host machine
• Interface 2 (vmbr2) — monitoring: Security Onion will watch all traffic on this bridge in promiscuous mode

Install Security Onion:

Boot the VM and follow the installer. When asked for the setup type, choose Evaluation mode — it's a single-node setup that combines all components on one VM, which is exactly what we want for a home lab.

During setup:

• Management interface: ens18 (the vmbr0 interface) — this gets an IP and is how you reach the dashboard
• Monitor interface: ens19 (the vmbr2 interface) — no IP assigned, promiscuous capture only

Installation takes 15–30 minutes. After it completes, access the web dashboard from your host browser using the management IP Security Onion configured.

Step 3 — Install Kali Linux

What is Kali Linux?

Kali is a Linux distribution maintained by Offensive Security, preloaded with hundreds of security and penetration testing tools. It's the standard platform for ethical hackers, pentesters, and security researchers. In your lab it's your "attacker" machine — you'll use it to run scans and exploits against Metasploitable and then watch Security Onion detect them.

Why use Kali instead of just installing tools on Ubuntu? Because Kali comes pre-configured for offensive security work — the tools are installed, the paths are set, and the configurations are tuned. It also means when you look up guides and exercises, the commands will work exactly as written.

Download: Go to kali.org/get-kali/#kali-installer-images and download the 64-bit installer ISO. Upload it to Proxmox.

Create the Kali VM:

Install Kali normally. The installer will prompt you to create a user and password during setup.

After installation, update Kali before doing anything else:

sudo apt update && sudo apt full-upgrade -y

Key tools in Kali (all pre-installed):

Step 4 — Install Metasploitable 2

What is Metasploitable?

Metasploitable is a Linux VM intentionally built full of known vulnerabilities. It was created by Rapid7 (the company behind Metasploit) specifically as a safe, legal target for practicing attacks. Every service running on it has deliberate security flaws — outdated software, weak credentials, misconfigured services.

This is important: you need a legal target to practice on. You cannot run attack tools against systems you don't own. Metasploitable gives you a target where running attacks is not only legal but the entire point.

Download: Search for "Metasploitable 2 download" — it comes as a .zip file containing a .vmdk disk image (VMware format).

Import the disk into Proxmox:

Metasploitable doesn't come as an ISO — it comes as a pre-built virtual disk. You need to import it into Proxmox:

1. Upload the .vmdk file to your Proxmox host via SCP:

scp metasploitable.vmdk root@192.168.1.10:/tmp/

2. Create a new VM in Proxmox with these settings:

   • Name: metasploitable
   • RAM: 1 GB
   • CPU: 1 core
   • Network: vmbr2
   • Do not add a disk during creation — skip the disk step

3. Note the VM ID that Proxmox assigns (visible in the left panel). Then import the disk from the Proxmox shell:

qm importdisk [VMID] /tmp/metasploitable.vmdk local-lvm

4. In the VM's Hardware tab, the imported disk appears as "Unused Disk 0" — click it, select Edit, and attach it as the primary disk. Also go to Options and set the boot order to boot from this disk.

Default credentials: msfadmin / msfadmin

Step 5 — Set Up Windows Active Directory

What is Active Directory?

Active Directory (AD) is Microsoft's directory service — it's how enterprises manage users, computers, groups, and permissions across Windows networks. If you work in IT, you will encounter Active Directory. It's the backbone of authentication and authorization in virtually every corporate Windows environment.

Understanding AD is important for Security+ because:

• Kerberos — the authentication protocol AD uses — is heavily tested
• Group Policy — how AD enforces security configurations across an organization — is a key concept
• Common AD attacks (Pass-the-Hash, Kerberoasting, privilege escalation) appear in both Security+ and more advanced security certs

Download Windows Server:

Microsoft offers free 180-day evaluation ISOs — no credit card required:

• Go to microsoft.com/en-us/evalcenter/evaluate-windows-server-2022
• Download the ISO and upload it to Proxmox

Create the Windows Server VM:

Why vmbr3 instead of vmbr2? The Windows AD lab is kept separate from the Kali/Metasploitable environment. You'll eventually practice AD attacks from Kali, but you want to control when that happens — not have your domain controller accidentally exposed to the attack bridge at all times.

Install Windows Server and promote to Domain Controller:

After installing Windows Server from the ISO:

1. Open Server Manager → Manage → Add Roles and Features
2. Select Active Directory Domain Services and install it
3. After installation completes, click the yellow flag notification → Promote this server to a domain controller
4. Choose Add a new forest and name your domain (e.g., lab.local)
5. Set a DSRM (Directory Services Restore Mode) password — keep it safe
6. Accept the remaining defaults and complete the wizard
7. The server will reboot as a domain controller

Add a Windows 10 client:

Download a Windows 10 evaluation ISO from Microsoft (search "Windows 10 Enterprise evaluation ISO"), create a VM (4GB RAM, connected to vmbr3), and join it to your lab.local domain:

1. On the Windows 10 VM: Settings → System → About → Join a domain
2. Enter lab.local and provide Domain Admin credentials
3. Reboot — the machine is now domain-joined

AD exercises to practice:

• Create users and organize them into groups (e.g., IT, Finance, Management)
• Create a Group Policy Object (GPO) that restricts desktop settings for the Finance group
• Run gpresult /r on the Windows 10 client to see which policies are applied
• Disable a user account and attempt to log in — observe what happens
• Open Event Viewer on the Domain Controller and examine the Security log — look for login events (Event ID 4624 for successful logins, 4625 for failures)
• Try a bad password multiple times and find the lockout event in the security log

These exercises build exactly the skills Security+ tests in its identity and access management domain.

Step 6 — Run Your First Attack Scenario

This exercise ties everything together. You'll run a scan from Kali, watch Metasploitable respond, and observe Security Onion detect the activity in real time — the complete attacker/defender loop.

Prerequisites: Kali, Metasploitable, and Security Onion are all running. Security Onion is monitoring vmbr2.

Exercise 1 — Port scan and detection:

On Kali, open a terminal:

# Discover what's on the network
nmap -sn 10.20.20.0/24

# Run a full service and OS detection scan against Metasploitable
nmap -sV -O 10.20.20.20

The -sV flag probes open ports to determine what service and version is running. -O attempts OS fingerprinting. Against Metasploitable you'll see dozens of open ports — services that would be considered catastrophically insecure on any real system.

On Security Onion, open the web dashboard and navigate to Alerts. You should see Suricata alerts triggered by the scan. This is exactly what a SOC analyst sees when a scan is detected on a real network.

What to observe:

• Which ports are open on Metasploitable (there will be many — it's intentional)
• What Suricata classifies the activity as and what severity it assigns
• The Zeek connection logs showing the full timeline of the scan
• How quickly Security Onion detected and alerted on the activity

Exercise 2 — Simple exploitation:

From Kali, launch Metasploit:

msfconsole

Search for a module targeting one of Metasploitable's known vulnerable services (vsftpd 2.3.4 is a classic — it has a backdoor):

search vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 10.20.20.20
run

If it works, you'll get a shell on Metasploitable. In Security Onion, you should see alerts for the exploit attempt. Compare the alert timeline to when you ran the exploit.

Why this matters: Understanding how attacks work at a technical level is what makes a good defender. You can't write effective detection rules or interpret alerts correctly without knowing what the attacker is actually doing. Security+ expects you to understand both perspectives.

Step 7 — Vulnerability Scanning with OpenVAS

What is a vulnerability scanner?

A vulnerability scanner automatically checks a system for known weaknesses — unpatched software, misconfigured services, weak passwords, default credentials, and more. It compares what it finds against a database of known vulnerabilities (CVEs) and produces a prioritized report.

Security+ covers vulnerability scanning as a key defensive technique. Understanding how to run a scan and interpret its output is a real, practical skill you'll use in IT and security roles.

Install OpenVAS (Greenbone) on Kali:

sudo apt update && sudo apt install openvas -y
sudo gvm-setup
sudo gvm-start

The setup takes several minutes — it downloads a large vulnerability database. Access the web UI from inside the Kali VM at https://127.0.0.1:9392.

Run a scan against Metasploitable:

1. In the Greenbone web UI: Scans → Tasks → New Task
2. Set the target to Metasploitable's IP (10.20.20.20)
3. Choose a scan configuration — "Full and fast" is good for practice
4. Start the scan and wait — it will take 15–30 minutes

Reviewing the results:

When the scan completes, it generates a report with findings organized by severity (Critical, High, Medium, Low, Info). For each finding you'll see:

• The CVE identifier (e.g., CVE-2011-2523)
• A description of the vulnerability
• The CVSS score (a standardized severity rating from 0 to 10)
• Remediation recommendations

Metasploitable will have dozens of Critical and High findings — it's designed that way. The exercise is learning to read and prioritize a vulnerability report, which is exactly what a security analyst does.

Security+ Lab Exercises Checklist

• Install Security Onion in Evaluation mode
• Verify the Security Onion web dashboard loads from your host browser
• Install Kali Linux and update it fully
• Import and boot Metasploitable 2
• Confirm Kali, Metasploitable, and Security Onion monitoring are all on vmbr2
• Run nmap -sn from Kali to discover Metasploitable
• Run a full port scan and observe the alert in Security Onion
• Use Metasploit to exploit a service on Metasploitable
• Capture and analyze the exploit traffic in Wireshark
• Install Windows Server and promote it to a Domain Controller
• Create users and groups in Active Directory
• Apply a Group Policy and verify it on a Windows 10 client
• Run an OpenVAS vulnerability scan against Metasploitable
• Review and interpret the vulnerability scan report
• Simulate a brute-force attack with Hydra and find it in Security Onion logs
• Identify Indicators of Compromise (IoCs) in Security Onion

Part 5 — Future Labs

Your Proxmox setup scales naturally into every major cert path. Here's how to expand when you're ready. The key insight is that each addition builds on top of what you've already set up — you're not starting over, just adding VMs and containers to the same Proxmox host.

Linux+ Lab

CompTIA Linux+ tests your ability to administer Linux systems at an intermediate level: file permissions, processes, package management, shell scripting, systemd, storage management, and networking.

What to add:

Key topics to practice:

• File permissions with chmod, chown, and umask
• User and group management (useradd, groupmod, /etc/passwd)
• Process management (ps, top, kill, systemctl)
• Package management (apt on Ubuntu, dnf on Rocky)
• Shell scripting — automate repetitive tasks with Bash
• Log analysis with journalctl and /var/log/
• Cron jobs for scheduled tasks
• LVM (Logical Volume Manager) for flexible storage management

Cloud+ / AWS / Azure Labs

Cloud certifications test your understanding of cloud infrastructure, services, and security. You can practice locally using a simulator before ever touching a real cloud account.

Local simulation — LocalStack:

LocalStack runs inside a Docker container and emulates AWS services (S3, EC2, Lambda, IAM, and more) on your local machine — no AWS account needed and no risk of unexpected charges.

# Install Docker first, then:
pip install localstack awscli-local
localstack start

You can run AWS CLI commands against localhost as if it were real AWS. Great for learning IAM policies, S3 bucket operations, and Lambda functions without any cost.

Free tier cloud accounts:

When you're ready for real cloud practice:

• AWS Free Tier — 750 hours of EC2 per month free for 12 months
• Azure Free Account — $200 credit plus always-free services
• Google Cloud Free Tier — $300 credit for 90 days

Infrastructure as Code:

Once comfortable with cloud basics, learn Terraform — the standard tool for defining infrastructure in code files rather than clicking through web consoles. You can use it against LocalStack for practice before touching real cloud resources.

CySA+ / PenTest+ Lab

These are the natural next steps after Security+.

CySA+ (Cybersecurity Analyst) focuses on defense: threat hunting, log analysis, incident response, and security operations.

Add to your existing Security+ lab:

• Wazuh — open source SIEM/XDR that integrates with Elastic Stack. More feature-rich than Security Onion for detection rule tuning
• TheHive — incident response platform for tracking and managing security incidents through their full lifecycle
• MISP — threat intelligence platform for sharing and consuming indicators of compromise
• Additional Windows clients to generate realistic log noise

PenTest+ focuses on offense: planning and executing penetration tests professionally.

Expand your Kali setup with:

• BloodHound — maps Active Directory relationships visually and identifies attack paths to Domain Admin
• Burp Suite — web application security testing proxy
• OWASP WebGoat — deliberately vulnerable web application for practicing web security
• HackTheBox VMs — download retired machines and import them as Proxmox VMs for structured practice

Kubernetes / CKA Lab

Kubernetes (K8s) is the dominant container orchestration platform in production environments. The CKA (Certified Kubernetes Administrator) is one of the most valued cloud-native certifications.

k3s is a lightweight Kubernetes distribution that runs comfortably on VMs without the full resource requirements of standard Kubernetes:

# On a fresh Ubuntu VM, install k3s:
curl -sfL https://get.k3s.io | sh -

A practical 3-node cluster needs:

• 1 control plane VM: 2 GB RAM, 2 vCPU
• 2 worker VMs: 2 GB RAM, 1 vCPU each

That's only 6 GB total RAM — easily fits in the reserve pool from Part 1's resource budget.

Lab Expansion Roadmap

Now (2026)
|
+-- Network+ Lab --------------------------> CompTIA Network+
|
+-- Security+ Lab -------------------------> CompTIA Security+
|
+-- (Add) Linux VMs ------------------------> CompTIA Linux+
|
+-- (Add) LocalStack / Free Tier -----------> AWS CLF-C02 / AZ-900 / Cloud+
|
+-- (Add) Wazuh + TheHive ------------------> CompTIA CySA+
|
+-- (Add) BloodHound + Burp Suite -----------> CompTIA PenTest+
|
+-- (Add) k3s cluster ----------------------> CKA / CKAD

You don't need to plan all of this now. Build the Network+ lab first, use it while you study, then expand when you're ready for the next cert. The Proxmox foundation supports all of it.

Part 6 — Study Tips and Resources

Recommended Learning Order

This sequence builds skills in the right order — each step prepares you for the next:

1. Install Proxmox → get comfortable with the UI, create VMs and containers, understand bridges and snapshots
2. Build the Network+ lab → pfSense, DHCP, DNS, VLANs
3. Study Network+ content (Professor Messer) while actively using the lab — the hands-on experience makes the concepts stick
4. Build the Security+ lab → Security Onion, Kali, Metasploitable
5. Do TryHackMe "Pre-Security" and "SOC Level 1" paths alongside the lab — they provide structured exercises that complement the open-ended lab environment
6. Study Security+ content while practicing in the lab
7. Take the exams when you're consistently passing practice tests at 85% or above

Free Resources

Key Commands Reference

Proxmox (run in host shell):

qm list                          # list all VMs and their status
qm start [vmid]                  # start a VM
qm stop [vmid]                   # stop a VM
pct list                         # list all LXC containers
qm snapshot [vmid] [name]        # take a named snapshot
qm importdisk [vmid] [file] [storage]  # import a VM disk image

Kali / Security tools:

nmap -sn [network/cidr]          # host discovery — find live hosts
nmap -sV -O [target]             # service version and OS detection
nmap -sC [target]                # run default NSE scripts against target
msfconsole                       # launch Metasploit framework
searchsploit [keyword]           # search local CVE/exploit database
hydra -l admin -P /wordlist [ip] [service]  # brute-force login
nikto -h [target]                # web vulnerability scanner

Active Directory (Windows):

gpresult /r                      # show applied Group Policies
Get-ADUser -Filter *             # list all AD users (PowerShell)
Get-ADGroupMember "Domain Admins"  # list members of a group
net user [username] /domain      # show user details
eventvwr                         # open Event Viewer

Proxmox VE 8.x · Security Onion 2.x · Kali Linux 2024.x Metasploitable 2 · Windows Server 2022 · OpenVAS / Greenbone ThinkPad P14s Gen 2 AMD — Ryzen 5850U · 48GB RAM