Tagged: Homelab
15 posts · browse all tags
-
Host-Based Detection Part 5: Enrolling a Real, Mixed Fleet
A manager with no agents is an expensive way to look at an empty dashboard. What actually happens enrolling a real Raspberry Pi, and separately a genuinely mixed Linux-and-Windows lab fleet, into Wazuh.
-
Host-Based Detection Part 4: Standing Up a Manager, Two Different Ways
Two real Wazuh managers already exist on this site's infrastructure, built for opposite reasons. What the contrast between a shared homelab instance and a disposable lab one actually teaches about sizing and placement.
-
From Dropbox to Daily Driver Part 1: Scoping the Rebuild and the Threat Model
The same Raspberry Pi 4 that played an attacker's call-home dropbox in Part 5 of the empty-port series gets reflashed as a legitimate, hardened remote-access device — starting with the threat model and the OS and storage decisions that shape everything after it.
-
From Dropbox to Daily Driver Part 2: Flashing the Card and the First Boot
Burning the 128GB microSD card, working through Raspberry Pi Imager's customisation screen — hostname, auth, and Raspberry Pi Connect left off — and a real first SSH login to the freshly flashed Pi, with the version-mismatch story between Raspberry Pi's downloads page and GitHub along the way.
-
From Dropbox to Daily Driver Part 3: Locking Down the Base OS
Real SSH keys installed on the Pi (with a genuine known_hosts detour left from the reflash), password auth switched off despite a cloud-init drop-in fighting back, a default-deny ufw firewall, unattended upgrades with a Debian-vs-Ubuntu config gotcha, and why fail2ban doesn't make the cut.
-
From Dropbox to Daily Driver Part 4: Adding TOTP Two-Factor Authentication
Real TOTP 2FA layered on top of key-only SSH: libpam-google-authenticator, PAM and sshd_config chaining, making the second factor mandatory, and a login that hung for reasons that turned out to have nothing to do with PAM at all.
-
From Dropbox to Daily Driver Part 5: Cloudflare Tunnel, Zero Trust Access, and a WebSocket That Wouldn't Handshake
Putting this Pi behind a Cloudflare Tunnel and a Zero Trust Access policy so it's reachable from anywhere without a single inbound port open, plus a real ingress bug that took a debug session and a cross-checked log to actually find.
-
From Dropbox to Daily Driver Part 6: Standing Up a Wazuh Manager, and Why the VM Wouldn't Boot
Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
From Dropbox to Daily Driver Part 8: An Ansible Control Node, a Second Pi, and What changed=0 Actually Proves
Turning seven parts of manual hardening into something a machine can run: a dedicated Ansible control node, a second Pi built specifically to prove reproducibility, a real gotcha in check mode explained honestly, and a second playbook run that changed nothing at all.
-
From Dropbox to Daily Driver Part 9: The Closing Checklist, and What Actually Changed Since Part 5
A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.
-
Route Leaking Between VRFs on FortiGate: What Happens When You Actually Build It
I set out to build the BGP leak-target VRF route-leaking mechanism from my own earlier post, on a real FortiGate 70G. It hit three undocumented platform quirks in a row. The real answer turned out to be a static route over a VDOM-link — no BGP required.
-
Building an Enterprise-Grade NTP Service with chrony and Integrating it with FortiGate: Chronos Keeps Time
Why we chose chrony over ntpd and timesyncd, what CIS and Fortinet hardening guides say about NTP, a full build walkthrough, the deny-all ordering mistake every network engineer will make, and how to generate NTP keys that FortiOS will actually accept.
-
Pairing a FortiGate and FortiSwitch the Right Way, Part 1: Get the Firmware Right First
Before a FortiGate and FortiSwitch will even talk to each other over FortiLink, both need to be on compatible, fully-patched firmware — and NTP/DNS need to be solid. Part 1 covers the upgrade plan we should have run before touching FortiLink at all.
-
Pairing a FortiGate and FortiSwitch the Right Way, Part 2: FortiLink, and Where We Actually Went Wrong
The FortiLink handshake looks trivial in the docs: cable it in, authorize, done. Ours didn't go that way. Part 2 walks the correct pairing process, then dissects exactly where — and why — our first attempt stalled, with the redo plan for when we factory-reset both boxes.