Tagged: Raspberry Pi
11 posts · browse all tags
-
From Dropbox to Daily Driver Part 1: Scoping the Rebuild and the Threat Model
The same Raspberry Pi 4 that played an attacker's call-home dropbox in Part 5 of the empty-port series gets reflashed as a legitimate, hardened remote-access device — starting with the threat model and the OS and storage decisions that shape everything after it.
-
From Dropbox to Daily Driver Part 2: Flashing the Card and the First Boot
Burning the 128GB microSD card, working through Raspberry Pi Imager's customisation screen — hostname, auth, and Raspberry Pi Connect left off — and a real first SSH login to the freshly flashed Pi, with the version-mismatch story between Raspberry Pi's downloads page and GitHub along the way.
-
From Dropbox to Daily Driver Part 3: Locking Down the Base OS
Real SSH keys installed on the Pi (with a genuine known_hosts detour left from the reflash), password auth switched off despite a cloud-init drop-in fighting back, a default-deny ufw firewall, unattended upgrades with a Debian-vs-Ubuntu config gotcha, and why fail2ban doesn't make the cut.
-
From Dropbox to Daily Driver Part 4: Adding TOTP Two-Factor Authentication
Real TOTP 2FA layered on top of key-only SSH: libpam-google-authenticator, PAM and sshd_config chaining, making the second factor mandatory, and a login that hung for reasons that turned out to have nothing to do with PAM at all.
-
From Dropbox to Daily Driver Part 5: Cloudflare Tunnel, Zero Trust Access, and a WebSocket That Wouldn't Handshake
Putting this Pi behind a Cloudflare Tunnel and a Zero Trust Access policy so it's reachable from anywhere without a single inbound port open, plus a real ingress bug that took a debug session and a cross-checked log to actually find.
-
From Dropbox to Daily Driver Part 6: Standing Up a Wazuh Manager, and Why the VM Wouldn't Boot
Every layer this series has built so far assumes I'm the only one who'd ever notice if something went wrong. Standing up a Wazuh manager on pve to actually change that, plus a VM that dropped straight into a rescue shell and a small Proxmox API gotcha on the way there.
-
From Dropbox to Daily Driver Part 7: Wiring the Pi In as a Wazuh Agent
Part 6's Wazuh manager gets its first agent: the Pi, confirmed alerting on SSH/PAM/sudo out of the box, then a real SCA configuration audit against CIS benchmarks, real fixes, real false negatives sorted from real gaps.
-
From Dropbox to Daily Driver Part 8: An Ansible Control Node, a Second Pi, and What changed=0 Actually Proves
Turning seven parts of manual hardening into something a machine can run: a dedicated Ansible control node, a second Pi built specifically to prove reproducibility, a real gotcha in check mode explained honestly, and a second playbook run that changed nothing at all.
-
From Dropbox to Daily Driver Part 9: The Closing Checklist, and What Actually Changed Since Part 5
A closing checklist of every security layer this build actually has and verified, which pieces are Raspberry Pi-specific versus reusable anywhere, and the full-circle comparison back to this same Pi's stint as an attacker's dropbox.
-
Five Minutes and an Empty Port Part 5: Building a Real Call-Home Dropbox on a Raspberry Pi 4
A real LAN Turtle-style dropbox built and tested live on a Raspberry Pi 4: a cloud-init race condition that took three rebuilds to diagnose, and a Cloudflare Tunnel call-home path proven end to end with a real reboot-recovery test.
-
Resilient DNS at Home: Building an HA Pi-hole Pair on Raspberry Pi
A complete walkthrough for installing Pi-hole on a Raspberry Pi running current Raspbian, then turning a single box into a highly available pair using keepalived and Orbital Sync — with the config examples and show commands you'll actually use.