Haydn Cowley

I turned off password logins so only my key works, stopped root logging in and only allowed my own user. I locked myself out once getting there, which taught me the right order: copy the key, check it works, then turn passwords off.

$ ssh -o PubkeyAuthentication=no haydn@<the pi>
haydn@<the pi>: Permission denied (publickey).

How I locked myself out

UFW blocks everything coming in unless I’ve allowed it. I scanned every port from another computer on my network. “Filtered” means the firewall drops the packet without replying, so a scanner can’t tell anything is there. This was before I added more services.

$ sudo nmap -p- <the pi>
Not shown: 65531 filtered tcp ports (no-response)
PORT    STATE SERVICE
22/tcp  open  ssh
53/tcp  open  domain
80/tcp  open  http
443/tcp open  https

Full scan resultsMITRE ATT&CK T1046

Fail2ban watches the login logs. Five wrong logins in ten minutes and that IP is banned in the firewall for an hour, and for longer each time it comes back. I attacked from my Kali Linux VM until it banned me, then unbanned myself.

1. 1
2. 2
3. 3
4. 4
5. 5
6. Banned in the firewall

Build log, 18 OctoberMITRE ATT&CK T1110.001

Lynis checks hundreds of settings and scores them out of 100. I hardened SSH, kernel network settings and file permissions, and turned off protocols I don’t use. Two warnings were false positives, and I left some things on purpose, like a malware scanner that’s too heavy for a 2GB Pi.

What I fixed and what I skipped

I added HSTS, a Content Security Policy and four more headers in Caddy. That got an A, capped because my page had code inside it, so I moved the code into its own file and blocked inline scripts completely. Then it got an A+.

Headers write-up

My Cloudflare rules block common attack paths (WordPress, PHP, .env, .git) and only allow GET and HEAD requests, so these never reach the Pi.

$ curl -s -o /dev/null -w "%{http_code}\n" https://haydnhomelab.com/wp-login.php
403
$ curl -s -o /dev/null -w "%{http_code}\n" -X POST https://haydnhomelab.com/
403

Firewall rules write-up

More than 100 requests in 10 seconds from one IP gets blocked. My first version blocked nothing: I’d matched the path /, which only covers the homepage, and my test was hitting /stats.json. Changing it to /* fixed it.

Firewall rules write-up

Pi-hole blocks ads, trackers and known malware domains on my devices. Unbound looks websites up itself instead of telling one big company every site I visit, and checks DNSSEC, so a domain with deliberately broken signatures gets refused.

# a domain with deliberately broken signatures
$ dig fail01.dnssec.works @127.0.0.1 -p 5335
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL
# the same test site, signed properly
$ dig dnssec.works @127.0.0.1 -p 5335
;; ->>HEADER<<- opcode: QUERY, status: NOERROR
;; flags: qr rd ra ad

Output trimmed. The ad flag means the answer was checked and is genuine.Private DNS write-up

OpenCanary pretends to be eight services that nothing should ever touch, so any connection is a warning sign. It runs as its own user in a locked-down sandbox, and since 27 October it alerts my phone. When I noticed what I typed into its fake login would show publicly, I changed the page to only show common attacker usernames.

• Old SSH server2222
• Telnet23
• FTP21
• MySQL3306
• Remote Desktop3389
• VNC5900
• Redis6379
• NAS login page8081

Honeypot write-up

Every night the Pi backs up its settings, scripts, Jellyfin and Pi-hole to the 1TB drive, encrypted, and keeps the last 14. A backup is only useful if you can restore it, so I decrypted one on my Mac and compared it with the real file.

1. The Pilocks each backup with the public key. It can’t unlock it.
2. 1TB driveonly ever holds encrypted .age files.
3. My Macunlocks it with the private key, which never touches the Pi.
4. Checkthe SHA-256 of the restored firewall rules matched the Pi’s.

Encrypted backups write-up

The first scan found 2 critical and 15 high in my Homepage and Speedtest images. Updating both brought it down to 0 critical and 6 high. The rest are waiting on the apps’ makers to release fixed versions.

Trivy write-up

A GitHub Actions workflow runs gitleaks on every push and every Monday, across every commit, not just the newest. To check it really catches things, Claude committed a fake token to a throwaway repo, and gitleaks flagged it.

The repo on GitHub