Write-ups
What I built, how I attacked it to check it held up, and what went wrong along the way. Each one is a real test on my own Raspberry Pi homelab.
A security email from Cloudflare, and checking it wasn't phishing first
Cloudflare told every Tunnel user to update after eight certificate keys turned out to be guessable. Before running anything, we checked the email was real.
Updated in minutes, site down for secondsI scanned my own apps for vulnerabilities. The first run found 2 critical
After the PHP alert I wanted to catch old, vulnerable software inside my Docker apps without waiting for a warning. The first scan found 17 serious problems in my own dashboard and speed tester.
2 critical, 15 high down to 0 critical, 6 highA bot hunted my site for phpinfo.php. Here's what stopped it
In about ten seconds, a scanner tried dozens of paths looking for a page that leaks a server's setup. My firewall blocked every one before it reached my house.
Every request blockedResponding to an NCSC alert the same day
The NCSC warned about two critical PHP flaws. My website doesn't use PHP, but one app on my Pi did.
Found and stopped the same dayFinding a weak spot in my own backups
My nightly backups held my most sensitive keys, unencrypted, on the same drive as my films. So I fixed it and proved I could still restore.
Encrypted, restore testedTesting my Cloudflare firewall rules (and finding my mistake)
Three free firewall rules stop attack traffic before it reaches my house. The rate limit didn't work at first, and testing is how I found out.
785 of 1,000 blockedFrom F to A+ on securityheaders.com
Six HTTP headers took my site from an F to an A+. The last step meant moving every bit of JavaScript out of the page.
F to A+Private DNS with Unbound, and proving it rejects fakes
Pi-hole was sending every site I visit to a big DNS company. Unbound looks them up itself and checks they haven't been tampered with.
Fake answers refusedBuilding a honeypot on my home network
Eight fake services that nothing should ever touch. If anything does, I know about it straight away.
Every test hit loggedPutting a website online without opening a single port
My site runs on a Raspberry Pi at home, but my router has no ports open. An Nmap scan proves the firewall does what I think it does.
65,531 ports filteredLocking down SSH, and locking myself out
Key-only SSH is the right setting. I proved it by accidentally locking myself out of my own Pi.
Password logins refused