As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

    • MigratingtoLemmy@lemmy.worldOPEnglish
      1·
      7 months ago

      I didn’t know MS exchange could be used as a WAF. Will need to read more about that.

      Can I host Intune completely on-prem?

      What do you mean by “My Sophos is self-contained”?

      Does your Cisco router get updates? My problem with these companies is that they build backdoors in their firmware for agencies to use. Are you monitoring the network usage of your Cisco gateway?

      Using AD/RADIUS on-prem is an intriguing idea. I didn’t consider it because if my AD server goes down I’m essentially locked out of my services. I need to think more on this. Thanks.

        • MigratingtoLemmy@lemmy.worldOPEnglish
          2·
          7 months ago

          As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.

          This is such a great and a simple idea. Thanks.

          I think I followed your setup at a high level, but because I don’t have hands-on experience with AD I didn’t quite catch the scope of it. Thanks for letting me know, I’ll get some reading done when I get the time!

        • MigratingtoLemmy@lemmy.worldOPEnglish
          1·
          7 months ago

          This is the first time I’ve come across Elastiflow, thanks for mentioning it. Seems like an intriguing service to add.

          I was considering using Suricata/installing Security Onion to do IDS from the certificate from a private CA. Sophos firewall seems pretty good too.