Welcome to Incremental Social! Learn more about this project here!
Check out lemmyverse to find more communities to join from here!

@MSgtRedFox@infosec.pub cover
@MSgtRedFox@infosec.pub avatar

MSgtRedFox

@MSgtRedFox@infosec.pub

Husband, Father, IT Pro, service.

If I ask a lot of questions, I might understand why.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

I know this isn't what you're looking for, but I got a family plan from Google for music and split it with 6 family members, which is probably the same as apple music I assume.

I don't have to mess with download anymore.

Lidarr is only one I know.

Where to put reverse proxy?

I currently have my reverse proxy on my NAS. That means I forward all of my 443 HTTPS traffic to my NAS. I am using OpnSense for my router, and there are several options for reverse proxies on that. Everything works the way it is now, but I do wonder if it would be "better" if I moved all of the reverse proxy stuff to my router....

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Is this for internal clients?

If no, do you need unauthenticated public access to that?

Would you consider VPN instead?

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Is that a pickup line? Lol

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

I'm an enterprise guy, so that's the explanation for non home use things.

  • VPN for anything not my web or certificate revocation distribution point
  • Sophos IPS
  • sophos utm for web application firewall
  • transparent inline web proxy, sophos is doing https inspection. I have internal CA and all clients trust it. I don't inspect medical or banking, other common sense stuff.
  • heavily vlan segmented with firewall between
  • my windows clients are managed by active directory with heavy handed GPOs.
  • least priv accounts, different accounts for workstation admin, server, domain, network devices
  • security Onion IDS
  • separate red forest that has admin accounts for my management access and accounts on devices
  • trellix antivirus and global reputation based file monitoring
  • I've started applying disa STIGs on servers
  • site to site VPN with other family member household. They get managed trellix av also.
  • my public identity accounts like MS,.Google, etc all need 2fa, token, etc.

I bet this can still get exploited, just would take effort hopefully none does for a home network.

I'm still one shitty windows zero day click away from getting my workstation or browser tokens owned though, I can feel it.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Ha yeah.

Id say the same for trellix.

You should try doing things with installs or updating apps when the edr product blocks write access to all temp locations. You have to do an exclusion for every installer, signing cert, or turn it off to install programs.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Also laughing because that's how some companies get owned, IP stolen, etc.

There has to be balance, if your life using their system sucks so hard you can't do your job or meet production marks, you get creative.

My industry has to prioritize security over productivity. It's almost impossible to get work done.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Ha, probably. It's fun to learn stuff though.

Working in this field, almost every company has been beached, IP stolen, etc.

Sometimes your home IP gets hit in an automated scan for a vulnerability and then auto exploited by automation. I'm hoping not to get random chance added to a botnet.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Your working environment sounds gross :)

IT is hard. Finding good IT people is harder in my opinion. Working for a company that is not super squared away with good security and great usability sucks. At least you found some work arounds and are trying to do it well.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar
  1. Exchange on prem 😳
  2. Both mdm,.Ms intune, and just installing the root cert manually in trusted store. You don't have to root Android for that. It presents some warnings, appropriate.
  3. My Sophos is self contained. It does radius against active directory. It wants IPS and other updates though.

I guess the firmware is as good as possible. All network devices are just computers and can be exploited. I use a Cisco router as my actual gateway. Sophos is inline after that.

Privacy. 🤔

Not much. I have certain traffic go through a VPN to the Internet, but that's split tunneled.

I use incognito? That doesn't really do anything, ha.

I'm slowly killing web browser tracking and cookie stuff that group policy allows.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Sorry for confusion. I use Sophos utm as a WAF for exchange. Basically reverse proxy that is specifically programmed for exchange attacks. It allows OWA to keep working.

I put the exchange admin URL behind authentication, so you try to go to /ecp, it Sophos intercepts and make you authenticate to Sophos utm first, which is passing to ad with radius.

MS got rid of intune on prem. It's only Azure service now. I think.

My router is my biggest vuln. Oddly the most important. It's an enterprise ISR. It's updated as far as possible. My paranoia ends with the US gov/NSA. I don't care if they want back door oddly. I don't want China using me for attack relay however.

Loads of monitoring. You do a span/mirror port to your IDS like security Onion. Let it analyze all your traffic. Apparently there are some state sponsored exploits that allow them to owe a router at kernel level and hide their activities from you and monitoring, but that's a level I can't deal with.

As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

I have the older Sophos utm, which doesn't use the Sophos cloud central manager.

I think their new firewall utm can work disconnected, but I don't know.

Sophos has a home use license that's free for non business use.

I love companies that do community edition or free home use.

Sophos, Veeam has nfr, Elastiflow has community edition, which is a netflow.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

I think that's synonymous with "all hail the shareholder"

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

This corporate cycle isn't likely to change anytime soon right?

Top tier corps, boards, Cs, ultimately care about share price and growth right?

Isn't it tied to their pay incentives? To keep their contracts and incentives, they have to grow or reduce costs.

They make bad choices or bets among the way, no problem, just reduce costs and still meet the metrics. Only people who pay seem to be the workforce, right?

Or am I oversimplifying?

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

I recommend look into managed, vlan capable switches after you get your firewall figured out. That will allow you to put hosts on different vlans and separate lab stuff from the rest of your home network stuff.

There's a million videos.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

One of the keys to selecting the solution from the provided answers is if you need this to be publicly trusted.

I use an internal openssl ca root, created intermediate ca for each active directory domain or Forest. Also, I wanted to create internal PKI smart cards with yubikeys and his c1150 cards. For you know, fun.

I didn't care that other hosts don't trust my stuff because all my hosts are configured with root ca, and I only use VPN for access.

You want external trust, must do some of the other suggestions. Setting up internal CA is a chore with understanding AIA, CDP points, line of sight to PKI urls for renovation checking, more...

VPN to home network options

I currently have a server running Unraid as the OS, which has some WireGuard integration built in. Which I've enabled and been using to remotely access services hosted on that server. But as I've expanded to include things like Octopi running on a Pi3 and NextcloudPi running on a Pi4 (along with AdGuardHome), I'm trying to...

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Doesn't tailscale retain closed source for the coordination server?

I think nebula mesh is totally open and you can run your own coordination server, lighthouse?

Nebula would need static IP, TS can do that part for $

Hosting websites over 4g

I have been hosting a few websites from my home server and it has taught me a lot. I have recently had major issues with the electrical storms, Kogan NBN support (Australia), and the NBN network in general. I know 4g is not fast, but I would like to use it so that in the event of a network outage, im not at the mercy of NBN. On...

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

You're on the right track. As long as wiregurd on the VPS will allow an incoming connection from you home 4g, which will probably be CGNAT, it'll work. Did you look into running the NGINX reverse on the VPS? I like terminating external stuff on cloud side, then only bring filtered or desired traffic over the tunnel.

MSgtRedFox ,
@MSgtRedFox@infosec.pub avatar

Are they fucking high?>

Yeah, probably

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • incremental_games
  • meta
  • All magazines
    •