As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

  • RedFox@infosec.pubEnglish
    1·
    2 years ago
    1. Exchange on prem 😳
    2. Both mdm,.Ms intune, and just installing the root cert manually in trusted store. You don’t have to root Android for that. It presents some warnings, appropriate.
    3. My Sophos is self contained. It does radius against active directory. It wants IPS and other updates though.

    I guess the firmware is as good as possible. All network devices are just computers and can be exploited. I use a Cisco router as my actual gateway. Sophos is inline after that.

    Privacy. 🤔

    Not much. I have certain traffic go through a VPN to the Internet, but that’s split tunneled.

    I use incognito? That doesn’t really do anything, ha.

    I’m slowly killing web browser tracking and cookie stuff that group policy allows.

    • MigratingtoLemmy@lemmy.worldOPEnglish
      1·
      2 years ago

      I didn’t know MS exchange could be used as a WAF. Will need to read more about that.

      Can I host Intune completely on-prem?

      What do you mean by “My Sophos is self-contained”?

      Does your Cisco router get updates? My problem with these companies is that they build backdoors in their firmware for agencies to use. Are you monitoring the network usage of your Cisco gateway?

      Using AD/RADIUS on-prem is an intriguing idea. I didn’t consider it because if my AD server goes down I’m essentially locked out of my services. I need to think more on this. Thanks.