Hardening the home lab

Security work is mostly unglamorous. It is knobs and defaults, not movie heroics. Here is the baseline I apply to every box in the lab.

The first pass

Before any clever detection rule, three cheap wins:

• Rotate and scope every set of credentials
• Disable password SSH auth, keys only, users only
• Patch on a schedule, not on a feeling

SSH done right

PasswordAuthentication no
PermitRootLogin no
AllowUsers pierrec
MaxAuthTries 3
LoginGraceTime 20

Segment or regret

One flat network turns every compromised gadget into a stepping stone. So carve out VLANs for:

1. Management - only you get in here
2. Services - your containers and self-hosted tools
3. Guests and IoT - the permanent quarantine zone

If you cannot say what credential would have stopped that intrusion, you cannot say it will not happen again.

Backups are not optional

An immutable backup is the difference between inconvenience and catastrophe. Restic to an offline target, tested restores monthly - because an untested backup is Schrodinger’s archive.

Deck it all with monitoring afterwards - but get the basics right first.