Notes
Short write-ups of things that broke, or almost did. What I saw, what was actually wrong, and what keeps it from happening again.
My audit tool was sending a password in plain text
My home lab has an audit tool that checks everything against its documentation. One of the things it talks to is the API of my DNS filter, and that API needs a password. For a while, that password went over plain HTTP on every single run. Every service in the lab gets its certificate from my own internal certificate authority, and the servers trust it. What I hadn't thought about is that Python's requests library doesn't use the system's trust store.
Read the full note
List what may leave, not what must not
My lab dashboard gets backed up as a full snapshot, and that snapshot holds things that should never travel: the app's config with its secrets, its database, and its private TLS key. The first version of my extraction used an exclude list. I forgot the certificates folder, and the private key came along with the code into a shared folder.
Read the full note