Security Findings Register¶
Findings observed during lab discovery and ongoing operations. Each finding has a target phase for remediation and is tracked through to closure.
Process: When a SEC-* item is closed, update the status here and note the PR/commit that resolved it.
Active Findings¶
| ID | Finding | Severity | Target Phase | Status |
|---|---|---|---|---|
| SEC-002 | VLANs are organizationally segmented but no inter-VLAN firewall rules enforce isolation. A compromised IoT or Security-VLAN device can reach the Servers VLAN. | Medium | Phase 7 | Closed — ZBF enabled on UDM, 8 custom policies verified via API scan (2026-05-15). See docs/architecture/firewall-policy.md |
| SEC-003 | DSM HTTP/HTTPS (5000/5001) forwarded from public internet. Remove these WAN forwards while retaining LAN and authorized tailnet administration. | Medium | Phase 7 | Closed — historical WAN-forward removal from UDM (2026-05-15). The authorized Tailscale path at 100.71.93.130:5001 worked off-LAN on 2026-06-19; that test did not establish external-path exclusivity. See the access scope below. |
| SEC-004 | Port-forward omgwtfbbq to 192.168.1.84:9001. Purpose unknown; operator does not recall creating it. |
Medium | Phase 0.5 (investigate) / Phase 7 (remediate) | Closed — port forward deleted from UDM (2026-05-15) |
| SEC-005 | All four WiFi SSIDs share the same networkconf_id and land on VLAN 1 (GenPop). The EAP-secured SSIDs likely intend tier separation that isn't network-enforced. |
Low-Medium | Phase 7 | Closed — SSID network assignments updated and verified via API (2026-05-15). IsThisTheKrustyKrab → Personal, HotSignalsInYourArea → IoT, Rebellious Amish Family → Appliances |
| SEC-006 | Tailscale node recordurbate health-check warning: advertising routes but --accept-routes=false. Cosmetic/operational, not exploitable, but should be fixed when the node comes under management. |
Low | Phase 3 | Closed — tailscale set --accept-routes applied (2026-05-12) |
| SEC-007 | Tailscale tailnet has 6+ nodes offline for 53-590 days. Confirmed as real devices to be rehydrated. Evaluate retention policy and ACL hygiene. | Low | Phase 0.5 (audit) / Phase 7 (ACL policy) | Closed — ACL in infra/tailscale/acl.json; GitHub Action sync green (2026-06-19, run 27811413868) |
| SEC-008 | DSM admin UI exposed via SEC-003 forwards. 2FA must be confirmed on all DSM admin accounts as a compensating control until SEC-003 closes. | Medium | Phase 0 (confirm 2FA) | Closed — 2FA, AutoBlock, Account Protection confirmed (2026-05-11); SEC-003 closed 2026-05-15 |
| SEC-011 | Broad SOPS recipients and shared host key path create unnecessary blast radius across services and appliances. | Critical | Contractor remediation | Blocked on owner keys — scoped recipient rollout needs owner-provided public age recipients; legacy recipient retained during transition (CA-002) |
| SEC-015 | Tailscale server ACLs allowed unrestricted tag:server -> tag:server:* lateral movement and root SSH to every tagged server, not just the hypervisor. |
Medium-High | Contractor remediation | Partially closed — PR #55 narrows the network ACL to tag:server:9100 (node_exporter) with deny tests. Root-SSH scoping to a prox-only tag is deferred: it needs a live re-tag of the already-joined prox node before merge to avoid a window with no root SSH path (CA-009) |
| SEC-016 | Backup/restore-test evidence does not yet cover tier-1 externals (Authentik DB, HAOS, Harbor) or a Wazuh tier-1/2 restore drill. | Medium | Contractor remediation | Open (CA-011) |
| SEC-017 | Docker socket is mounted directly into Traefik, Homepage, Alloy, cAdvisor, and Komodo Periphery instead of going through a scoped docker-socket-proxy. |
Medium | Contractor remediation | Open (CA-015) |
| SEC-018 | render-discovery-inventory.py --check passes silently when the generated file is missing (not just when it differs), and hardcodes ansible_user: someone instead of reading canonical host_vars. |
Medium | Contractor remediation | Partially closed — check mode now fails on missing outputs and keeps the output directory read-only; prox discovery uses root instead of someone. Remaining work: load canonical connection vars instead of special-casing (CA-012) |
| SEC-019 | Public docs site (hldocs-c0acdec9.pages.dev) is intentionally public without Cloudflare Access, and includes internal IPs, hostnames, SSH aliases, and DR procedures. |
Medium | Owner-accepted | Accepted risk (2026-06-26, reaffirmed 2026-07-03) — see cloudflare-pages.md. Next review: 2026-10-03 or on any incident involving the docs site (CA-010) |
Compensating Controls¶
SEC-008: DSM 2FA Verification (historical)¶
SEC-003 is closed. This section records the verification performed while DSM was still WAN-reachable:
All DSM admin accounts must have 2FA enabled. Verified 2026-05-11:
- Log in to DSM at
https://<synology-ip>:5001 - Go to Control Panel > User & Group
- For each user with admin privileges:
- Click the user, go to the Security tab (or Personal > Security for your own account)
- Confirm 2-Step Verification is enabled
- If Adaptive MFA is available (DSM 7.2+), enable it
- Under Control Panel > Security > Account:
- Enable Auto Block (10 failed attempts in 5 minutes)
- Enable Account Protection to lock accounts after repeated failures
Note
SEC-003 records removal of the DSM WAN forwards on 2026-05-15, not removal
of LAN access. LAN and authorized tailnet administration remain in scope:
inventory lists https://192.168.6.215:5001 for LAN management; the recorded
Tailscale path is https://100.71.93.130:5001.
SEC-001 (public SMB) closed 2026-06-21 — see closed findings.
DSM access scope and verification boundary¶
The NAS inventory and firewall policy retain LAN administration. The off-LAN Tailscale check on 2026-06-19 demonstrated a working authorized path, not that all other paths were denied. The historical WAN-forward fix stays closed; this is not a new Tailscale-only policy or evidence of another exposure.
Before claiming current external-path exclusivity, the owner must review current NAT/port forwards, IPv6 ingress, DSM host firewall, and remote-access features such as QuickConnect, then authorize off-LAN negative-boundary checks without Tailscale as well as positive checks for permitted LAN and authorized tailnet access. Record dated results privately. Those checks have not been performed by this documentation update.
Closed Findings¶
| ID | Closed | Resolution |
|---|---|---|
| SEC-002 | 2026-05-15 | ZBF policies applied on UDM |
| SEC-001 | 2026-06-21 | Verified absent from UDM port-forward list; see scripts/hotfix-disable-smb-forward.md |
| SEC-003 | 2026-05-15 | Recorded DSM WAN port forwards removed; LAN and authorized tailnet administration retained. Current external-path exclusivity requires separate verification. |
| SEC-004 | 2026-05-15 | Unknown port forward deleted |
| SEC-005 | 2026-05-15 | WiFi SSID → VLAN mapping corrected |
| SEC-006 | 2026-05-12 | recordurbate accept-routes fixed |
| SEC-007 | 2026-06-19 | ACL GitOps workflow + secrets |
| SEC-008 | 2026-05-15 | 2FA verified; SEC-003 closed |
| SEC-009 | 2026-06-21 | dr-public-edge.md — tabletop proven (Cloudflare token rotation, Traefik ACME, Authentik backup restore paths) |
| SEC-010 | 2026-07-01 | PR #32 — PR-triggered CI isolated on homelab-pr runner pool (CA-001) |
| SEC-012 | 2026-06-28 | PR #33 — removed raw host publishes for ARA/Prometheus/cAdvisor/Loki/Traefik metrics; ARA's ARA_ALLOWED_HOSTS/CORS also hardened in the same change (CA-003, CA-008) |
| SEC-013 | 2026-06-28 | PR #35 — Wazuh backup tier, healthchecks, and disk watermarks added (CA-004) |
| SEC-014 | 2026-06-28 | PR #34 — recursive plaintext-scalar check + hardened secret-render temp handling (CA-005, CA-007) |
| SEC-020 | 2026-06-28 | PR #36 — live source-of-truth overlays added to README/docs home instead of editing PLAN.md (CA-006) |
| SEC-021 | 2026-07-03 | PR #55 — Grafana auth-proxy default role changed Admin → Viewer; promotion is now a documented manual step (CA-014) |
| SEC-022 | 2026-07-03 | PR #55 — removed monitoring/grafana/** from Komodo's deploy paths-ignore, so dashboard-only commits trigger Pull homelab repo again (CA-016) |
| SEC-023 | 2026-07-03 | PR #55 — pinned ARA to a digest and Homepage to v1.13.2; both already have Dependabot compose entries for future updates (CA-017) |
| SEC-024 | 2026-07-03 | PR #55 — Promtail positions moved from /tmp to the promtail-positions named volume (CA-018) |