Security Findings Register¶
Findings observed during lab discovery and ongoing operations. Each finding has a target phase for remediation and is tracked through to closure.
Process: When a SEC-* item is closed, update the status here and note the PR/commit that resolved it.
Active Findings¶
| ID | Finding | Severity | Target Phase | Status |
|---|---|---|---|---|
| SEC-002 | VLANs are organizationally segmented but no inter-VLAN firewall rules enforce isolation. A compromised IoT or Security-VLAN device can reach the Servers VLAN. | Medium | Phase 7 | Closed — ZBF enabled on UDM, 8 custom policies verified via API scan (2026-05-15). See docs/architecture/firewall-policy.md |
| SEC-003 | DSM HTTP/HTTPS (5000/5001) forwarded from public internet. DSM has a recurring CVE history; access should require Tailscale. | Medium | Phase 7 | Closed — port forwards deleted from UDM (2026-05-15). DSM accessible only via Tailscale at 100.71.93.130; off-LAN verified 2026-06-19 |
| SEC-004 | Port-forward omgwtfbbq to 192.168.1.84:9001. Purpose unknown; operator does not recall creating it. |
Medium | Phase 0.5 (investigate) / Phase 7 (remediate) | Closed — port forward deleted from UDM (2026-05-15) |
| SEC-005 | All four WiFi SSIDs share the same networkconf_id and land on VLAN 1 (GenPop). The EAP-secured SSIDs likely intend tier separation that isn't network-enforced. |
Low-Medium | Phase 7 | Closed — SSID network assignments updated and verified via API (2026-05-15). IsThisTheKrustyKrab → Personal, HotSignalsInYourArea → IoT, Rebellious Amish Family → Appliances |
| SEC-006 | Tailscale node recordurbate health-check warning: advertising routes but --accept-routes=false. Cosmetic/operational, not exploitable, but should be fixed when the node comes under management. |
Low | Phase 3 | Closed — tailscale set --accept-routes applied (2026-05-12) |
| SEC-007 | Tailscale tailnet has 6+ nodes offline for 53-590 days. Confirmed as real devices to be rehydrated. Evaluate retention policy and ACL hygiene. | Low | Phase 0.5 (audit) / Phase 7 (ACL policy) | Closed — ACL in infra/tailscale/acl.json; GitHub Action sync green (2026-06-19, run 27811413868) |
| SEC-008 | DSM admin UI exposed via SEC-003 forwards. 2FA must be confirmed on all DSM admin accounts as a compensating control until SEC-003 closes. | Medium | Phase 0 (confirm 2FA) | Closed — 2FA, AutoBlock, Account Protection confirmed (2026-05-11); SEC-003 closed 2026-05-15 |
| SEC-011 | Broad SOPS recipients and shared host key path create unnecessary blast radius across services and appliances. | Critical | Contractor remediation | Blocked on owner keys — scoped recipient rollout needs owner-provided public age recipients; legacy recipient retained during transition (CA-002) |
| SEC-015 | Tailscale server ACLs allowed unrestricted tag:server -> tag:server:* lateral movement and root SSH to every tagged server, not just the hypervisor. |
Medium-High | Contractor remediation | Partially closed — PR #55 narrows the network ACL to tag:server:9100 (node_exporter) with deny tests. Root-SSH scoping to a prox-only tag is deferred: it needs a live re-tag of the already-joined prox node before merge to avoid a window with no root SSH path (CA-009) |
| SEC-016 | Backup/restore-test evidence does not yet cover tier-1 externals (Authentik DB, HAOS, Harbor) or a Wazuh tier-1/2 restore drill. | Medium | Contractor remediation | Open (CA-011) |
| SEC-017 | Docker socket is mounted directly into Traefik, Homepage, Alloy, cAdvisor, and Komodo Periphery instead of going through a scoped docker-socket-proxy. |
Medium | Contractor remediation | Open (CA-015) |
| SEC-018 | render-discovery-inventory.py --check passes silently when the generated file is missing (not just when it differs), and hardcodes ansible_user: someone instead of reading canonical host_vars. |
Medium | Contractor remediation | Partially closed — check mode now fails on missing outputs and keeps the output directory read-only; prox discovery uses root instead of someone. Remaining work: load canonical connection vars instead of special-casing (CA-012) |
| SEC-019 | Public docs site (hldocs-c0acdec9.pages.dev) is intentionally public without Cloudflare Access, and includes internal IPs, hostnames, SSH aliases, and DR procedures. |
Medium | Owner-accepted | Accepted risk (2026-06-26, reaffirmed 2026-07-03) — see cloudflare-pages.md. Next review: 2026-10-03 or on any incident involving the docs site (CA-010) |
Compensating Controls¶
SEC-008: DSM 2FA Verification (historical)¶
SEC-003 is closed. This section records the verification performed while DSM was still WAN-reachable:
All DSM admin accounts must have 2FA enabled. Verified 2026-05-11:
- Log in to DSM at
https://<synology-ip>:5001 - Go to Control Panel > User & Group
- For each user with admin privileges:
- Click the user, go to the Security tab (or Personal > Security for your own account)
- Confirm 2-Step Verification is enabled
- If Adaptive MFA is available (DSM 7.2+), enable it
- Under Control Panel > Security > Account:
- Enable Auto Block (10 failed attempts in 5 minutes)
- Enable Account Protection to lock accounts after repeated failures
Note
DSM is reachable only via Tailscale (100.71.93.130:5001) since 2026-05-15.
SEC-001 (public SMB) closed 2026-06-21 — see closed findings.
Closed Findings¶
| ID | Closed | Resolution |
|---|---|---|
| SEC-002 | 2026-05-15 | ZBF policies applied on UDM |
| SEC-001 | 2026-06-21 | Verified absent from UDM port-forward list; see scripts/hotfix-disable-smb-forward.md |
| SEC-003 | 2026-05-15 | WAN port forwards removed; Tailscale-only access |
| SEC-004 | 2026-05-15 | Unknown port forward deleted |
| SEC-005 | 2026-05-15 | WiFi SSID → VLAN mapping corrected |
| SEC-006 | 2026-05-12 | recordurbate accept-routes fixed |
| SEC-007 | 2026-06-19 | ACL GitOps workflow + secrets |
| SEC-008 | 2026-05-15 | 2FA verified; SEC-003 closed |
| SEC-009 | 2026-06-21 | dr-public-edge.md — tabletop proven (Cloudflare token rotation, Traefik ACME, Authentik backup restore paths) |
| SEC-010 | 2026-07-01 | PR #32 — PR-triggered CI isolated on homelab-pr runner pool (CA-001) |
| SEC-012 | 2026-06-28 | PR #33 — removed raw host publishes for ARA/Prometheus/cAdvisor/Loki/Traefik metrics; ARA's ARA_ALLOWED_HOSTS/CORS also hardened in the same change (CA-003, CA-008) |
| SEC-013 | 2026-06-28 | PR #35 — Wazuh backup tier, healthchecks, and disk watermarks added (CA-004) |
| SEC-014 | 2026-06-28 | PR #34 — recursive plaintext-scalar check + hardened secret-render temp handling (CA-005, CA-007) |
| SEC-020 | 2026-06-28 | PR #36 — live source-of-truth overlays added to README/docs home instead of editing PLAN.md (CA-006) |
| SEC-021 | 2026-07-03 | PR #55 — Grafana auth-proxy default role changed Admin → Viewer; promotion is now a documented manual step (CA-014) |
| SEC-022 | 2026-07-03 | PR #55 — removed monitoring/grafana/** from Komodo's deploy paths-ignore, so dashboard-only commits trigger Pull homelab repo again (CA-016) |
| SEC-023 | 2026-07-03 | PR #55 — pinned ARA to a digest and Homepage to v1.13.2; both already have Dependabot compose entries for future updates (CA-017) |
| SEC-024 | 2026-07-03 | PR #55 — Promtail positions moved from /tmp to the promtail-positions named volume (CA-018) |