38 lines
1.1 KiB
Markdown
38 lines
1.1 KiB
Markdown
# Defensive Security Scans
|
|
|
|
This directory contains defensive scan configuration for the homelab and public
|
|
website. These checks are for assets owned by this lab only.
|
|
|
|
Use Jeannie from the Debian homelab host:
|
|
|
|
```bash
|
|
./jeannie security-scan
|
|
./jeannie security-zap
|
|
./jeannie security-k8s
|
|
```
|
|
|
|
The default `security-scan` runs:
|
|
|
|
- Trivy filesystem and IaC/config scans against this repo.
|
|
- OWASP ZAP baseline passive scans against `security/targets.txt`.
|
|
|
|
The focused commands are:
|
|
|
|
- `security-zap`: OWASP ZAP baseline scan only.
|
|
- `security-k8s`: kube-bench CIS checks against the kubeadm host.
|
|
- `security-trivy`: Trivy repo and IaC/config scans only.
|
|
- `security-nuclei`: low-rate nuclei HTTP exposure scans only.
|
|
|
|
Reports are written to:
|
|
|
|
```text
|
|
${HOMELAB_STATE_DIR}/security-reports
|
|
```
|
|
|
|
The ZAP scan uses baseline/passive mode. Do not run active attack scans against
|
|
public endpoints unless you intentionally schedule a maintenance window and
|
|
understand the traffic it will generate.
|
|
|
|
`security/targets.txt` is the public target allowlist. Keep it limited to
|
|
services you own.
|