57 lines
2.0 KiB
Markdown
57 lines
2.0 KiB
Markdown
# Defensive Security Scans
|
|
|
|
This directory contains defensive scan configuration for the homelab and public
|
|
website. These checks are for assets owned by this lab only.
|
|
|
|
Use Jeannie from the Debian homelab host:
|
|
|
|
```bash
|
|
./jeannie security-prepare
|
|
./jeannie security-scan
|
|
./jeannie security-zap
|
|
./jeannie security-k8s
|
|
./jeannie security-host
|
|
./jeannie security-web
|
|
```
|
|
|
|
The default `security-scan` runs:
|
|
|
|
- Trivy filesystem and IaC/config scans against this repo.
|
|
- gitleaks secret scans against this repo.
|
|
- OWASP ZAP baseline passive scans against `security/targets.txt`.
|
|
|
|
The focused commands are:
|
|
|
|
- `security-prepare`: validate Docker/report prerequisites and pre-pull scanner
|
|
images.
|
|
- `security-zap`: OWASP ZAP baseline scan only.
|
|
- `security-k8s`: kube-bench CIS checks against the kubeadm host.
|
|
- `security-host`: Lynis host audit summary for Debian. This command is
|
|
report-only and prints one highest-risk finding to focus on first.
|
|
- `security-trivy`: Trivy repo and IaC/config scans only.
|
|
- `security-secrets`: gitleaks repo secret scan only.
|
|
- `security-nuclei`: low-rate nuclei HTTP exposure scans only.
|
|
- `security-web`: quick HTTPS, status, and defensive-header checks for owned
|
|
web targets.
|
|
|
|
Reports are written to:
|
|
|
|
```text
|
|
${HOMELAB_STATE_DIR}/security-reports
|
|
```
|
|
|
|
The ZAP scan uses baseline/passive mode. Do not run active attack scans against
|
|
public endpoints unless you intentionally schedule a maintenance window and
|
|
understand the traffic it will generate.
|
|
|
|
`security/targets.txt` is the public target allowlist. Keep it limited to
|
|
services you own.
|
|
|
|
`security-host` intentionally does not self-fix Lynis findings. Some hardening
|
|
recommendations can break SSH access, Docker networking, kubeadm, or public edge
|
|
routing. When `LAB_BACKSTAGE_BRAIN_ENABLED=true`, Jeannie asks the local
|
|
Ollama/RAG helper to select exactly one finding; otherwise it falls back to the
|
|
first Lynis warning, then the first suggestion. The full Lynis report is still
|
|
saved so you can review the complete output before adding any explicit hardening
|
|
command.
|