Security

I sent a query from my IoT VLAN to 8.8.8.8 for a name only my Pi-hole knows, and Pi-hole answered. Then I went after the encrypted DNS paths a port 53 redirect can’t touch.

One allow rule on my IoT VLAN hadn’t passed a packet in two months, and it took two fixes to find out why. This is the rule set, the test I ran from inside the VLAN, and the two holes it found.

In August I moved my UDM Pro to UniFi’s zone-based firewall and left it alone for two months. When I read the policy list back, three rules pointed at a machine that stopped being Plex a while ago.

On October 19 I found a Message Center post: Entra stops honoring layout CSS in company branding on October 26. The news listed ten properties. Learn lists 58, display included, so I built a scanner.

OneLogin gives a role, a group and a policy nothing but a name, and a Smart Hook not even that. Teardown still has to delete only what my seed made, so each object is proved by what it holds.

The first PingOne seed I ran from Windows PowerShell 5.1 turned every accented and Han name into question marks. The fault was in how 5.1 encodes a request body, and all six providers in the module had it.

My seed asks the FreeIPA realm’s own CA for ten real certificates, and a CA has no delete. Teardown revokes them, so every seeded realm keeps a record of the run, next to HBAC and sudo rules built to be misread.

Authentik was already in my homelab doing single sign-on, so there was no license cap to design around. Of everything the provider seeds, the three hundred users are the least interesting.

I opened the Okta provider expecting to write the ten-user post again with better numbers. The eight users are the same eight users. Nearly everything around them has been replaced.

Okta, Authentik, FreeIPA, PingOne and OneLogin all hand me a token to paste into a config file. Entra hands me nothing, so the seeder has to solve its own access problem before it can create a single user.