Interesting traffic on my self-hosted secrets manager this morning. I saw a spike in HTTP traffic around 01:16CET (when everyone was asleep) and a high number of 404 errors in my dashboard. Checked the traefik access logs and it was someone scanning for WordPress vulnerabilities (/admin.php). Glad I am able to dignose those sorts of things in my #homelab #selfhost environment
Post
Replies:
5
@infosec812 If you find a moment of spare time, I‘d appreciate a brief roundup of what your setup looks like to evaluate those logs and display them. Assuming this was not done completely manually. :-)
Thanks in advance
@MacLemon The first time around it was done manually. I am in the process of updating my Ansible playbooks to automate all of this for DR purposes.
@MacLemon
Sure. Some of it is already on my blog at https://blog.devenphillips.dev
@infosec812 Awesome, thanks for the writeup.
@MacLemon Two new posts incoming on my blog. The first helps you set up Prometheus and Perses to see things like your Traefik traffic. The second show how to put your traefik access logs into a Perses dashboard as well. https://blog.devenphillips.dev/posts/
