Between the Synology C3RB3r warning and 1,000+ GitLab servers still unpatched, this week has me thinking about my own self-hosted stuff. This is a plan I’m considering, not something I’ve done yet.
What I’m thinking about
- Inventory: list every box I self-host, what it runs, and what version, so nothing gets forgotten
- Patch status: compare each one against this week’s advisories (DSM fixed builds, GitLab’s latest patch release) and turn on auto-updates where it makes sense
- Exposure: make sure no admin or management UI is reachable from the internet, and keep remote access behind a VPN
- Backups: confirm there’s at least one offline or immutable copy ransomware can’t touch, and actually test a restore
- Accounts: remove default and unused admin accounts, and use long unique passwords plus 2FA
Open questions
- How often should a check like this run? Monthly, or every time a big advisory drops?
- Could a bot do the inventory and version comparison, with me approving any changes?
My take
The boxes that bite you are the ones you set up once and forgot. What would you add to the list?
God Bless, and Use the Source!
