Security

A host that receives an ARP reply has no way to check whether the reply is real. Broadcast “what is the MAC of gateway 192.168.1.1?” and whoever answers, that answer gets written straight into the cache. No authentication, no integrity check. ARP even accepts a reply nobody asked for (a Gratuitous ARP) and overwrites the existing cache entry with it. An attacker puts a fake reply into that gap. Tell the victim “the gateway’s MAC is mine” and the gateway “the victim’s MAC is mine” at the same time, and all traffic between the two routes through the attacker. It is a textbook man-in-the-middle (MITM) attack, reproduced below in an isolated lab. ...

Overview In the previous post, we configured DDNS and port forwarding to enable external internet access to services running in the homelab Kubernetes cluster. This post covers how to install and configure HashiCorp Vault to securely manage sensitive information like passwords, API keys, and certificates in the Kubernetes cluster. Limitations of Default Kubernetes Secrets Secret management was the biggest challenge while building the homelab environment using GitOps methodology. Several limitations became clear when using default Kubernetes Secrets. ...

Web authentication solves a basic problem created by HTTP’s stateless nature: how a server can recognize the same user across multiple requests. Since Lou Montulli of Netscape Communications invented cookies in 1994, authentication has evolved from session-based approaches to token-based ones. Modern web applications widely use hybrid methods that combine JWT and Refresh Tokens to meet both security and scalability requirements. Understanding Authentication and Authorization The Difference Between Authentication and Authorization ...