Homelab Hero · No. 012

One incident. Three calls.

Tuesday, 11 PM. Your monitoring digest shows a successful SSH login to your media server at 3 AM from an address in another country. The box has one port forwarded so a friend can reach it, and the friend's account on it is years old.

Your call:

A. Block that address at the router and audit the logs properly tomorrow

B. Change every password on the box, kill the session, and keep it running while you watch it

C. Pull the box off the network, preserve the logs, and treat it as compromised until you have checked for new accounts and persistence

100 Hero Points for the right call — 200 on the Friday Boss Fight. From Issue No. 012 of The Homelab Herald. Your result lands on the next page, ready to share.