Sam Rolfe 2ed0ca80ae security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11) ...

- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*

2026-11-11 17:02:00 +11:00

7.8 KiB

Raw Blame History

View Raw