Board:   [fsxNet] BBS Software Development/Support
Subject: RE: BBS Security...
From:    NuSkooler(21:1/121)
Date:    Thu Sep 03, 2026 11:17

Twas Saturday, August 29th when Shurato said...
 Sh> The only things I'm not doing that have been suggested are VLANs (I want
 Sh> all of my systems to be able to connect to eachother on the same subnet,
 Sh> so I don't know if I can do this), tunneling and reverse proxies as well.
 Sh>  I'm not sure if I can do that with non- http services (telnet, ftp, ssh,
 Sh> nntp) as well as if I would need ssl certs for each domain.  I'm not a
 Sh> business, so I don't know if I  need those.  I've got fail2ban through
 Sh> crowdsec and rgtel, geoip blocking, bad actor lists through crowdsec,
 Sh> qfeeds and maltrail and suricata, dns blocking through zen armor and the
 Sh> above and unbound as well as filtering through quad9).  I also have
 Sh> clamav checking my traffic.  The main thing I'm concerned about though,
 Sh> is the fact that none of my traffic filtering handles https.  I'm poor
 Sh> and can't afford the licenses that would support that (hundreds of
 Sh> dollars a month I think).

I'm missing context here, I think, but you don't need to a lot of money for good BBS security. I suggest a setup sort of like this:

{internet} -> [*PHYSICAL* firewall] -> [nginx or caddy TLS term] -> Your services.

Physical FW: An older box will due, especially for BBS traffic. Install pfSense or similar.

nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).

Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.


--
 ■ NuSkooler // Xibalba - "The place of fear"
 ■ xibalba.vip (44510/telnet, 44511/ssh)
 ■ ENiGMA 1/2 WHQ | Phenom | 67 | iMPURE | ACiDic
--- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.22.2)
 * Origin: Xibalba -+- xibalba.vip:44510 (21:1/121)
.