How do you protect your servers? What techniques and tricks do you use? reddit / selfhosted ---------------------------------------------------------------------- just-ans · 2023-09-27 09:52 I'm really curious to know to how the people of r/selfhosted protect their server from attacks and all the wilderness of the internet. I just recently began my journey in networking and upon the setup of my first server, I found that many attempts were being made on my SSH port (22), this was quite shocking. Like It wasn't even a hour and attacks were coming in. Then I searched and found changing the default port will reduced the automated attacks, and indeed it reduced the number of attempts. Since, I just began I don't know what are some other things, and pit falls that I need to watch for, How would I make sure my server is all well and protected weather it's mail server or something else. I have heard of some things like intrusion detection and intrusion prevention applications, do any of you use it? Well do small projects even need to use them? I think NO. Please share your experience and tales of protecting your server and if every was breached then how did you dealt with it. ​ Thanks. ---------------------------------------------------------------------- vikymonkey · 2023-09-27 09:56 fail2ban ---------------------------------------------------------------------- mystarkfuture · 2023-09-27 09:57 Crowdec for services Non standard ssh ports SSL certs in Traefik Disable password login in ssh That is it ---------------------------------------------------------------------- tomistruth · 2023-09-27 10:08 I wrote a post on it How to protect your self-hosted servers with VPNs using Wireguard https://reddit.com/r/selfhosted/s/SQRzSudhc8 ---------------------------------------------------------------------- cpt_adam · 2023-09-27 10:09 Wazuh for me ---------------------------------------------------------------------- botterway · 2023-09-27 10:23 I don't expose my server to the internet. Simple as that. If I want to access it remotely, I use a VPN. ---------------------------------------------------------------------- AmateursPls · 2023-09-27 10:40 Secure your shit with SELinux and proper user management (ie don't run nginx as privileged user). If SELinux seems daunting or frustrating to you, learn it. It can single-handedly be the difference between your nginx instance getting pwned and your entire machine getting pwned. SELinux is not that hard, it only takes a couple hours of proper studying and practice to be able to utilise in 99+% of your homelab uses. Use an intrusion prevention system (fail2ban/IPBan). Read the docs on your IPS and set it as strictly as you consider sane without potentially getting in the way of users of your system. Only expose 80 and 443 tucking the rest of your services behind a reverse proxy. Ensure your reverse proxy settings handle routing and stapling correctly so it doesn't drop the secure connection after initial connection. Use an SSL certificate and route your traffic through Cloudflare for free DDoS protection as well as to drastically slow down automated subdomain sniffing. **\*\*KEEP YOUR SOFTWARE UPDATED\*\*** Don't announce your shit to crawlers. If you want to run a blog or community forum with some SEO I strongly advise getting it a dedicated domain if you absolutely insist on hosting it on a homelab. Use non-standard ports. Use certificate authentication for SSH. Even consider port knocking for SSH if you want to be a really cool kid. Keep in mind security through obscurity is not considered security on its own, but is still considered good practice in conjunction with other good security practices. Do not use UPnP. Do not use DMZ. Whenever you think you might need to use these, there is 100% a better alternative solution. The only time to use a DMZ is in very specialised networks using an outer-layer router to handle access into the inner layer of your network. This does not apply to 99% of homelabs. Use strong passwords. Don't reuse passwords for **anything.** If you aren't already utilising a password manager to aide in this, then start already. Lock down your password manager with 2FA. Once 2FA is activated, NEVER send your recovery codes over the internet, only ever handle them locally and offline. Do NOT store them on the same machine as where the password manager is located or hosted. This is far from comprehensive, just a few quick tips off the top of my head. ---------------------------------------------------------------------- yarisken75 · 2023-09-27 10:43 Whatever the measures you take, exposing something is always a risk. So be aware of this and make good backups. Why do you expose port 22 if your server is inside your house ? I would in that case definitly use a vpn if you need access. If something goes wrong you still have access when you are home. I do not expose anything, except a torrent port, in my home router. ---------------------------------------------------------------------- ElevenNotes · 2023-09-27 10:55 Like [this](https://hub.docker.com/r/11notes/sshpiper) ---------------------------------------------------------------------- l86rj · 2023-09-27 10:56 I only expose my IPV6 interface. You can have different firewall configurations for ipv4 and ipv6, and the ipv6 is a huge address, almost impossible to get scanned. And I don't have a domain for it, I just use this big ipv6 number to connect when I'm on an external network ---------------------------------------------------------------------- xSean93 · 2023-09-27 11:06 Agreed. Easier to set up VPNs than expose services securely to the internet. ---------------------------------------------------------------------- roman5588 · 2023-09-27 11:09 Impressed with Bitninja and have been running it on my externally facing servers. Great if you can qualify for free tier. Otherwise a combination of - whitelisting sensitive ports to my ips or via a vpn - Fail2ban - 2FA and email notifications on sign in - Range blocking certain counties and problematic ASN’s - Regular port scans to ensure firewalls are set - Regular monitoring of load and network traffic with alarms - Canary tokens to alert of data loss ---------------------------------------------------------------------- pixelvengeur · 2023-09-27 11:09 That's the one and only answer if you're the only one using the services. Don't want others remoting it? Don't give them any chance to. ---------------------------------------------------------------------- nyrosis · 2023-09-27 11:10 A good program for servers. For my router I use opnsense with some basic IPS rules configured. ---------------------------------------------------------------------- mystarkfuture · 2023-09-27 11:41 Security through obscurity? ---------------------------------------------------------------------- 7aichi · 2023-09-27 11:43 Uhhh. So you're exposed then?... with your VPN. ---------------------------------------------------------------------- azukaar · 2023-09-27 11:44 Even unexposed, your local network is very insecure, because all the IOT / smart devices and smartphone who can access your server ---------------------------------------------------------------------- zarevskaya · 2023-09-27 11:45 The VPN is not a magic solution. Too many people think it's the ultimate protection. Don't think that!!! ---------------------------------------------------------------------- azukaar · 2023-09-27 11:45 I am the devloper of [github.com/azukaar/cosmos- server](https://github.com/azukaar/cosmos-server) a software dedicated to managing your server with a huge focus on security, such as adding 2FA web portals in front of things, rate limiting, geoblocking, and soon VPN ---------------------------------------------------------------------- dervish666 · 2023-09-27 11:54 Or Crowdsec, like fail2ban on steroids. ---------------------------------------------------------------------- botterway · 2023-09-27 11:56 Well, technically you're right. But if somebody can find and hack my openVPN server (which isn't near my server), then get access to my LAN, and then hack my server, I've probably got bigger problems. ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 11:57 Tailscale. Basically a VPN. ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 11:58 Impossible to scan, easy to sniff. This is frankly a really, really bad solution. ---------------------------------------------------------------------- randobando129 · 2023-09-27 11:59 Add 2fa as well and you have a pretty solid setup ---------------------------------------------------------------------- theTrebleClef · 2023-09-27 12:00 I use firewall and routing to prevent these devices from accessing the Internet. If the game preloaded with malware they could still do damage, but considering you can overwrite many of these, you can prevent that. For cloud-only IoT devices, I isolate those onto a separate network that cannot access my systems. ---------------------------------------------------------------------- RedditNotFreeSpeech · 2023-09-27 12:03 Don't expose anything. Von, cloudflare, erc ---------------------------------------------------------------------- WildestPotato · 2023-09-27 12:05 You realise there’s prefix announcements from an ASN right? ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 12:07 Not everyone has iot/smart devices on their network ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 12:08 Except that for all practical purposes it is. ---------------------------------------------------------------------- wrath_of_reaper · 2023-09-27 12:18 Just thought about the same. That's not a security strategy in my opinion. ---------------------------------------------------------------------- nurseynurseygander · 2023-09-27 12:24 Only if you let them. I have one router for giving comms to dumb and untrustworthy devices and another for the servers. ---------------------------------------------------------------------- enormousaardvark · 2023-09-27 12:31 Wireguard VPN - the only port that should be exposed to the internet, uless you run web services on ports 80/443 then use Nginx Proxy Manager, and then on top of that OPNSense firewall, I geo block the world except for the country I live in ;) ---------------------------------------------------------------------- trisanachandler · 2023-09-27 12:32 MFA on the VPN is an option. ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 12:33 Tailscale. So basically a VPN. ---------------------------------------------------------------------- azukaar · 2023-09-27 12:38 You guys can downvote me to hell does not make my comment wrong lol And obviously you are going to let them, what good is a Nextcloud server if your laptop cant access it at all, what good is a PLex server if your TV or phone cant access it?? Be real ---------------------------------------------------------------------- AmateursPls · 2023-09-27 12:38 Except that it literally isn't. ---------------------------------------------------------------------- TripletStorm · 2023-09-27 12:39 Run your service in a docker container that doesn’t have root access. Use cloudflare to expose your service. Zero ports open on your firewall. ---------------------------------------------------------------------- azukaar · 2023-09-27 12:39 Thanks now let me rephrase : "for the 99.99% of the population who own a smartphone and/or a TV bought after 2018" ---------------------------------------------------------------------- loctong · 2023-09-27 12:40 Firewall every port in and out of every vm, whitelist dns zones that are reachable on a per-server basis, whitelist external http access on a per-server basis, selinux in enforcing mode, no root access, sudo access only for the commands required, and everything configured through a configuration management tool so I’m not worried about purging a node and rebuilding. ---------------------------------------------------------------------- azukaar · 2023-09-27 12:41 It dose not matter. If your devices, say your phone or your laptop can access your server (which obvioulsy it can, otherwise what's the point of the server) any process on said device can potentially attack your servers. And those devices also have internet access even if you server does not. ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 12:42 smartphones aren't iot devices. Nor are appletvs, chromecasts, etc which plenty of people use. My TV doesn't have internet access because it's UI is utter garbage. ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 12:44 🙄 Wow. Such argument. VPNs are 99.9999999% foolproof. If you advertise that you have $1B in bitcoin with the key sitting in plain text in a text file on your desktop you *might* have an issue. ---------------------------------------------------------------------- AmateursPls · 2023-09-27 12:46 > Dismisses somebody based on the perceived weakness of an argument > Proceeds to give a fake statistic with absolutely no supporting argument whatsoever in response urbdabest! ---------------------------------------------------------------------- Boomam · 2023-09-27 12:47 Its bad from every point of view. Its not like you can even say that its 'easier to connect' by remembering an IPv6 address either! :-p ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 12:47 You're an idiot. ---------------------------------------------------------------------- azukaar · 2023-09-27 12:48 You are probably so focused on proving me wrong that you end up talking non sense, but in my sentence: "all the IOT / smart devices and smartphone who can access your server" Definitely INCLUDES smartphones and smart TVs. And those can definitely be corrupted, and attack your servers, and those are (once again, for that 99.99% of the people, good for you if not) connected to the internet. ---------------------------------------------------------------------- returnofblank · 2023-09-27 12:49 Only open what you need to the public, and always use a VPN for anything sensitive that needs to be accessed remotely. I would never directly open my ssh port to the public, much safer to use a VPN tool like Tailscale. I also host all my web services through Cloudflare Tunnels rather than my own web server. Everything I host is password protected and the services themselves run thru Docker. ---------------------------------------------------------------------- AroundThisEarth · 2023-09-27 12:49 You're an idiot. ---------------------------------------------------------------------- amwdrizz · 2023-09-27 12:50 pFsense firewall, ids/ips, pfBlocker w/GeoIP, multiple vLANs for network segments with properly configured firewall between them. IoT is on its on vLAN with no access to my server vLAN. For vLANs, I have one for each group of devices. Wireless (x2 authenticated and not), desktop/client devices, oobm, servers (generic), internal routing, etc. ---------------------------------------------------------------------- Boomam · 2023-09-27 12:51 Whilst i support that strategy in certain contexts, in this case, an externally accessible addresses with no real security, is tantamount to believing that your houses front door is secure as you are using a different handle, so it must be safe, right? right!? ---------------------------------------------------------------------- kriswithakthatplays · 2023-09-27 12:59 The same could be said for leaving port 443 open and using nginx to hostname forward to your internal services. ---------------------------------------------------------------------- jbarr107 · 2023-09-27 13:05 My personal policy: * Service with public access: CloudFlare Tunnel with rules * Service with restricted multi-user access: CloudFlare Tunnel with rules + Cloudflare Application to provide authentication * Service with my exclusive access: TailScale or a CloudFlare Tunnel with rules + Cloudflare Application to provide authentication In all cases, no ports are exposed. CloudFlare manages DDoS and other attacks, and a CloudFlare Application provides authentication whereby the user/attacked only hits my servers if they pass authentication. I take additional measures that are detailed elsewhere in this thread. ---------------------------------------------------------------------- grahamsz · 2023-09-27 13:05 I use the Emerging Threats blacklist (at work we also block all connections from a bunch of countries where we don't do business and get lots of abusive traffic, that seems like a really good idea to do at home). Right now i have IOT devices kept to a region of the IP space where they can't access the internet. Primarily i'm concerned with devices that reach out to chinese servers over http to get new firmware, that seems like a super high risk. I have been meaning to migrate them all to a separate wifi network and use VLANs to segregate that traffic (so they can't access other my servers), but haven't got round to it yet. I have one port open for a service that needs it and then wireguard for everything else. ---------------------------------------------------------------------- gongsh0w · 2023-09-27 13:05 this guy secures ---------------------------------------------------------------------- Xiakit · 2023-09-27 13:06 Traefik, SSL, geoblocked (home country only), other services via cloudflare. ---------------------------------------------------------------------- tjohaj · 2023-09-27 13:08 How do you monitor attempts and breaches? I run Ubuntu headless ---------------------------------------------------------------------- Complex_Ad8695 · 2023-09-27 13:12 I reset my pods every 2 days or so.. persistent storage volumes for longer term data.. other than that, Cloudflare tunnels are decent. ---------------------------------------------------------------------- see_ess_fifty · 2023-09-27 13:15 I’m interested in creating a vpn to log into my network remotely. I don’t really know where to start (networking is fairly new to me). Would it be possible to describe how you did it or point me towards a resource? ---------------------------------------------------------------------- Blackenet1 · 2023-09-27 13:16 How do i disable the password login and what do you use to access ssh? ---------------------------------------------------------------------- AmateursPls · 2023-09-27 13:16 I personally use Security Onion with real-time push notifications to my phone for particularly interesting/persistent attempts via [ntfy.sh](https://ntfy.sh) This is a particularly involved approach mind you and is more something I enjoyed setting up than I think most homelabs necessarily *need*. For most use cases, log monitoring alerts via your IPS with a simple log monitoring reporting cronjob like logcheck should suffice. ---------------------------------------------------------------------- 2treesandatiger · 2023-09-27 13:25 What if you want to access it from devices where you can’t install a vpn(?), say a work laptop ---------------------------------------------------------------------- keechy1231 · 2023-09-27 13:25 Tailscale. :) ---------------------------------------------------------------------- DyceFreak · 2023-09-27 13:25 What servers? ---------------------------------------------------------------------- TheMcRibReturneth · 2023-09-27 13:26 Authelia and a vpn. You don't have to worry about people fucking with your apps if they can't get to them. ---------------------------------------------------------------------- XamanekMtz · 2023-09-27 13:28 For web servers, I use apache and Nginx as reverse proxy and that's it, for other purposes VPN, back in time I used fail2ban with 2 chances on non default ssh port or other ports if I needed to open anything other than 80 and 443 ---------------------------------------------------------------------- botterway · 2023-09-27 13:28 Yeah, this. I run an openvpn server on my Asus-Merlin router, but for most people who are less tech-savvy, I'd say that if you have to ask how to do it, the answer is Tailscale. ---------------------------------------------------------------------- XamanekMtz · 2023-09-27 13:30 SSH Keys, gotta copy/install your public ssh key to the server you want to access passwordless ---------------------------------------------------------------------- ShinySubmarine · 2023-09-27 13:30 You can disable it in ur sshd config, use public /private key auth instead It may be wise to only disable root login so you are not fully locked out in case you lose your key ---------------------------------------------------------------------- tr4nceplants · 2023-09-27 13:32 You use certificate based login exclusively. You need to generate a certificate for yourself and upload it to your server. You also copy it on your devices -> now you can login from them ---------------------------------------------------------------------- pixelvengeur · 2023-09-27 13:33 Not sure. I'm an admin of my work laptop, but the network blocks the VPN, so I use my phone as a hotspot. If you are not an admin... You could do the same by installing the VPN on your phone and using it as a hotspot, but I'm not sure that would work. ---------------------------------------------------------------------- robtalee44 · 2023-09-27 13:38 If you have to have ports open to the Internet, you'll get attention. Quickly. Now, most of it amounts to kind of door knob rattling to see if there's an easy way in. As long as the security measure are tight, that's usually enough to cause people to find easier targets. Intrusion detection systems work -- I didn't like auto response type systems where they unilaterally took measures upon a detected attack, Just let me know and I'll deal with it or not. In only a couple of cases did we see a DOS attack and it's was always just script kiddies coming from a single address block that we could handle easily. So, good practices coupled with perhaps a detection systems that alerts would be about as far as I'd take it without significant, practical reasons to do more. It's really easy to build out something that becomes a monster to feed and maintain. Good luck. ---------------------------------------------------------------------- colin_colout · 2023-09-27 13:45 Zero trust as a principal. It means what it sounds like; don't trust that any adjacent network later, technology, configuration, application, technique, etc is secure. For instance: * let's say you have an app that you already patched and configured "securely" with best practices. * assume your application is full of zeros days, so you might want to configure access control proxy in front of it. * you should also assume there's a way to bypass the access control, so put the app in its own private network, and the access control in a DMZ * you should assume the access control itself isn't perfect and restrict access to THAT on the network later. Let's say with a VPN * assuming the VPN can have vulnerabilities, become misconfigured, or you could leak credentials, you can also add another layer (such as white listing certain IPs, or using multi factor) * in the other direction, you the OS the app is running on could have vulnerabilities. If someone gains access to that, your VPN is useless. You should patch it, run apparmor/selinix. Include strict user permissions, disable root login, etc (there's so much more, but you can find best practices docs). * if you're using docker, go through the same process with the docker image. * hardware, bios updates. Boot password. * lock your server away. Same for network equipment. If you have access to those, you can bypass everything. * does your server communicate to anything else? Encrypt that channel. Use role bases access control. Ok, so that's a bit much for a home lab. I personally trust my servers physically because I'm not doing anything too sensitive. My desktop PC has more sensitive information than my home lab. I also don't care about remote access too much. I don't need to remote access my Jellyfin, so I use Cloudflare tunnels. Ultimately you need to go through a similar 'threat modeling' exercise as I wrote above and assess your own stack. At that point, only you can decide what needs to be done. Good luck! ---------------------------------------------------------------------- lack_of_reserves · 2023-09-27 13:51 Crowdsec is way better than fail2ban, especially if you completely ignore editing the fail2ban default configuration which is horrible. ---------------------------------------------------------------------- zarlo5899 · 2023-09-27 14:04 i have fail2ban on my ssh jump server the only ports i have open are 22 80 443 51820 + some ports when hosting game servers https only ssh is key only web control panels that dont support OIDC or SAML are not exposed to the internet a large ip block list ---------------------------------------------------------------------- h7x4 · 2023-09-27 14:07 Heavy systemd sandboxing of everything that is exposed to the internet. Even if someone finds a vulnerability, it's only that single service being compromised, not the entire server. ---------------------------------------------------------------------- Mehlsuppe · 2023-09-27 14:08 ​ * Disabled password login * Fail2ban * Wazuh * Login via Yubikey * Local firewall only accepts my IP address for the SSH port. When my IP address changes, my router automatically triggers a script on my server and the FW rule gets updated. ---------------------------------------------------------------------- cpt_justice · 2023-09-27 14:08 An hour before attacks began? You must be pretty well hidden! I think the first time I had a firewall which reported ssh attempts, it was literally a second after I turned the firewall on. ---------------------------------------------------------------------- ericesev · 2023-09-27 14:14 I use a combination of Promtail, Prometheus, and Alert Manager. Promtail collects all the logs. As it does I have it configured to monitor some critical events: process crashed, AppArmor policy violated, successful login, etc. Prometheus polls Promtail for counters. These counters increase as the critical events happen. Prometheus is configured with alerting rules to notify when the counters change. Alert Manager works with Prometheus to send alerts whenever one of the Prometheus alerting rules fire. If there is an alert, Grafana can be used to view the logs from all the systems. It can also make nice dashboards from the logs. https://imgur.com/a/sKpjHPs ---------------------------------------------------------------------- lawk · 2023-09-27 14:18 I want my server exposed to the internet, as I use various services on it. I disallow root login on ssh and ftp. I also change the SSH port. (i still allow password logins though, i login as another user and then su to become root). I use fail2ban to monitor ssh and others. I also use it with crowdsec in parallel for now. Update the services regularly. I also use SSL on webserver, mailserver… ---------------------------------------------------------------------- Maxtecy · 2023-09-27 14:19 \+1 for crowdsec, amazing stuff. ---------------------------------------------------------------------- macvirii · 2023-09-27 14:20 Only the reverse proxy ports (80,443) on ipv4 are open (and also ipv6 allow on correct ports on the firewall) The server for the reverse proxy don't have ssh enabled, only way to interact with it is using the vnc from proxmox. I also have a vpn to access the local services on the go, and all services with different passwords using a password manager. ---------------------------------------------------------------------- fprof · 2023-09-27 14:20 Wait until you get home/to a PC you own. ---------------------------------------------------------------------- sophware · 2023-09-27 14:23 To piggyback: If a breach were to happen, what tools (and used how) would enable us to say what happened? What logs should we be reading and with what knowledge or assistance? ---------------------------------------------------------------------- ericesev · 2023-09-27 14:33 >Secure your shit with SELinux and proper user management (ie don't run nginx as privileged user) With SELinux/AppArmor enforcing, what can nginx do as a privileged user that it couldn't do as a non-privileged user? My thought has been that the mandatory access controls from SELinux/AppArmor make root no more privileged than any other user. Is that incorrect? ---------------------------------------------------------------------- willjasen · 2023-09-27 14:34 Most of the services I host are internal only behind a Traefik instance. If you’re not coming from a trusted network, you get a 403 Forbidden. The only downside is that I have Traefik open to the world so that valid SSL certs can happen. ---------------------------------------------------------------------- Signal_Inside3436 · 2023-09-27 14:34 I don’t fully understand when you say don’t use a DMZ….isnt it common practice to place a reverse proxy in a DMZ then place the actual servers safely behind that, and only accessed through the reverse proxy? ---------------------------------------------------------------------- 10leej · 2023-09-27 14:36 I dont put my servers with critical data on a direct path to the inernet. If i want external access I connect through a ssh tunnel to a jumphost which happens to have two ethernet ports one on each VLAN and ssh chain my way to where i want to be. Do i want media? I rsync it around the machines (the jump host has a 100GB ramdisk for this purpose) ---------------------------------------------------------------------- instant_dreams · 2023-09-27 14:37 Now that is nice. Could you share your promtail and alertmanaget config? ---------------------------------------------------------------------- talent_deprived · 2023-09-27 14:38 \+1 for fail2ban, it operates independently and self-contained. ---------------------------------------------------------------------- mshorey81 · 2023-09-27 14:48 All public facing services are behind NPM which is running Fail2Ban and Crowdsec. NPM is behind pFsense which is running pfBlockerng blocking all but north America and using various other community supported lusts. Pfsense also grabs the Crowdsec entries from NPM and dynamically updates a Blocklist to block at the perimeter. ---------------------------------------------------------------------- nik282000 · 2023-09-27 14:50 Keep ssh on another port (quieter logs) and use key only logins with root user disabled. Put your web services in containers VMs that don't have access to other parts of your network if they don't need it. And reverse proxy with certbot can cover all your services with https. The only other thing I do is to track (and map) the number and location of remote hits to check if someone is actively trying to exploit my server. Example map: https://i.imgur.com/aJ6aVZp.png ---------------------------------------------------------------------- solid_reign · 2023-09-27 14:50 You can use zerotier. ---------------------------------------------------------------------- TheFluffiestRedditor · 2023-09-27 14:52 uhhh just like how I don't access my work systems from my personal kit, I don't manage my personal systems from my work kit. Or, install something like Firezone or Guacamole which provide pure web based remote access. ---------------------------------------------------------------------- vikymonkey · 2023-09-27 15:16 ssh-keygen ssh-copy-id @ ---------------------------------------------------------------------- chanc2 · 2023-09-27 15:20 I use a hardware firewall - Firewalla ---------------------------------------------------------------------- AmateursPls · 2023-09-27 15:20 I'm a little unsure as to what benefit this would provide and what exactly the DMZ would be doing in this scenario? You're still facing the reverse proxy publicly, it still has the capability to route traffic to the server and as such if it becomes compromised there is no difference in what it can or cannot do. ---------------------------------------------------------------------- AmateursPls · 2023-09-27 15:26 Technically yes, SELinux can control what root user can do. There was (probably still is?) even challenger servers launched out to the world where the server admin would provide the world with a user with root access, and dare anyone to pwn their system with that root user through their SELinux policies, and these systems stood up to the test. However, it serves no practical purpose, is not advised to do this, and even if you were an SELinux wizard that could be 100% assured your policies are properly configured and hardened, there is no sense in abandoning other good practices when the two can coexist just fine. ---------------------------------------------------------------------- ericesev · 2023-09-27 15:44 Thank you Promtail config: [https://gist.github.com/esev/5ae688a5253a943df5921b2 961a7bacb](https://gist.github.com/esev/5ae688a5253a943df5921b2961a7ba cb) Alerting rules: [https://gist.github.com/esev/36e7727bec49b194613f200c 54d90986](https://gist.github.com/esev/36e7727bec49b194613f200c54d9098 6) I'm using this patch to push the geoip data into the logs: https://github.com/grafana/loki/pull/10256 ---------------------------------------------------------------------- unoder · 2023-09-27 15:44 wireguard... ---------------------------------------------------------------------- daywreckerdiesel · 2023-09-27 15:46 You can set up a travel router to connect back to your network via Wireguard / Tailscale. The travel router connects to your work wifi, and anything that plugs into the travel router has access. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-09-27 15:49 Thefore you're exposing it to the internet, by using a security measure. If you don't want remote access you have to have no internet connection. Everything else is exposing it to the internet. Which is fine, if you know what you're doing. So please stop pretending like VPN is some magic. VPN software is just as likely to be hackable as OpenSSH is. The most likely way you get hacked is either misconfiguration or outdated software. VPN is also prone to both of these problems. ---------------------------------------------------------------------- ericesev · 2023-09-27 15:53 Thank you. I'm mostly interested for Docker containers. Some are simple to run as non-root while others are harder. I've taken the approach of adding AppArmor profiles to all containers that process data from the internet. (reverse proxy, logging tools, etc). Excellent comment of best practices by the way. The one extra thing I'd add is: Given the choice between software written in a memory-safe language and one not written in a memory-safe language, choose the software written in the memory-safe language. ---------------------------------------------------------------------- throwaway234f32423df · 2023-09-27 15:59 > Non standard ssh ports also unbind SSH and all other administrative services from IPV4 most security scanners and hacking tools are IPV4-only so going IPV6-only will cut down on attack noise by 99% ---------------------------------------------------------------------- foomatic999 · 2023-09-27 15:59 How regularly do you check its dashboard? I setup a wazuh server in the past but don't really use it for active monitoring. What I do watch out for is a log server which collects syslog for all my machines (which typically are linux boxes). Additionally I use ntfy to send a notification to my phone when an ssh-connection to one of my systems is established. ---------------------------------------------------------------------- throwaway234f32423df · 2023-09-27 16:01 > Keep ssh on another port (quieter logs) and use key only logins with root user disabled. unbind SSH from IPV4 as well and only allow logins over IPV6 this will reduce log spam by 99% ---------------------------------------------------------------------- botterway · 2023-09-27 16:06 Yeah, erm, okay. ---------------------------------------------------------------------- DirectReflection3106 · 2023-09-27 16:07 do you readlly really really need to open ssh to your server to whole world or maybe you have some ip(s)/ip range where you connects from usually? so just make it available from those ips. and vpn if you need to use it while away. ---------------------------------------------------------------------- DerKommunist- · 2023-09-27 16:10 Outsourcing them to Microsoft/Google/Amazon or other Cloud Services. Should they Deal with attacks and shit lol 😂 ---------------------------------------------------------------------- Mother-Wasabi-3088 · 2023-09-27 16:14 Only need to ensure that 1 port is secure instead of dozens. If brute- forcing Wireguard were easy we would know about it. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-09-27 16:14 The techniques are simple: 1. Verify all incoming connections. That means SSL, DNSSEC, TLS, something. 2. Fail2ban with stringer settings (mist botnets seem to be hard coded). 3. Firewall. Block foreign countries or at least Russia, China, Singapore, Iran, Azure; sources of about 99% of bot nets. 4 No UPNP or auto port forwarding. 5. Block all ports except specific ones I open. 6. No two passwords are alike. Use a password manager. 7. Public facing ports for something like sharing files via email. Everything else is internal only (Tailnet). 8. 2FA on critical administration accounts (name server, servers, Bitwarden). 9. Anything that can be isolated is. My untrusted devices (TVs) are on a guest LAN…internet access only. Connections to a Cloudflare tunnel share a Docker bridge network, not LAN accessible except via nginx or Cloudflare. The idea is to minimize the external attack surface, and aggressively protect the internal attack surface too. I’m not quite a Zero tier zealot but I recognize the need. ---------------------------------------------------------------------- just-ans · 2023-09-27 16:15 Nice, I have fail2ban implemented, now will look into Crowdsec. ---------------------------------------------------------------------- just-ans · 2023-09-27 16:15 What do you use for 2fa? ---------------------------------------------------------------------- Gabe_Isko · 2023-09-27 16:16 Honeagly, I would not recommend ssh port access at all over the public internet. Put it behind a VPN. I only have http and https ports forwarded, and those are behind a fail2ban setup (this is all based on the SWAG reverse proxy from linuxserver.io). ---------------------------------------------------------------------- just-ans · 2023-09-27 16:16 Well I have fail2ban, non standard ssh ports, I don't know what Traefik is, I have disabled password logins. Now, will look into Traefik ---------------------------------------------------------------------- just-ans · 2023-09-27 16:17 and please add like you will have to specify your key file, if you have more than 1 keys right? ---------------------------------------------------------------------- the-internet- · 2023-09-27 16:19 You disable it within /etc/sshd/sshdconfig Then create ssh keys to allow password less ---------------------------------------------------------------------- just-ans · 2023-09-27 16:19 Yes, I've heard about this tip. the IPv6 space is somewere around 10 Quitilion addresses. I don't know how many zeroes those are, but compared to IPv4's 7 Billion. ---------------------------------------------------------------------- sk1nT7 · 2023-09-27 16:27 Only exposing Traefik as reverse proxy. Requiring authentication and 2FA with Authelia as middleware. Parsing traefik logs with promtail and loki into a grafana dashboard. Fail2ban also inspects traefik logs and bans abusive behaviour like forceful browsing (many 404 errors) or general brute forcing (many 401 or 403 errors). Traefik itself and all proxied services are behind Cloudflare. Firewall allows TCP/80 and TCP/443 from Cloudflare IPs only. Traefik only requests wildcard SSL certificates to ensure that my subdomains are not disclosed publicly in certificate transparency logs. For internal services I have valid SSL certs too. Access only from local lan or via VPN (I use wg-easy). The only other port, which is exposed except of TCP/80 and TCP/443 is SSH. Here only pubkey-auth is allowed and the SSH port was changed to a non-standard one, which helps reducing bot traffic and auth tries. ---------------------------------------------------------------------- just-ans · 2023-09-27 16:28 Thanks for this comprehensive guide, You have included almost all the stuff that I found after reading articles for weeks, like port knocking seemed pretty cool to me, I never heard about certification authentication for SSH, I today came to know about SELinux. I'm using nginx as my reverse proxy, request comes to NGINX and then it comes to my gunicorn server for my Django application, but the Djago application locally doesn't have any certs. Thanks for the info. ---------------------------------------------------------------------- bnberg · 2023-09-27 16:35 My "NAS" is only reachable at home (except an Wireguard tunnel to it, which still requires a Password and Username). And my VPS have simply my Private SSH key (which has obviously a passphrase). And i have fail2ban and a monitoring. I dont want to overengineer it, while still using good practises for a private hobby. ---------------------------------------------------------------------- vikymonkey · 2023-09-27 16:37 Would argue keeping password login is beneficial, just keep a long password. And store it, in case you lost the rsa key. ---------------------------------------------------------------------- Spuxilet · 2023-09-27 16:37 1 I use wireguard vpn to connect to my services from LAN or WAN. There is no other way to connect to them as ports are not forwared to the host. Only 2 ports for dns and wireguard. Wireguard is open from WAN side of course. 2 All services are isolated in their own network. I use traefik as proxy. 3 I have proper https certificates for all my services. Use duckdns for it. 4 I use dockersocketproxy for containers that need docker socket. In which i could not figure out how to use this i mount docker socket in readonly mode. 5 I always backup using rsync my whole docker setup (docker root) to my laptop and external drive. ---------------------------------------------------------------------- RydRychards · 2023-09-27 16:38 Wireguard ---------------------------------------------------------------------- just-ans · 2023-09-27 16:41 Which VPN do you recommend? ---------------------------------------------------------------------- SirEDCaLot · 2023-09-27 16:42 VPN for access + no external open ports. Problem solved. ---------------------------------------------------------------------- pigers1986 · 2023-09-27 16:47 unless server needs to be exposed, it can be accessed via tailscale only ---------------------------------------------------------------------- lutiana · 2023-09-27 16:47 Google how to harden SSH, there are more than a few things you can do. Also, look into fail2ban, it goes a long way to stopping most of the attacks. Consider not opening SSH to the internet, but if you have to, consider turning off username/pass authentication and use private key authentication. Personally the only ports I have open to the internet for my stuff is 80 and 443, and anything on 80 gets re-directed to 443. This is an nginx reverse proxy for some services. Outside of that, I use VPN access (piVPN) to get onto my network remotely if I need to. ---------------------------------------------------------------------- just-ans · 2023-09-27 16:48 Well, do you use sub netting to create a separate network for these devices? Well I'm a beginner so correct my if I'm wrong. ---------------------------------------------------------------------- just-ans · 2023-09-27 16:50 How do you use ntfy to send a notification to your phone when an ssh- connetion to one of your system is made? Could you describe a little? ---------------------------------------------------------------------- zim1985 · 2023-09-27 16:55 I only expose port 22, 443, and 80 to the wild. 22 is locked down by fail2ban. 80 forwards to 443. Every service that is behind my reverse proxy is behind Authelia with 2FA enabled (unless the apps has auth of its own that that I can swap out for Authelia in some way). Given how I use my services I've tried to find a balance between security and usability (non tech savvy friends and family use things). I'm sure there are things I could do to make it better but I think I've covered my bases pretty well. ---------------------------------------------------------------------- just-ans · 2023-09-27 16:55 This was really nice. ---------------------------------------------------------------------- just-ans · 2023-09-27 16:57 What configuration management tool do you use? ---------------------------------------------------------------------- foomatic999 · 2023-09-27 16:58 Just as described in the manual. https://docs.ntfy.sh/examples/ Since I have a syslog server, this one would have been a better source. Maybe I'll get around to fixing it some day. ---------------------------------------------------------------------- just-ans · 2023-09-27 17:00 Thanks, after reading all the above comments I came to your comment and this line really is good "It's really easy to build out something that becomes a monster to feed and maintain.", I will check all the solutions mentioned for learning purposes and then I will use threat modelling to secure my server, according to the needs. ---------------------------------------------------------------------- mystarkfuture · 2023-09-27 17:00 That is just a reverse proxy that automatically installs and renews SSL certs from letsencrypt. You may use something else like nginx or caddy. It all does the same thing. ---------------------------------------------------------------------- just-ans · 2023-09-27 17:04 I'm new to networking, could you explain how zero ports open in my firewall is gonna allow my service to get a connection? ---------------------------------------------------------------------- just-ans · 2023-09-27 17:04 What are pods? ---------------------------------------------------------------------- xSean93 · 2023-09-27 17:07 Well, I do it with my router. But you could use something like PiVPN ---------------------------------------------------------------------- Croatwink · 2023-09-27 17:09 Mainly just keep it up2date, set unique passwords, use key-based auth and don't expose services needlessly. 25 years of selfhosting and not a single server hacked so far. (My personal laptop got hacked once but that's another story;) I never bothered with fail2ban, but I was known to change the ssh port for a period. Now I don't care anymore. The logs rotate anyways and it's not that bad. Actually my latest development might be to completely disable ssh. I've been getting more and more into IaC using CoreOS as an immutable container host and at work we have a staging environment with ssh enabled, and a prod environment where you can't login neither over ssh nor local console. So that might be the next step for my personal environment, ensure that deploys are idempotent and just disable logins. ---------------------------------------------------------------------- just-ans · 2023-09-27 17:09 Well, I would like to know more about this? I'm new could you describe by giving an example? ---------------------------------------------------------------------- just-ans · 2023-09-27 17:12 Hey, I 'm running a mail server too, I use mailinabox for the time, but my cloud VPS i.e digital ocean has blocked my port 25. Do you host your mail server locally? ---------------------------------------------------------------------- just-ans · 2023-09-27 17:13 Please share, if you find anything useful. ---------------------------------------------------------------------- just-ans · 2023-09-27 17:15 Yes, the IPv6 thing works. ---------------------------------------------------------------------- just-ans · 2023-09-27 17:16 How do you map the number and locations of remote hits to check if someone is actively trying to exploit your server? ---------------------------------------------------------------------- just-ans · 2023-09-27 17:16 How much difference does, a software based vs a hardware based firewall makes.? ---------------------------------------------------------------------- just-ans · 2023-09-27 17:17 Leave the sarcasm as well as the sub reddit. LOL ---------------------------------------------------------------------- Complex_Ad8695 · 2023-09-27 17:29 Kubernetes. Like docker containers just managed by Kubernetes instead. ---------------------------------------------------------------------- wubidabi · 2023-09-27 17:33 Yes, by adding e.g. ‘-i ./.ssh/homelab’, if you’re starting the SSH connection from your home folder on a Linux/macOS system and your key is called *homelab* (rather than *id_rsa*). Since you’re asking about more than one key, I’d recommend naming them appropriately. ---------------------------------------------------------------------- Girgoo · 2023-09-27 17:36 Geolocation restrictions on ip. Vpn. ---------------------------------------------------------------------- pielman · 2023-09-27 17:42 1. Cloudflare Proxy / SSL 2. Authelia 2factor authentication for all public facing domains on cloudflare 3. fail2ban 4. No ports exposed to WAN, no NAT everything is with cloudflare tunnel 5. tailscale VPN for accessing internal network 6. backup wireguard 7. SSH access is with public/ private key authentication only ---------------------------------------------------------------------- michaelpaoli · 2023-09-27 17:46 >How do you protect your servers? Don't run services open to The Internet that you don't want and intend to have open to such. Notably if there ain't nothin' listening on the port, then there's nothing to attack there. Likewise if it's not listening on IP(s) reachable from The Internet. Keep things well "patched"/updated and current. Use fail2ban to cut down on some of the nuisance (like tons of stupid bot attacks on ssh). And have limited some services ... because ... stupid bots. E.g. sign up on wiki to create your account and access ... yeah, no more fully automated ... because damn bots. And stupid bots at that, that chew up lots of resources, and can't even achieve what they're attempting ... because most of the bots are stupid. ---------------------------------------------------------------------- Mag37 · 2023-09-27 17:48 Step by step. - Create a local key - `ssh-keygen -t rsa -b 4096` Follow the steps, use default path, set a passphrase. - Copy the public part of the key to the server - `ssh-copy-id -i $HOME/.ssh/id_rsa.pub username@remote.server` This will require your usual password for the server, it'll store your public key on the remote server to allow it as a method of auth. - Try to connect to the server as usual, enter your new passhrase when prompted. - If successful, disable password auth: - edit `/etc/ssh/sshd_config` with editor of choice. - find and set `PasswordAuthentication no`, make sure its uncommented. ---------------------------------------------------------------------- beheadedstraw · 2023-09-27 17:49 VPN for anything internal, reverse proxy for anything external, Key based auth for SSH (which is only accessible through VPN) and banning China/Russian/Iran/\*insert questionable country here\* IP's for icing on the cake. ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-09-27 17:51 - firewall - (public key auth for SSH) - fail2ban (crowdsec will be tested) - regular patching ---------------------------------------------------------------------- BeYeCursed100Fold · 2023-09-27 17:53 Here's a wakthrough for Ubuntu: https://www.digitalocean.com/community/tutorials/how-to-set-up-multi- factor-authentication-for-ssh-on-ubuntu-20-04 The instructions haven't been updated, but it still works on Jammy and Debian 13. ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-09-27 17:54 correct but it‘s not an issue if you‘ve got left with some kind of console access ---------------------------------------------------------------------- causal_friday · 2023-09-27 17:57 There is no reason to use a password. In the worst case, you can physically access the machine (cloud provider console, drive to the datacenter and use the console) with a password, and update \~/.ssh/authorized\_keys. But, you shouldn't be losing your private key, just throw it in your password manager like you would with the long password. ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-09-27 17:58 try: ssh-keygen -t ed25519 -a 420 -f -C "comment that makes clear what the key is used for“ ed25519 are much short when displayed … easier to handle not less secure ---------------------------------------------------------------------- hm876 · 2023-09-27 18:02 No ports open, which means it's harder to get in i.e no port forwarding. If the connection starts within your network, it's easier to create a secure connection that doesn't involve connection to your LAN via a port that's exposed on your router. ---------------------------------------------------------------------- laser50 · 2023-09-27 18:13 Don't use port 22... I use 2202, no one finds out. Otherwise, Dont open the ports and use a VPN for ssh outside of the network. ---------------------------------------------------------------------- sirrush7 · 2023-09-27 18:22 Besides CrowdSec, Geoip blocking, WAF, IDS/IPS, anything I publicly expose is only via a REVERSE PROXY (nginx via SWAG) with valid SSL certs. And wireguard. I only opened 443 for specific websites I host, and everything else is wireguard only. I don't bother or risk opening access directly to my devices in this day and age... ---------------------------------------------------------------------- iCrumbz · 2023-09-27 18:26 NPM reverse Proxy, Cloudflare WAF (Country and HTTP version filter), Authelia 2FA, fail2ban configured to track NPM Logs and automatically block IPs on Cloudflare IP Access rules via API. Just ordered a Unifi dream machine. ---------------------------------------------------------------------- Dr_Narwhal · 2023-09-27 18:29 Airgap ---------------------------------------------------------------------- Windows_XP2 · 2023-09-27 18:34 Tailscale if you want something easy and can't port forward. There's a few other similar options, but I've had good luck with Tailscale. ---------------------------------------------------------------------- beesuptomyknees · 2023-09-27 18:35 Thanks for this. Looks great and just what I’ve been meaning to set up. ---------------------------------------------------------------------- MacGyver4711 · 2023-09-27 18:48 Cloudflare tunnels with Google mfa and country restrictions seems to working nicely for my apps. No open ports in the firewall, which is good in my mind If ssh access is needed I've been using Tailscale, and for piece of mind I've disabled login with passwords and only use certificates. I don't have anything special stuff exposed, so until I have a breach this is my go-to setup 👍 ---------------------------------------------------------------------- yawkat · 2023-09-27 19:06 Attacks will come in no matter what you do. But as long as most services are firewalled there's little to worry about. Even keeping ssh open on port 22 is not a big risk, unless you are using a very weak password (just use key auth). ---------------------------------------------------------------------- Noname8899555 · 2023-09-27 19:08 Do not open it to the internet. I host a vpn to my private network on my router or a vps ---------------------------------------------------------------------- lunakoa · 2023-09-27 19:09 Backups and a DR plan, dont forget that. ---------------------------------------------------------------------- chanc2 · 2023-09-27 19:11 The one I use produce a lot of analytics of what’s being blocked. Not sure about a software one. Of course a hardware one has dedicated CPU just focused on the task. And it monitors both inbound and outbound traffic. ---------------------------------------------------------------------- nitsky416 · 2023-09-27 19:11 My phone split tunnels when I use VPN and none of the hotspot traffic goes down the VPN tunnel, only phone traffic. ---------------------------------------------------------------------- nitsky416 · 2023-09-27 19:13 The closest I come to mixing these two is deciding that which of my personal accounts I want to use on my work computer (basically just things like Marriott and southwest because I travel for work), and then sharing those in a bitwarden organization owned by my personal account that my work account is a member of. Otherwise it's completely separate, even keep em on a different SSID and VLAN if I'm using my home Internet connection. ---------------------------------------------------------------------- DWolfUK40 · 2023-09-27 19:29 Don’t take this the wrong way but you need to do some serious homework so you understand fully what’s happening and why. There’s no reason to have loads of ports open. Setup a vpn or similar to access internal networks if you need to and proxy everything you want internet facing. There’s no need to have ssh ports open at all if you set things up right. You can ofc add all sorts of other things to make things safer. ALWAYS understand what you’re doing and why and how to test it otherwise you can feel safe whilst been wide open and that can be worse. ---------------------------------------------------------------------- cpt_adam · 2023-09-27 19:44 I set up Slack notifications if anything happens I have it. Other than that, every couple of days ---------------------------------------------------------------------- loctong · 2023-09-27 20:52 Ansible, but I’m changing to puppet. Pays to be proficient in multiple. ---------------------------------------------------------------------- l86rj · 2023-09-27 20:59 I'm not saying you should rely only on that or anything. The firewall is still there. It's just an easy way to make it a bit more safe and avoid the situation related by OP with very little effort. In regards of remembering the address, I don't need it. My ssh connections are saved and web pages bookmarked. If I ever need to input the address manually, I copy it from a note in Google keep. ---------------------------------------------------------------------- _3xc41ibur · 2023-09-27 21:04 I've substituted my default ssh port for a tarpit instead. It essentially sends an ssh banner very very \*very\* slowly. I'm only one person, but maybe it'll slow something down. https://github.com/skeeto/endlessh ---------------------------------------------------------------------- Asyx · 2023-09-27 21:04 The easiest way is whatever your router can do. If you are European you have probably heard of AVM and their Fritz line. They're like the default "good" router in Germany and I think some other countries as well. They can do pretty much everything that you'd know as a consumer. OpenVPN and Wireguard are the big ones. Your router might offer something else. Alternatively, just install Wireguard on your server. I have a script that checks if my external IP changed and then sets a DNS record. The only port that is actually open on my router is Wireguard and I just picked a random one. ---------------------------------------------------------------------- ayoungblood84 · 2023-09-27 21:05 Get a domain, allow cloud flare to manage it. Use dynamic DNS and also run a reverse proxy like nginx or haproxy. Then standard stuff like only allowing needed ports, vlans, and a proper firewall. ---------------------------------------------------------------------- Asyx · 2023-09-27 21:06 I stopped caring once I switch everything from a VPS to a machine in the basement. If you have access to that machine you are either in my house or got past my router and wireguard or are in my house. ---------------------------------------------------------------------- luftgoofy · 2023-09-27 21:10 I use multiple Systems too secure my homeserver. First Layer ... ufw + custom ssh Port and fail2ban Second Layer... ssh key Third layer ... yubikey for high risk actions (sudo etc.) Not unbreakble, but very secure. ---------------------------------------------------------------------- xyrodileas · 2023-09-27 21:19 I need to expose services to friends, so I try to apply defense in depth : - physical firewall to allow/deny traffic + Geoblock IPs not in my country, NAT inbound traffic + DMZ to isolate the host - Uncommon port for ssh and admin in general (more obscurity than security) -2 load balancers (one internal only, one external), I use then to filter url I don't want accessible outside - All services behind SSO (if the app support oauth or via auth proxy) - An IDS to inspect and alert on suspicious traffic I'm currently working on setting up a transparent proxy, but that require to install my CA in all my containers for https to work Next would be rootless containers and Web Application Firewall 😅 It might be never enough to have peace of mind though ---------------------------------------------------------------------- h7x4 · 2023-09-27 21:26 Sure! Most distros heavily underutilize systemd. The service files are configured with the bare minimum amount of config needed to get them running. There are a lot of other option that let's you do cool things, including a lot of hardening options. You'll find most of them available in [systemd.exec](https://www.freedesktop.org/software/syste md/man/systemd.exec.html). While there are too many to have any good examples here, [this](https://blog.sergeantbiggs.net/posts/hardening- applications-with-systemd/) might be a good starting point. Also, have a look at the output of `systemd-analyze security `, it will tell you what could potentially be improved. Two of the cool features I find myself using a lot both for security and to spare resources, is socket activation and network namespaces. If a service does not make any server side requests, I can put it in its own network namespace. This means it will have it's entirely own IP stack, and usually only access to the loopback interface. The service stays off, and systemd listens on the socket (let's say 127.0.0.1:8000). Whenever someone connects to this, systemd will automatically start the service, and hand over the socket to the service to handle the request. The service is entirely locked out from any networking with the rest of the machine. If the service does need to do serverside requests, I can add a network card (or even a VPN tun interface) to the namespace for the service to route traffic through. At some point, you have hardened it so much that it starts to become the same level of sandboxing as a docker container. You can actually run another kind of container this way, using systemd-nspawn. That too brings some really neat features. Easy shell access, spawn dependencies, shared logs, etc. ---------------------------------------------------------------------- Boomam · 2023-09-27 21:27 Be that as it may, it's a bad idea and bad for security in every context. There's zero justification that would change that. ---------------------------------------------------------------------- slickwillymerf · 2023-09-27 21:30 I use VRFs on my network to segment all traffic up to my firewall. My DMZ services live in a proper DMZ, though I currently run all VMs on a single cluster. VLAN’d traffic of course, but I’m not too familiar on how to achieve securely segmented VMs on my Proxmox host. I’m probably going to go ahead and buy a physically separate VM server for that purpose. ---------------------------------------------------------------------- pixelvengeur · 2023-09-27 21:41 I tried it, and mine does too. Quite and interesting technology too ---------------------------------------------------------------------- Majestic-Contract-42 · 2023-09-27 21:41 I web search for " post install security steps" and do whatever the top 10 list of that says. I figure being not the lowest hanging fruit is good enough. ---------------------------------------------------------------------- LolMaker12345 · 2023-09-27 21:42 I don’t have it open to the internet, if I need to access it from outside my network, I use twingate ---------------------------------------------------------------------- ithakaa · 2023-09-27 21:44 Im only sharing my services withy siblings so I just use tailscale. Done and dusted ---------------------------------------------------------------------- l86rj · 2023-09-27 21:46 Would you mind explaining to me why it's less secure than exposing ipv4? Or you're just saying it would change nothing for OP? I really thought that could reduce the intrusion attempts, but I'm no expert at all. ---------------------------------------------------------------------- Background_Ask_4310 · 2023-09-27 21:46 I follow this: https://tailscale.com/kb/1077/secure-server- ubuntu-18-04/#prerequisites ---------------------------------------------------------------------- nik282000 · 2023-09-27 21:49 Ooo, that is a good idea. No IPv6 for me though. ---------------------------------------------------------------------- nik282000 · 2023-09-27 21:51 I have a python script that scrapes my apache log and auth log every day for IPs, then it counts the number of requests/login attemptsper IP and checks Shodan to get location data if it's available. ---------------------------------------------------------------------- Electrical-Piece-389 · 2023-09-27 22:07 Traefik is also a bit better when using container, it can navigate in the virtual network of the container itself ---------------------------------------------------------------------- dinosaurdynasty · 2023-09-27 22:21 VPNs on some devices are a PITA (most mobile only lets you have one VPN at a time, and if you're already using the slot...) The other alternative (that I admit could be better documented) is reverse proxy authentication. I use Caddy + Authelia. Works _amazingly_ and I don't have to worry about upgrading things constantly because they aren't exposed at all (or at least, not more than a VPN would). ---------------------------------------------------------------------- southwood775 · 2023-09-27 22:32 This. ---------------------------------------------------------------------- kevinglasson · 2023-09-27 22:33 Lots of good suggestions, I would use a zero trust solution these days. No need to open your network - Cloudflare Zero Trust, or Twingate… etc ---------------------------------------------------------------------- dontworryimnotacop · 2023-09-27 22:40 Hint: many ports in the 40's range don't show up on nmap scans, if you change your SSH port to one of those you'll likely never see a single bruteforce attempt again in the server's entire lifetime. ---------------------------------------------------------------------- Anposter · 2023-09-27 23:07 If you use reverse proxy, which is the only right way it's again one port (443) to expose. And no we wouldn't know about wireguard being vulnerable, until after the fact. That is what Heartbleed, Spectre and Meltdown have thought us. If you really don't want something exposed in your network, don't allow it at all on your router. Using external tunnels is probably better, as much as secure and trusted that can be if external companies are involved. ---------------------------------------------------------------------- digestedbrain · 2023-09-27 23:08 Make people use a free VPN to connect ---------------------------------------------------------------------- qqby6482 · 2023-09-27 23:27 how safe is to block all ports but one, ie 9999 then use vpn on that port and access the server, like ssh or http sites, only while using the vpn? ---------------------------------------------------------------------- srosorcxisto · 2023-09-27 23:29 Lan access only, enforce both at the router level and using UFW on the server. wireguard via Tailscale to VPN in from the outside. ---------------------------------------------------------------------- ThrowAllTheSparks · 2023-09-27 23:49 Oooooo that's a pretty cool tip - thanks! ---------------------------------------------------------------------- Sensitive-Farmer7084 · 2023-09-28 00:01 Patch aggressively. Stop unused services. Monitor network traffic and system event logs with Security Onion. ---------------------------------------------------------------------- Sensitive-Farmer7084 · 2023-09-28 00:06 There is no airgap. There is only the meatbridge. ---------------------------------------------------------------------- Sensitive-Farmer7084 · 2023-09-28 00:11 The lonely correct answer, all the way down at the bottom with a single upvote. Well, have another one on me. ---------------------------------------------------------------------- StrykerSigma · 2023-09-28 00:12 I spray them with holy water 🙄 ---------------------------------------------------------------------- Sensitive-Farmer7084 · 2023-09-28 00:15 Offsite backups! Team up with a friend homelabber and host each other's backups. ---------------------------------------------------------------------- TripletStorm · 2023-09-28 00:23 If I want to mail you something I need your home address. If many people share an address we have unit or apartment numbers. Every computer on the internet has an IP address. To connect to that computer you need an address AND a port number (think an apartment number). If your firewall has no ports open there is no way for me to “talk” or connect to your computer. For me to hack you, your computer has to call me. If you self-host you either open ports on your firewall so people outside your home can talk to your computer -or- find someone else to open a port for you and connect to them. ---------------------------------------------------------------------- Sensitive-Farmer7084 · 2023-09-28 00:25 It's less about the port itself, more about what service you run on that port and which protocol you use. Wireguard uses UDP and drops packets that don't authenticate, so it can remain pretty well hidden even though the port is open to the world. A TCP-based VPN has to establish a connection with a 3-way handshake, meaning the server will reply to SYN requests and effectively tell the world of its existence. Once the port is found to respond, a simple nmap service scam will quickly discover which service it is, software version, etc. tldr, generally safe if you also make good architecture decisions. What you describe is a common pattern for phone-home VPN. ---------------------------------------------------------------------- purepersistence · 2023-09-28 00:30 Does your router forward port 22? Why? ---------------------------------------------------------------------- Bouncing_Fox5287 · 2023-09-28 00:57 You can also match by IP address so for everything outside of your own subnet password Auth is required but within your subset you can use a password to get in if for some reason you lose your keys (e.g. device factory reset). Adding the section below allows a password from your subnet: ``` Match address 10.30.0.0/16 PasswordAuthentication yes ``` ---------------------------------------------------------------------- jmeador42 · 2023-09-28 01:12 Don't expose anything to the internet at all. I put it all on a private Tailscale or Nebula network. You get all the benefits of a private LAN but with the accessibility of the wider internet. ---------------------------------------------------------------------- LightningJC · 2023-09-28 01:16 CloudFlare tunnels is pretty easy and can be secured with your choice of MFA, I use Azure AD. No open ports to the internet, can access from any PC and don’t need to install a VPN client. This assumes the things you need to access are web based, and realistically everything you host should be web based if you’re using modern technologies. ---------------------------------------------------------------------- idoescompooters · 2023-09-28 01:22 I’m a Tailscale user. Do I need to do anything extra in terms of security or you’re saying it’s already good by default? I know I use 2FA for SSHing into my exit node. ---------------------------------------------------------------------- luche · 2023-09-28 01:48 still requires direct access to the hosts docker.sock though, correct? ---------------------------------------------------------------------- thedaly · 2023-09-28 02:23 > I found that many attempts were being made on my SSH port (22)... > Then I searched and found changing the default port will reduced the automated attacks... Security through obscurity isn't the solution. Using a non default ssh port is recommended best practice and will certainly reduce the volume of automated attacks, but it only protects against the very bottem tier attacker. It is trivial to scan a host and identify an ssh server listening on a non default port. Some basic tips I tend to use and would recommend: - Passwords / Sudo User / Etc - Configure a non root admin/sudo user. Strong passwords should be used on all user accounts and root account. - Optional: Setup 2fa for sudo with google-auth or other solutions. - Firewall - Setup a firewall and block incoming connections by default. - On a typical basic system, I typically configure the firewall to allowing outgoing connections by default, block incoming by default, and specifically allow 22, 80, 443, and any other custom ports that I need open. - Fail2ban - Setup fail2ban and enable it for the sshd server. Fail2ban is a application/service that monitors the access logs and blocks an IP after a configured number of connection attempts. - SSH Server (sshd) - Disable root login - Disable password login and require public key auth instead - [SSH Hardening Guides](https://www.sshaudit.com/hardening_guides.html) - Additional Resources: - [Intro to securing a ubuntu server, lots of good links.](https://blog.akbal.dev/how-to-completely-secure-an-ubuntu- server) - [Arch Linux Wiki - Security Page](https://wiki.archlinux.org/title/security) - [Red Hat Enterprise Linux Documentation - Security Hardening](https://wiki.archlinux.org/title/security) ---------------------------------------------------------------------- GreenPRanger · 2023-09-28 02:52 Nothing, I don’t care. It’s been running smoothly for 9 years 👍 ---------------------------------------------------------------------- quizmical · 2023-09-28 03:41 Hmm, I use a wiregaurd VPN mesh, with a $4 a month vps as a "hub" running pfsense. Nothing really has any open ports to the world. Wireguard on laptop, witegaurd on phone. ---------------------------------------------------------------------- vosaram · 2023-09-28 03:48 Here's what i do to protect my servers and services: \- fail2ban \- whitelist some services to only allow access by my IP or VPN \- only allow private key for ssh logins \- custom DNS for my private services, something like media.local, password.local, etc. So it can only be accessed by devices that uses my dns server \- i also setup alerts in grafana if unknown IP reached limits ---------------------------------------------------------------------- FoxxMD · 2023-09-28 04:09 How is security onion ingesting traffic? Do you have a top-level switch with a tap/span port? Or running pfsense and security onion on the same machine? ---------------------------------------------------------------------- XChikuX · 2023-09-28 04:16 I'd recommend a wireguard docker instance to get into the network followed by passwordless SSH. IPv6 is overkill, and will reduce your readability if you are working with many systems. ---------------------------------------------------------------------- nickyzhu · 2023-09-28 04:19 For cyber attacks, Cloudflare has a lot of stuff. For physical attacks, I adopted two strat cats. They patrol the server room nightly ---------------------------------------------------------------------- XChikuX · 2023-09-28 04:28 If you want better latency than tailscale. I highly recommend this docker image: https://hub.docker.com/r/weejewel/wg-easy ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-09-28 04:32 This is the only IDS I use: https://github.com/64mb/SLAT-ssh-login- alert-telegram ---------------------------------------------------------------------- XChikuX · 2023-09-28 04:37 This: [https://hub.docker.com/r/weejewel/wg- easy](https://hub.docker.com/r/weejewel/wg-easy) Open up the right ports on your router. Tailscale is also great. ---------------------------------------------------------------------- Radsdteve · 2023-09-28 04:41 yep, see [here](https://doc.traefik.io/traefik/getting-started/quick- start/). ---------------------------------------------------------------------- AmateursPls · 2023-09-28 04:47 Yup, the latter. There was a guide on here a few years ago for getting started with it. I also use barnyard to communicate snort alerts to Security Onion via PFSense. ---------------------------------------------------------------------- WildestPotato · 2023-09-28 05:05 Thank you bestie ❤️ ---------------------------------------------------------------------- import-antigravity · 2023-09-28 05:27 IPv4's \*4 billion addresses ---------------------------------------------------------------------- ItalyPaleAle · 2023-09-28 05:37 > Traefik itself and all proxied services are behind Cloudflare. Firewall allows TCP/80 and TCP/443 access from Cloudflare IPs only. Consider using CF tunnel. Then you have no need for the open port at all. ---------------------------------------------------------------------- Professional_Yam_130 · 2023-09-28 05:37 iptables allow ssh from my home ip or if it must be open port 22 iptables rate limit and put in sshd config alowusers x. and limit ciphers. or fail2ban sshguard etc ---------------------------------------------------------------------- rokiden · 2023-09-28 05:40 No, you can use proxy with restrictions, traefik only need to read containers and events. https://github.com/Tecnativa/docker-socket-proxy There is no fresh image, but it is easy to run original haproxy image with mounted haproxy.cfg from their repo. Such proxy really handful for monitoring your containers from other tools and you don't need to trust them. ---------------------------------------------------------------------- HearthCore · 2023-09-28 05:41 For what legitimate work reason? ---------------------------------------------------------------------- AroundThisEarth · 2023-09-28 05:46 Nope. The same goes for pretty much any VPN that connects two end points unless you're explicitly exposing ports or similar. Assuming your machines are all behind normal routers that means they're not accessible to any incoming internet traffic. Tailscale doesn't change that, it just allows them to talk to one another via WireGuard ---------------------------------------------------------------------- HaussingHippo · 2023-09-28 06:10 What are some obvious pitfalls that may be missed? ---------------------------------------------------------------------- eve-collins · 2023-09-28 07:03 But if the OP is behind a router that doesn’t proxy any ports (22, etc) to a particular internal box they should be fine regardless, right? ---------------------------------------------------------------------- BrigsLabs · 2023-09-28 07:33 This method, if you still using ipv4 and must exposed some port to internet 1. on router, use different port (> 20.000) and using dst-nat to real port ssh machine . 2. on ssh server completely disable password auth, only use key. 3. on ssh server setup csf firewall, secure all port, give only access to save ip, subscribe some blocklist for bad actor, or you can use geo-restrict ip block ---------------------------------------------------------------------- french_violist · 2023-09-28 07:41 Plus fail2ban. ---------------------------------------------------------------------- exmachinalibertas · 2023-09-28 07:42 The tldr is that security is about layers. You put ssh on a non- standard port but you also only allow ssh keys and not passwords just in case the non-standard port isn't enough. Then you also only allow ssh for an unprivileged user, to mitigate the damage if any attacker gets in with ssh. For every aspect of you computer and any applications you run, research how best to secure them and do as many layers as you can. You never know what vulnerabilities or zero-days will crop up, so you just do as much as you can and hope for the best. And of course, setup logging and monitoring and alerts for if something bad does happen. Security is hard because you never get any positive feedback to know if you've done enough. You only get negative feedback when you've done too little and something bad happens. It's better to be paranoid, but at some point you also want to weigh the costs and benefits to determine how much effort you can reasonably spend and where it is most appropriate to spend that effort. ---------------------------------------------------------------------- Medium_Spell4822 · 2023-09-28 07:48 - fail2ban - disabled root ssh login - ufw - run all server in docker with no-root - traefik with ssl required ---------------------------------------------------------------------- VTXmanc · 2023-09-28 08:02 Hardening the OS, fail2ban, SELinux, using lxc non-root and docker container non-root. Premiter Firewall Fortigate 60F with all UTM Blades active aswell as changing management ports for SSH/HTTPS etc. (SSH in 2233 f.e. instead of 22) ---------------------------------------------------------------------- mystarkfuture · 2023-09-28 08:35 Crowdsec and fail2ban do the exact same thing. Perhaps Crowdsec is a bit more effective. So, no use having both. ---------------------------------------------------------------------- persiusone · 2023-09-28 08:49 A firewall helps. Not exposing anything to the 'wild' internet helps. A solid backup and restore process helps. A VPN for remote access helps. ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-09-28 08:51 Agreed. You could also use [OpenZiti.io](https://OpenZiti.io), its a zero trust overlay network which is FOSS and allows self-hosting, while also supporting more use cases (e.g., 'east-west' ZTN in your LAN). If you don't want to self-host, you can use CloudZiti with the free tier. ---------------------------------------------------------------------- Mag37 · 2023-09-28 08:54 You're right, I'll edit bits of it to my post! ---------------------------------------------------------------------- Teggers_Today · 2023-09-28 09:23 great stuff. thanks...i just use port 22. if youve set it to something else that makes it look like you have somehting to hide. my 1p worth ---------------------------------------------------------------------- mx20100 · 2023-09-28 09:43 I do the safe thing of not securing them heh. I'm in trouble. But I don't have anything public that shouldn't be public. Only allow certain ports that go to certain websites I have (such as a logviewer for a modmail bot in discord and a personal cloud storage for old photos I have on CD's so my parents can always access them) Everything always password protected with very strong passwords ---------------------------------------------------------------------- Astorek86 · 2023-09-28 09:49 Typically, if someone "hacked" into your ReverseProxy inside a DMZ- Net, the attacker could still attack the whole Webservices behind the ReverseProxy. But if you did Firewalling and Routing right, the attacker cannot go beyond that; the attacker cannot attack your whole LAN-Net if the DMZ-Net is compromised. Firewall-Rules are mostly like this: * Allow incoming WAN 80,443 to ReverseProxy * Allow outgoing ReverseProxy to WAN? No new connections, just if already established. (and VERY few exceptions, like 123 NTP and 53 DNS to Firewall itself, and maybe 80, 443 for Updates) * Allow ReverseProxy to LAN? Only the IP-Addresses, Ports and Protocols that are absolutely necessary to access the specific Servers, that you want to be reachable over internet. To be fair, this skips the whole "what if the Server itself is hacked?"-Scenario. But, in my opinion, a "real" DMZ (including it's own Subnet) isn't a bad idea overall... ---------------------------------------------------------------------- Kerboq · 2023-09-28 09:56 depends on the system of course, but by default it should be the auth logs. most systems log all activity so that should be checked too. ---------------------------------------------------------------------- Smaidz · 2023-09-28 11:28 Username checks out, holy crap Thanks, lucky to stumble upon your comment, as I am also starting out on my own homelab/selfhosting journey, and had a lot of questions about network security very much like the OP ---------------------------------------------------------------------- MRP_yt · 2023-09-28 11:41 All my server stuff getting backed up once a day to 3 different locations. All services i want to access from outside home-network - i am using tailscale and/or cloudflare tunnel. Cloudflare tunnel rules setup that A) needs to be my IP and B) verify using pin code to my email. Both needs to match to gain access. ---------------------------------------------------------------------- crisse-tabarnak · 2023-09-28 12:19 nano /var/log/auth.log 😂 ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-09-28 12:45 One of the most important things about a firewall: good logging output ---------------------------------------------------------------------- KlausBertKlausewitz · 2023-09-28 12:52 What if you’re too late and the IP change already happened? Are you locked out then? How do you change the IP then? ---------------------------------------------------------------------- 7aichi · 2023-09-28 13:04 MFA on SSH is too ---------------------------------------------------------------------- 7aichi · 2023-09-28 13:13 You're right in that minimising your attack surface is beneficial. So having one port open is better than many. But apart from that you're only as secure as the app you're presenting. Doesn't matter if it's VPN, reverse proxy or web server. OpenVPN has had its share of vulnerabilities. But sounds like you may have network isolation which helps too. :) ---------------------------------------------------------------------- trisanachandler · 2023-09-28 13:36 A pain, but true as well. ---------------------------------------------------------------------- Tai9ch · 2023-09-28 13:54 Going overkill on this stuff isn't helpful and has the potential of reducing security. Realistically the only risk from OpenSSH attacks is weak passwords, especially as root. There's no reason to allow root password authentication except maybe during initial setup, so don't do that. For non-root user password authentication, make sure your passwords are complex enough to prevent online brute force attacks. If you don't need password auth enabled, turn it off. Make sure you're installing security updates, preferably automatically. Using fail2ban is reasonable if you're really sketched out by the attacks showing up in your logs. Beyond that, stuff like non-standard ssh ports is just messing around. It makes things more complicated for no actual security benefit, and might convince you that you can skip the stuff that does matter like not having weak passwords. ---------------------------------------------------------------------- botterway · 2023-09-28 14:00 I guess I'm making the (perhaps somewhat naive) assumption that since a VPN is all about security, it's less likely to have security holes in it than, say, Jellyfin or any of the other services one might expose to the interwebs. ---------------------------------------------------------------------- luche · 2023-09-28 14:44 so... still a compromise instead of a real solution? thanks, but until [4174](https://github.com/traefik/traefik/issues/4174) is resolved with a valid solution, i'll stick with avoiding band-aids in production. ---------------------------------------------------------------------- DeMiNe00 · 2023-09-28 15:19 I am a fan of swords and judo. ---------------------------------------------------------------------- rokiden · 2023-09-28 16:49 From my point of view it is the finest solution. Access control middleware is wide used practice. Many small apps doing only their small jobs, Linux-way. Docker for containers, traefik for proxying them and haproxy for access control docker socket. ---------------------------------------------------------------------- NoNameJustASymbol · 2023-09-28 17:21 Network-based firewall (in some cases it's purely a firewall, in some it includes IDS/IPS). Host-based firewall. Fail2ban on host and a lot of code to dynamically manage host-based firewall rules. Heavy restrictions in the mail service. Web Application Firewall. Moving services away from their default port is "security by obscurity"... it's a only a feel good measure. ---------------------------------------------------------------------- Kharmastream · 2023-09-28 17:34 I don't expose anything to the internet. Vpn for the win ---------------------------------------------------------------------- willjasen · 2023-09-28 17:56 I don’t think what you’re asking about comes into play much really with the way my setup is, though I’m not sure if you mean inside or outside IP so I’ll cover both: my inside subnet isn’t going to change unless I wanna change it and that’s a lot of work; the outside is also listed as trusted and can technically change but doesn’t come into play with the way everything else is setup (local DNS points something like my MacBook directly to an internal website resource rather than routing it via my outside IP). Also, worst case is that I would just get into the Traefik server and update it for the new outside IP, but again, hasn’t ever been an issue. And oh yeah, Traefik is open to the world (at the moment) so that Let’s Encrypt certificates can generate but the DNS records for each of those services point to a dynamic DNS hostname provided by Meraki (my networking equipment of choice) so if my IP does change, there’s no overhead on my end - things should be chugging along in that front. ---------------------------------------------------------------------- swim_to_survive · 2023-09-28 21:06 So, is Promtail/Prometheus/Alert Manager something I can also use to pull syslog info from Unraid / PfSense? I found this https://github.com/thenaturalwill/pfsense-analytics and have tried my best to get it working but there seems to be some things broken due to recent versions and its just too much for me to try and fix. I'm looking for an alternative setup. Based on your wisdom and experience, should I nuke my pi that I have running all these services for this project that wont effectively work for something else? The end result product I would like is a nice grafana dashboard that aggregates all syslog stuff and other logs and can alert me as needed. ---------------------------------------------------------------------- ericesev · 2023-09-28 23:42 I've never used Unraid or PfSense, so please verify this advice. If Unraid/PfSense can send logs to a remote syslog server then this should work. I think you'd need to configure Promtail to listen for remote syslog messages. That configuration setting is described here: https://grafana.com/docs/loki/latest/send- data/promtail/configuration/#syslog ---------------------------------------------------------------------- swim_to_survive · 2023-09-29 01:05 Thanks!! Yeah it is pure syslog for both! So I’ll blow away this stupid graylog shit and do what you’ve done. Thanks for the config GitHub resources too. I hope I don’t run into any issues but if I do I might reach out. ---------------------------------------------------------------------- 7aichi · 2023-09-29 03:50 I'd suggest that's a dangerous assumption. Like I say, they're all just apps. So you're really at the mercy of the developers (who are people) developing these things, and the organisation who governs them. So for example, some software might deliberately be configured with backdoors (vulnerabilities) because of government directive. Or some companies might hire monkeys to do the development. This is why it's important to consider all software, including security-type software. And why it's important to have many layers of security. VPN, antivirus, reverse-proxy, firewall, network isolation, monitoring, etc etc. Not always easy for a home environment. But you do what you can do. A trusted VPN is a great start. ---------------------------------------------------------------------- Far_Lifeguard_5027 · 2023-09-29 04:53 It is all about using a layered defense. Never expose services such as SSH, FTP, Telnet ect to the internet. Use an openVPN or Wireguard VPN server for secure access for that. Yes, many knowledgeable home users will use a next-gen firewall with IPS along with other measures such as using reverse proxies (nginx) web application filters, DMZ zones and more. Personally I think a free firewall like Sophos XG is a perfect solution for home users who need remote access for self hosting. In fact almost nothing comes close to it for the price besides the cheap end firewalls like pfSense Zenarmor, or Untangle NG. ---------------------------------------------------------------------- PrizeMedium2459 · 2023-09-29 06:46 cloudflare for services, knockd for ssh + public key only auth ---------------------------------------------------------------------- thetredev · 2023-09-29 12:01 2 static IPs, first IP is for the server host (Proxmox) itself, second IP is WAN for pfSense VM. The pfSense WAN has 1 open port: WireGuard. The server host has 2 firewall rules: allow SSH from pfSense WAN IP, and allow 8006 from pfSense WAN IP. That's it. This way nobody can ever know the server host's IP. Nothing bothers my server because pfSense does wonders with this simple setup. Downside: gotta pay for the second IP. I tried with 1 IP only and a week after Chinese bots found their way into my server host, or at least they were able to DDOS it. Not when pfSense is in front with its own WAN IP. ---------------------------------------------------------------------- ProffesionalAds · 2023-09-29 12:57 Tailscale is a third-party provider. Although it is reputable in delivering secure connections, it, like any other VPN, does not guarantee default security. Tailscale and [Netmaker](https://www.netmaker.io/) uses Kernel Wireguard to enhance their security. ---------------------------------------------------------------------- idoescompooters · 2023-09-29 13:03 Well by default it is a local SSH on your LAN. Port 22 isn't exposed to internet. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-09-30 19:35 Wireguard + Cloudflare Tunnels is probably the easiest and safest setup you could achieve as a beginner. You use Wireguard to SSH into the machine (and perhaps to access your DNS ad blocker if you have one) and you use Cloudflare to serve whatever you're hosting. This essentially allows you to have 0 exposed ports to the internet and your services are attack proof thanks to Cloudflare. ---------------------------------------------------------------------- Sandmann_Ukulele · 2023-10-02 06:18 Did not expose any ports to the interwebs that you don't know how to properly secure. ---------------------------------------------------------------------- DatDamnZotzz · 2023-10-03 13:33 And wazuh 👊🏻 ---------------------------------------------------------------------- instant_dreams · 2023-10-03 15:09 Thank you so much for sharing this! It looks like there's a dependency on geoip, which I assume should be installed on the host - or is this on the promtail container? ---------------------------------------------------------------------- ericesev · 2023-10-03 18:47 You're correct. I have the [geoip database](https://www.maxmind.com/en/home) installed on the host. I'm using a bind mount to make it accessible within the Promtail container.