Is this server security enough? reddit / selfhosted ---------------------------------------------------------------------- mayurrenr · 2023-09-27 12:59 First, let me say that I understand that no security solution is perfect and there will always be flaws. I have purchased my first VPS (with Webdock for anyone who is interested in knowing my provider). Using cloudflare proxy with VPS doesn't work for some reason. I have setup ufw to close all ports except 22, which I want to retain for troubleshooting. Port 22 is restricted to allow inbound traffic from only 2 public IPs (my home and VPN service, both of which are static). Fail2ban has also been installed and configured. I'd prefer to use my own terminal for SSH rather than the Webdock interface for 'direct access'. Access to all other services is via cloudflare tunnel which is behind their zero trust email validation. Is there anything else I should do for someone in my position? (Ie. A small homelab, mostly for fun and convenience rather than anything mission critical). Thanks! ---------------------------------------------------------------------- ElevenNotes · 2023-09-27 13:09 You could use this [container image](https://hub.docker.com/r/11notes/sshpiper) to add 2FA and what not to your SSH setup. ---------------------------------------------------------------------- tomistruth · 2023-09-27 13:10 To add a notch, you could bind more sensitive web services like admin interfaces to only serve via an internal network and use a different subnetwork for public web services. ---------------------------------------------------------------------- mb2m · 2023-09-27 13:41 - Only allow public key authentication in sshd with unprivileged user account and strong sudo password - Strong passphrase on your private key ---------------------------------------------------------------------- CatOfTheDecade · 2023-09-27 13:46 That should be fine, but I'd recommend moving your SSH to a much higher port. Port 22 will be spotted instantly by anyone scanning your box. Higher ports can still be spotted, but it's going to require doing a full port scan, which takes time. Most script kiddies aren't running full scans on entire IP ranges because of how long it would take to find anything useful. ---------------------------------------------------------------------- FaBMak · 2023-09-27 13:53 I think your config is good enought. Maybe change SSH to use Key only, not passwords. ---------------------------------------------------------------------- glotzerhotze · 2023-09-27 15:23 security by obscurity won‘t add anything, but rather complicates usage of the system. don‘t change your ssh-port - unless you are comfortable adding -p to each ssh command. ---------------------------------------------------------------------- Idea_Guyz · 2023-09-27 15:36 Let’s say I just moved into a new house and would like to set up a secure network. We have two separate routers in the apartment. Is it better to hire someone local to come to the house to do it or is it possible to do this with a remote worker setting everything up? ---------------------------------------------------------------------- Idea_Guyz · 2023-09-27 15:37 And if remote is an option, are there any websites you would recommend for finding people? ---------------------------------------------------------------------- ElementalCyclone · 2023-09-27 15:46 About SSH, there's some extra steps that I personally like to do \- Moves it away from default port 22 \- You can use something like tailscale or makes your server as a Wireguard server then bind the SSH only to those wireguard/tailscale interface/IPs, or use UFW (as you already using it) to block your SSH port incomings from public interface. The only downside though, if your tailscale and/or wireguard (and ufw) goes funky, your ssh access will go down to the drain along with the 'funkiness' \- Not strictly 'security' per-se, If you are serving/doing something with HTTP, nginx can be a good layer of proxy+filtering+logging that can be extensible with many 3rd party app/plugins(?) ---------------------------------------------------------------------- Acceptable_Moment551 · 2023-09-27 16:02 Looks tight from here... ---------------------------------------------------------------------- p_235615 · 2023-09-27 16:19 or you just add all your ssh servers to .ssh/config under some alias and you dont need to use ports or username or any other options again... ---------------------------------------------------------------------- BeefyBob_likes_beef · 2023-09-27 16:58 Also with a random username. ---------------------------------------------------------------------- LetrixZ · 2023-09-27 16:59 Wouldn't it be only necessary if someone has access to OPs network? ---------------------------------------------------------------------- CatOfTheDecade · 2023-09-27 17:21 It doesn't complicate anything at all, other than for port scanners. Moving off standard ports is a widely accepted best practice, and your security should always be done in layers. This adds yet another layer to whatever other security steps you take. ---------------------------------------------------------------------- BCIT_Richard · 2023-09-27 17:23 Depends on exactly what you mean by 'secure network', typically any decent router will support VLANs, and use VLANs to section off portions of your network, that should be good enough in most environments. Watch Youtube videos, No 3rd party needed. ---------------------------------------------------------------------- buttstuff2023 · 2023-09-27 17:46 Obscurity is a perfectly fine layer of security as long as it's used in conjunction with other layers. There is absolutely a benefit to changing ports, it's small but not totally insignificant. Also,specifying the port is a non issue. Add a host entry to your ssh config and specify the arguments you want there. All ssh clients allow you to save the arguments you want so you don't have to specify them every single time. ---------------------------------------------------------------------- mb2m · 2023-09-27 17:48 Security is always a layered approach. ---------------------------------------------------------------------- lilolalu · 2023-09-27 18:43 The default port scans run up to 1024, if you move the ssh port above, you have a significant lower amount of scan attempts. It's not obscurity but common sense. ---------------------------------------------------------------------- anyOtherBusiness · 2023-09-27 18:57 I suggest additionally changing the ssh port from default 22 to something else. ---------------------------------------------------------------------- laser50 · 2023-09-27 19:38 Close the port, install a VPN and work through there. Or at the very least do not use port 22, makes it very easy to find. ---------------------------------------------------------------------- zozo1237 · 2023-09-27 19:58 Most people scanning the internet to find targets won't be using nmap (It's too slow) The'll be using something like [massscan](https://github.com/robertdavidgraham/masscan#masscan-mass- ip-port-scanner) ---------------------------------------------------------------------- zozo1237 · 2023-09-27 20:10 OP said they whitelisted access to port 22. Assuming this was configured properly\* then Port 22 will appear filtered to any attackers. This makes the proposed port change unnecessary. \*At the firewall level & the firewall is configured to silently drop packets ---------------------------------------------------------------------- zozo1237 · 2023-09-27 20:14 For a single system like this a VPN might be overkill but would still work well and be secure. In the proposed configuration using port 22 is fine (See [my other com ment](https://www.reddit.com/r/selfhosted/comments/16tjxct/comment/k2h 9hb3/)). ---------------------------------------------------------------------- hdp0 · 2023-09-27 20:15 Since you're already using Cloudflare Tunnel, you can actually proxy your SSH connection via the tunnel too, and protect it with zero trust - no ports at all exposed then. ---------------------------------------------------------------------- NurEineSockenpuppe · 2023-09-27 20:24 Security through obscurity does not work either way. I have a machine that has ssh not on 22 and my fail2ban logs still show just as many failed log in attempts with the usual credentials pi, root, admin etc. my guess is it doesn’t hurt but i also won‘t add any significant security to your system. ---------------------------------------------------------------------- zozo1237 · 2023-09-27 20:25 Looking good, but a few thoughts: * Remember that your VPS's security can only ever be as good as Webdock's security, if your Webdock account or Webdock itself is compromised then your VPS is as well - use a very strong, unique password. * Ensure ufw is configured properly by running a full Nmap scan from a public IP address that's not whitelisted. Nmap should report every port is 'filtered' ---------------------------------------------------------------------- zozo1237 · 2023-09-27 20:31 Your right that using non-standard ports will not completely eliminate attempts to access the service. Hell, it probably doesn't even eliminate most attempts. That said, it will eliminate \*some\* attempts which in theory is better then none. Whether that adds any significant security to your system is a topic worthy of debate - but I'd argue in quite a few cases that, yes, it does. ---------------------------------------------------------------------- NurEineSockenpuppe · 2023-09-27 20:38 But these are fairly low effort attempts. They use password lists and maybe random passwords. Using fail2ban and a secure authentication (good password or better public/private keys) make it pretty much impossible for those types to breach you anyway. Those attacks are going for the dude that is too lazy to change the default pw. ---------------------------------------------------------------------- thcduck · 2023-09-27 20:45 Just a friendly reminder: moving the ssh port is "security by obscurity", which isn't much, but it's good againt bots trying to ssh on every IP (in my experience). ---------------------------------------------------------------------- chaplin2 · 2023-09-27 20:57 If you allow ssh only through 2 IPs, your exposure is almost zero. ---------------------------------------------------------------------- violet-crayola · 2023-09-27 21:01 Its like putting on 3 condoms and then sleeping alone. Why use unpriveleged use? Are u suggesting that someone might hack your ssh crypto? So you are adding another defence level requiring person to type in sudo 500 times? What do you do on the server that doesnt require sudo? What do u do there? Why do I need a passphrase on my key? Just to sum up your advice - u want me to use ssh key and key in 2 different passwords before I can restart Plex? What lunacy fairtaile are u living in? ---------------------------------------------------------------------- violet-crayola · 2023-09-27 21:03 It sounds like this is necessary if OP is Osama Bin Laden and under constant attacks and state surveillance ---------------------------------------------------------------------- zozo1237 · 2023-09-27 21:19 Very true, that's a good argument! I suppose I'd rather just have some of them them not know about me instead. As an example, the chance is minor, but say a zero day affects a service I'm running and I don't read about it in time to patch. A whole metric ton of bots are going to be spun up real quick to exploit that vulnerability. If I'm on a default port it's more likely that I'll be compromised. ---------------------------------------------------------------------- GLaDOSDan · 2023-09-27 21:26 You need a passphrase on your SSH key in the event that your device is compromised, and your files stolen. Leaving an unencrypted key around is the equivalent to having a file called "Password.txt" on your Desktop. Having a passphrase protects you against this. It sounds like you might not be too familiar with SSH keys, but depending on your SSH client you can use what's called an "SSH Agent". You load your SSH key into your SSH agent (usually a part of your SSH client) when your client starts, and that's your key decrypted and ready to go until you reboot your computer or restart your SSH client. No matter if you connect once, or 500 times, you're only decrypting your key once. So, in essence - no, you're not entering 2 passphrases and "using your key" to restart Plex. You're, at best, entering your sudo password before becoming an administrator to reboot a service. ---------------------------------------------------------------------- Girgoo · 2023-09-27 21:34 If never restart your computer, then you never have to put in the passphrase again for your SSH key. Protection lost. ---------------------------------------------------------------------- Girgoo · 2023-09-27 21:36 You could disable all inbound traffic and just use the web based console that your provider have. But that is no fun. ---------------------------------------------------------------------- Girgoo · 2023-09-27 21:38 Reverse SSH tunnel is also a possibility of you are behind NAT ---------------------------------------------------------------------- violet-crayola · 2023-09-27 21:40 I use ssh keys all the time for work and home and have been for the last 15 years. I maintain the passphrases are a waste of your time for majority of this subreddit users. ---------------------------------------------------------------------- laser50 · 2023-09-27 22:02 Very simple crawlers might be tricked if they only scan designated ports.. But tbh a VPN and disabling port forwarding would always be the most secure choice. Setup (using say, wireguard) takes a few moments to get into but once it works it works. No more login attempts, no more fail2ban requirements, just good simple solutions :) ---------------------------------------------------------------------- j0hnp0s · 2023-09-27 22:35 Have a look at crowsec. It's like fail2ban on steroids I don't bother changing the ssh port. I'd rather they use it so that crowdsec can ban them fast Also, you should create a new user, add sudo and ssh keys to it. Then disable root and password login, and just use keys with your non root user. Keep the exposed services to a minimum. If you need to have admin stuff install wireguard and expose them to this interface rather than the internet facing one And have a look at selinux ---------------------------------------------------------------------- GLaDOSDan · 2023-09-27 22:36 Not necessarily. Sure, your key is stored in plaintext in memory, but at least it’s not stored in plaintext on your disk. It’s not unreasonable to assume that someone might back up their data and store it somewhere insecure, or in cloud storage, without thinking of the ramifications of having their unencrypted key mixed in there. ---------------------------------------------------------------------- zfa · 2023-09-27 23:55 Dude only has port 22 open from two static IPs he controls, he's fine leaving ssh on port 22 and having the convenience of not having to specify it himself on each connection. Question - do you move all your https off port 443? Why or why not. ---------------------------------------------------------------------- zfa · 2023-09-27 23:58 ITT: Loads of people who apparently didn't bother reading OPs post and are just coming in with their big-brain advice irrespective of whether it helps OP or not. Actually answer to OP - you're in a really good place. ---------------------------------------------------------------------- BriannaJoyyy · 2023-09-28 00:29 I second crowdsec is amazing at stopping or limiting brute force attacks on your sever better than fail2ban ---------------------------------------------------------------------- BriannaJoyyy · 2023-09-28 00:31 Check out [teleport](https://goteleport.com/). How Teleport Works Teleport provides secure access to SSH or Windows servers, Windows desktops, Kubernetes clusters, databases, and web applications. Teleport is trivial to set up as a Linux daemon or in a Kubernetes pod. The basics Teleport is a certificate authority and identity-aware, multi-protocol access proxy which implements protocols such as SSH, RDP, HTTPS, Kubernetes API, and a variety of SQL and NoSQL databases. It is completely transparent to client-side tools and designed to work with everything in today's DevOps ecosystem. ---------------------------------------------------------------------- zozo1237 · 2023-09-28 00:41 >Very simple crawlers might be tricked if they only scan designated ports.. True, but in the OP's case with access to port 22 being whitelisted it doesn't do anything. >tbh a VPN and disabling port forwarding would always be the most secure choice I take issue with the word "always" here, a poorly patched or poorly configured VPN can absolutely be worse then the security controls proposed by the OP. But that's mostly pedantic - in most cases you're right :) ---------------------------------------------------------------------- ball_soup · 2023-09-28 02:53 Like an ogre ---------------------------------------------------------------------- suntzu2050 · 2023-09-28 03:52 **There are two things that I would recommend in addition for consideration:** 1) [https://github.com/jtesta/ssh- audit](https://github.com/jtesta/ssh-audit) <-- harden your sshd\_config, keys, etc. 2) Use geo blocking to eliminate bots from Russia, China, and Belarus: [https://www.seenlyst.com/blog/geo-blocking-ufw- iptables/](https://www.seenlyst.com/blog/geo-blocking-ufw-iptables/) \*Don't change your port as "security through obscurity" is Microsoft not FOSS and has never proven to work. Masscan or other bots will find it on any port. Also, some Apps require the port and header to work effectively, so your approach to "hardening" and "ensuring operational security" is the right way to go. ---------------------------------------------------------------------- CardboardLambo · 2023-09-28 03:53 Yeah I was about to say the same. Leaving it at 22 is going to get a lot of bot hits if it's exposed. ---------------------------------------------------------------------- chaplin2 · 2023-09-28 05:19 Tailscale has an ssh feature. I guess it doesn’t need any open ports. ---------------------------------------------------------------------- lilolalu · 2023-09-28 05:22 Thanks for the info, but doesn't change the point. People using massscan will probably also scan the first 1024 ports since that's where 95% of the "interesting" services reside. ---------------------------------------------------------------------- mayurrenr · 2023-09-28 05:48 Thank you everyone for your advice and input. Things I have already done that I forgot to mention in my initial post: 1. Change default user to a non-root account with limited privileges 2. Disable root 3. Use SSH keys with a strong passphrase 4. Use complex passwords and MFA for all services / accounts that allow for this 5. I believe my private IP on my VPN belongs to me only, and is not shared with others at all Things I have implemented based on advice below: 1. Switch fail2ban to crowdsec 2. Ensure nmap shows no open ports Things I have decided not to do, and why: 1. SSH Piper - perhaps I misunderstood how this works, but I want an SSH solution that I can use if my docker / VPN / CF tunnel stops working 2. VPN (wireguard / tailscale etc) - After testing both WG and TS, I have already implemented a manual WG approach but not for SSH due to same reasons as (1) 3. Close all ports and use only CF tunnel - reasons same as (1) 4. Change port from 22 - this was perhaps the most interesting argument made on this thread. Lots of people for and against. I initially made this change (to 2222) but shortly after decided to revert as I'm not sure how much benefit this will be to me and my use- case Things to consider in the future: 1. Spend more time learning about SSH Piper - I wonder if SSH access would be retained if docker (and therefore SSH Piper) stopped working 2. Re-consider port change from 22 - still undecided! Once again, thanks to everyone for their input. ---------------------------------------------------------------------- Bambo630 · 2023-09-28 07:25 might be one of the most interesting tv tech tips ever shown. Let us know how it went and GL ---------------------------------------------------------------------- noideawhattowriteZZ · 2023-09-28 13:17 Personally, I would use Tailscale SSH and close down all outward facing ports altogether, allowing access only through the Tailscale interface. If you wanted to explore hardening further then check out the Ubuntu Hardening Scripts by Konstruktoid which are very well maintained and up-to-date: [https://github.com/konstruktoid/hardening](https://github .com/konstruktoid/hardening). (You use UFW, hence the assumption you're on Ubuntu.) And if you want some more fun then I suggest checking out these two hardening guides: * [https://madaidans-insecurities.github.io/guides/linux- hardening.html](https://madaidans-insecurities.github.io/guides/linux- hardening.html) * [https://privsec.dev/posts/linux/desktop-linux- hardening/](https://privsec.dev/posts/linux/desktop-linux-hardening/) Granted, all this may be over the top for what you're wanting to explore but thought I'd leave these links here for your interest. ---------------------------------------------------------------------- helmut72 · 2023-10-02 16:38 Some kind of unneeded stuff, but using strong SSH cipher, key and mac isn't there.