Security Essentials for Public Facing Web Sites reddit / selfhosted ---------------------------------------------------------------------- Omni__Owl · 2023-10-07 01:54 Perhaps there is a master thread for this somewhere and I missed it. I tend to find a lot of "security must-have" threads becomes outdated. What I'm wanting is to know how to best secure my public-facing NUC that will run small websites like my portfolio (so the data is not precious). What I assume I need is a reverse proxy setup, perhaps with nginx or something, domains that can point to said host and then some way to secure it (Yes I have a Static IP). Although please let me know if you have better ideas. While Static HTML pages are nice, it would be nice if I could do a bit more, but that is likely separate from this question. The host is a Debian 11 VM that exists on a Promox instance. The Proxmix PC is on my local network and can be seen by all other machines that can SSH to it's local IP. What I want to make sure of is that, while I can access the VM locally to do things like update the websites I host and such, I want to minimize network access as much as possible for would-be attackers. Nothing is perfect, but I wanna do the best I can. Any tips and tricks? ---------------------------------------------------------------------- TruckeeAviator91 · 2023-10-07 03:51 If you are hosting the static page with nginx or apache its should be pretty secure by itsself. Just open port 80 and 443 if your using ssl. You could open ssh to the internet with keys and disable root login, fail2ban etc. But honestly if you want to be extra secure just use a VPN to access your network and do updates to the site/server. I use wireguard easy to host a VM or container on proxmox. The less you open to the internet the better. ---------------------------------------------------------------------- ZarehD · 2023-10-07 04:48 Besides doing the usual hardening stuff (fail2ban, lock down root, use SSH keys, disable unnecessary services, etc. there are checklists online), you can, since you have a router/fw (OpnSense), configure routing rules that allow only port 80/443 traffic from the WAN interface to reach the VM. Other traffic to the VM must come from the interface(s) for your internal network(s). ---------------------------------------------------------------------- black-0ut · 2023-10-07 08:31 I believe for your usecase i.e hosting your portfolio, which I believe is a static site, there is no need to self-host. You can use something like Netlify, add a domain alias. Selfhosting with public access really only makes sense if you are trying to host something like gitlab, vaultwarden etc. ---------------------------------------------------------------------- AlbyV0D · 2023-10-07 08:34 Depending on your setup/needs/capabilities, you may want to separate your home network from the public-facing hosts. You can do that at layer 2 (i.e. vlan) and/or layer 3 (firewall, acl, ecc.). Es., you can start new ssh connections from your home network, but not the opposite. Maybe it's a good idea to expose a proxy, but it could be overkill for your needs. Also consider a WAF, i.e. coraza or modproxy, with other protections. ---------------------------------------------------------------------- wrath_of_reaper · 2023-10-07 19:01 To the downvoters: what‘s wrong with this statement? ---------------------------------------------------------------------- ithilelda · 2023-10-07 22:59 people are worrying too much. Opnsense is a powerful tool and you should really learn it. It isn't complicated at all. The WAN firewall rules are secure by default. You don't even have to worry about ssh stuff if there is no port open. install crowdsec plugin to automatically ban suspicious ip and you're good to go. just only open the required port to that single machine hosting the reverse proxy, and set it up correctly. I personally recommend caddy for homelabs because it is so much easier to setup correctly than npm. also, most attacks happen to password leaks rather than unnoticed security holes. use a password manager (just self host your vaultwarden instance with a strong master password, length is the key), and generate random passwords for each service. Then, you're harder to crack than most enterprises. ---------------------------------------------------------------------- SDSunDiego · 2023-10-08 02:47 OP is asking HOW to secure a self-hosted site. Not asking IF he should self-host. ---------------------------------------------------------------------- Omni__Owl · 2023-10-08 11:18 This is correct ---------------------------------------------------------------------- black-0ut · 2023-10-08 14:45 I disagree. All of us here are to discuss, advise and provide insights into potential solutions. Just because the OP feels they want to selfhost doesn't mean its the right decision, don't you think anyone should atleast mention that a better alternative exists ? The OP didn't mention that they doesn't want to host it on any free platform like Github, Netlify. Maybe he didn't know that there are free solutions for this. See nobody cares about karma, I certainly don't, you can downvote me to oblivion for all I care. With the kind of questions OP is asking right now, I feel its still time before they should consider to selfhost. ---------------------------------------------------------------------- SDSunDiego · 2023-10-08 15:29 Don't disagree with me. Disagree in your original post. I'm just calling out an observation. I can appreciate your point AND understand why you were downvoted. People may not want your opinion when they are seeking a specific angle. In fact, it can be incredibly annoying when seeking something out and a person, like yourself, injects something else that was not requested. It suggests a lack of nuance and ability to read/comprehend "the room". Almost like you are more interested in pushing something on OP then answering a question. ---------------------------------------------------------------------- Omni__Owl · 2023-10-11 01:24 It is not helpful. The question wasn't "should I self-host?" the question was "how do I best secure my self-hosted solution?"