Why do I feel less safe with a vps? reddit / selfhosted ---------------------------------------------------------------------- Major-Dragonfruit-72 · 2023-10-13 08:55 Hi all, I need your help to convince me that using a vps is as safe as or even more safe than using a personal server at home. For reasons I needed to switch my homelab from my server to a vps with digital ocean but idk I hesitate to port over my nextcloud and immich instances with my photos and personal document. Can you convince me that I'm dumb and I can trust DO? ---------------------------------------------------------------------- bobbyorlando · 2023-10-13 09:05 If your server is 10m or 10000m away, what's the difference if you use the same precautions? With the added benefit your home network isn't hackable. ---------------------------------------------------------------------- Alles_ · 2023-10-13 09:08 vps is just someone else computer, remember. police has always the authority to look inside vps instances, even more if the provider is US based. to when available if you dont feel save always try to enable encryption on the vps side. Nextcloud has it as a feature. immich i dont think so. but at least you know what you are dealing with. other police, if you are not dumb hackers or internal attacks in the datacenter itself are very low risk ---------------------------------------------------------------------- killermenpl · 2023-10-13 09:09 Cons of hosting at home: - if you're hacked, your whole network is compromised Cons of hosting on a VPS: - the provider can just look at all the things happening on the server ---------------------------------------------------------------------- EspritFort · 2023-10-13 09:13 >Hi all, I need your help to convince me that using a vps is as safe as or even more safe than using a personal server at home. For reasons I needed to switch my homelab from my server to a vps with digital ocean but idk I hesitate to port over my nextcloud and immich instances with my photos and personal document. >Can you convince me that I'm dumb and I can trust DO? Depends. I personally consider giving a third party hardware access to what amounts to an *extension of my mind* to be chipping away at my **privacy** for sure. Comparable to the feeling one might get from letting a stranger into your house (for maintenance work for example), just worse. But I suspect this is not a universal thing. Now when it comes to **safety** it's also tricky since hosting at home and hosting remotely have entirely different threat profiles. Is it "safer" to store your valuables in a bank vault or at home - dunno, what's the most credible threat to your valuables? Is your neighborhood experiencing a series of break-ins? Is the bank known to employ crooks? ---------------------------------------------------------------------- roman5588 · 2023-10-13 09:21 Co-location baby! Generally speaking a providers network will be more resilient than yours. Major risks are: - Host gets hacked or rogue employee goes snooping, heard of cases where scripts got loaded onto host servers to look for crypto private keys within customers vms. - Provider goes under and you lose access - Automation failure deleting the instance or hardware failure. No chance of data recovery - You forget to pay bill and all data lost. At the absolute minimum, have an offsite local copy and harden the VPS (firewall, ssh keys etc). ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-13 09:27 **Privacy?** Definitely, VPS is less private (for most usecases). **Safety?** (from automated attacks) It depends on your security setup actually. **Availability?** Here VPS wins (again, for most usecases, but not for WFH setups). Another compromise option is to use E2E and use your VPS merely as a transfer station. Unfortunately, most self-hosted software isn't designed in a way that would allow to implement E2E easily. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-10-13 09:31 \> if you're hacked, your whole network is compromised Also, your employer's network as well sometimes (hello, r/LastPass , that's how your complete dataset was obtained, huh?) However, if your home network is designed with this in mind, there would be almost no difference where your host is - on the shelf/in the basement; or in a DC hundreds miles away). ---------------------------------------------------------------------- sneakpeekbot · 2023-10-13 09:31 Here's a sneak peek of /r/Lastpass using the [top posts](https://np.reddit.com/r/Lastpass/top/?sort=top&t=year) of the year! \#1: [Recommended actions for the LastPass security breach](https://np .reddit.com/r/Lastpass/comments/ztemzy/recommended_actions_for_the_las tpass_security/) \#2: [Notes are encrypted](https://np.reddit.com/r/Lastpass/comments/z zz5x4/notes_are_encrypted/) \#3: [Another LastPass Security Incident](https://np.reddit.com/r/Last pass/comments/z90oyf/another_lastpass_security_incident/) ---- ^^I'm ^^a ^^bot, ^^beep ^^boop ^^| ^^Downvote ^^to ^^remove ^^| ^^[Contact](https://www.reddit.com/message/compose/?to=sneakpeekbot) ^^| ^^[Info](https://np.reddit.com/r/sneakpeekbot/) ^^| ^^[Opt-out](ht tps://np.reddit.com/r/sneakpeekbot/comments/o8wk1r/blacklist_ix/) ^^| ^^[GitHub](https://github.com/ghnr/sneakpeekbot) ---------------------------------------------------------------------- LincHayes · 2023-10-13 09:43 I host things that don't affect my privacy and security on a VPS. Things I want to keep close and be in completely control of, I self- host. ---------------------------------------------------------------------- nibbl0r · 2023-10-13 09:46 I'd recommend running nextcloud and similar services in isolated environments - no matter if you run a company or if it's selfhosted. I also see, that this is not usually the case. But your "con" is conditional :D ---------------------------------------------------------------------- lilolalu · 2023-10-13 09:51 Depends entirely on the hosting provider. You should read their TOS precisely under which circumstances they will hand out your data etc. That said, take care to run full encryption on everything and take all measures necessary to operate a machine in a potentially "unsafe" environment. ---------------------------------------------------------------------- lilolalu · 2023-10-13 09:54 Nextcloud encryption is not sufficient. If you are scared about your private data, you need to have full disk encryption for boot and data drive. But that's not only doable, it's fairly easy. ---------------------------------------------------------------------- lilolalu · 2023-10-13 09:57 Its a big difference depending on how much effort "they" take to hack your machine. On a remote machine you won't notice when they are taking out the ram sticks to do memory dumps. ---------------------------------------------------------------------- azukaar · 2023-10-13 10:02 You're not dumb, in fact much smarter than you think. Server security is hard, and people tend to (very wrongly) assume that their server is safe because it's home in their local network. They could not be any further from the truth! In order to properly secure your server, always use HTTPS, strong authentication with 2FA, properly setup reverse proxy and so on... As a matter of fact, I wrote Cosmos, which is one of the option to achieve this, but you could also use others like NGINX/Trafiek for Reverse Proxy, Let's Encrypt for HTTPS, Authelia for authentication, Wireguard/Tailscale for VPN, and so on! ---------------------------------------------------------------------- DWolfUK40 · 2023-10-13 10:04 In a word no. You should never trust anybody either your sensitive data. I’ve read a lot of different vps just close accounts with vague reasoning and the user loses everything including digital ocean so there’s that. The bandwidth you will use for nextcloud or similar might be costly. Personally I’d use a vps to protect a home server but not to replace one. To me there’s not much reason to not self host my stuff but if I was going to host it elsewhere I’d be looking for somewhere with a good rep and serious guarantees. That’s just me though. I get so paranoid and need to be in control of my stuff. I can’t be worrying that others are snooping whilst I sleep. ---------------------------------------------------------------------- lilolalu · 2023-10-13 10:04 There are guides and tutorials and oodles and oodles of o. https://reddit.com/r/selfhosted/s/pLzgDRDHQr ---------------------------------------------------------------------- bobbyorlando · 2023-10-13 10:09 Yeah true, I didn't take completely illegal stuff or paranoia into consideration. ---------------------------------------------------------------------- lilolalu · 2023-10-13 10:09 I am only running stuff on a VPS that needs more bandwidth than my home server can provide. Minimal Nextcloud as WeTransfer replacement, with a 2week retention policy similar to wetransfer Redundancy Instance of peertube to chime in on p2p streaming All the low bandwidth stuff (so most things) are on my homeserver. ---------------------------------------------------------------------- lilolalu · 2023-10-13 10:13 Given the questions in the subreddit, a lot of people seem to be that paranoid, so I am just contributing a little to that confusion. ---------------------------------------------------------------------- OldManinTights · 2023-10-13 10:19 If you’re scared host all this on a raspberry pi and lock it down so only your private vpn up address can access it ---------------------------------------------------------------------- MrSliff84 · 2023-10-13 10:22 Me, who has his whole unraid server Luks encrypted with a 128 character random password 🤔 ---------------------------------------------------------------------- Alles_ · 2023-10-13 10:28 Is it doable on ocean cloud VPS tho? ---------------------------------------------------------------------- candle_in_a_circle · 2023-10-13 10:35 would you feel safer keeping your life savings in your home or in a bank? ---------------------------------------------------------------------- jkirkcaldy · 2023-10-13 11:05 If you’re attacked by something like a DDOS, your entire home network will probably go down, a vps, even if your vps goes down, at least you’ll still be able to use the internet. ---------------------------------------------------------------------- lilolalu · 2023-10-13 11:20 I dont personally know Digital Ocean VPS or the configuration you have there, but they have several guides on how to use disk encryption with their services, so i would assume its possible: https://www.digitalocean.com/community/tutorials/how-to-use-dm-crypt- to-create-an-encrypted-volume-on-an-ubuntu-vps ---------------------------------------------------------------------- therealscooke · 2023-10-13 11:21 Just go through the tuts at Digital Ocean. Super clear and helpful. Just look for the term you are concerned about and something will be there. Personally, you are safer on a VPs which you've hardened than home serving. With a hardened VPS, the only problems you may have deal with software you are running - nextcloud and whatnot. Those can get hacked anywhere. If it's on your VPS, only the content there is at risk. On your home server... Kiss all your computer contents goodbye! Go for it. ---------------------------------------------------------------------- identicalBadger · 2023-10-13 11:21 It is less safe. A VPS is more or less unmanaged except for you. The only time you hosting provider will intercede is if the activities on your compromised system are cause issues for other people, apart from that is more or less hands off. And it is possible for the admins at DO to extract data from your VM and storage. Take with that what you want. ---------------------------------------------------------------------- lilolalu · 2023-10-13 11:27 ... but, in this scenario, encrypting your disks is of limited use if you cannot trust the service provider, but still something you should do. Also consider unlocking the disks with a remote key on startup via something like tang / clevis https://github.com/latchset/clevis ---------------------------------------------------------------------- tomistruth · 2023-10-13 11:32 You can make it fairly secure by binding all web services like nextcloud to a private IP in a private network using wireguard. You can then close off other ports like 80 and 443 and everything is only served via an encrypted tunnel. There is a wireguard tutorial here. ---------------------------------------------------------------------- T_2007 · 2023-10-13 11:41 VLANS / FW rules? Only open fw ports to dmz subnets at home? ---------------------------------------------------------------------- r3dk0w · 2023-10-13 12:07 128 character random password, written on a sticky under your keyboard. :P ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-13 12:08 That’s simply not true. Have you heard of zero tier the concept not the product? This applies to VPS as well. The concept most network designers use is the castle and most theory so you defend the “gate” really well with passwords, credentials, firewalls, fail2ban, etc., but then no security once past that point. Zero tier goes further. You segment the network internally so for instance limit device access only to what it needs and rely on credentials or logins/passwords that are different even within your LAN. As an example containers only have access to specific ports and volumes. Non-hardened servers are VLAN’d or run as VMs again with tight security. Printers and file servers don’t have internet access or only limited access to specific ports. No “administrative” accounts directly face the internet, so you must login to say a VPN like Tailscale first to get past the firewall. The kids can only their game servers, the printer, the internet, and some container services. The printer is only visible on certain ports. Use VLANs and firewall settings on every device. There is no reason for instance for your kids to have access to you or your spouse’s laptops or each other, and an IoT device should not have access to any of them. Even within your own server that’s why for instance you don’t set up your login directly as an administrator/root account and purposely limit your own access, even so you can’t accidentally delete stuff. On very important accounts like routers use 2FA but keep the TOTP and password manager as separate apps/devices. Another method is only allow certain logins from certain ports. So for example I have my router configured with VLANs and the administrator account is only allowed on port 1. All of my devices and WiFi access points are on other ports. Port 1 is unused except when I plug my laptop into it. If you can’t do that consider for instance if you blocked access to RDP, SSH, and/or VNC except from a separate “KVM” which might be a virtual machine with nothing else on it. Maybe run say nginx but put the terminal server on a nonstandard port or say a standard port but not one you would expect like 53 (DNS). Ideally the goal is to create layers of security without making it too complicated to use. Separate administrative accounts that you don’t normally use, multi-factor logins, virtual or physically separate LANs, and firewalls set up so it requires an extra layer to access privileged functions all greatly increase the difficulty of penetration. This configuration allows for the possibility of having a compromised device or account within your network and still maintain security and operate with all other devices. And the concept of zero tier is to limit the scope/access to only the functions needed. For instance database administrators in corporate networks may only be able to trigger a password reset, setup, delete, backup, restore, or migrate databases but may not have access to the database itself. Network technicians can login to every switch but not routers/firewalls. Windows administrators typically have a separate account personally from the “administrator” account and usually use a tool for remote access/control that handles logins. This setup is easy to do with a little thought and hardens your home lab. I’ve “tested” this more than once. Or rather my one daughter does routinely downloading questionable games and such, and another kid used the same password everywhere. All “fixable” with backups, and I usually see alerts from Pihole pretty quickly when Trojan horse games get installed. If you extend zero tier to a VPS, nothing changes. So you have to make some assumptions. Most likely accessing memory directly of a VPS isn’t very likely but your storage is easily accessible. With Vaultwarden for instance all data on the server is encrypted and the server doesn’t have any passwords in it. With say document storage consider EC2 with encryption keys on your homelab. That way you aren’t trusting your VPS, AWS, or your homelab. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-13 12:10 Please note that nobody is securing your VPS for you. You have to set up things properly on the VPS as well as at home. Neither one is more secure than the other out of the box. ---------------------------------------------------------------------- io-x · 2023-10-13 12:14 I will keep short. You are less safe with a VPS. ---------------------------------------------------------------------- MrSliff84 · 2023-10-13 12:32 No, that password is in my bitwarden vault as a protected notice. So to get this password, you need to know 2 different passwords. May consider putting a printed hardware copy somewhere out of reach. ---------------------------------------------------------------------- r3dk0w · 2023-10-13 12:45 \*\*takes notes\*\* ....good to know.... ---------------------------------------------------------------------- chronop · 2023-10-13 12:48 actually, i would say a VPS with public IPv4 is less secure out of the box than a homeserver would be. at least with most providers who leave the public connection open. oftentimes when you get a VPS with a public IP, it's already being scanned/brute forced by the time you sign in and there are little to no firewall protections at all until you set it up. at least with a home server, you usually have your router/firewall in front ---------------------------------------------------------------------- atheken · 2023-10-13 12:56 It really depends on your risk profile. The most realistic (added) _security_ risk to you in a VPS would be that there would be some virtualization vulnerability that would allow a bad actor to collect information from your machine (like Spectre did). But there are a bunch of things that would have to go wrong to this to affect you: - The bad actor would have to care about your data (they don't) - The bad actor would have to manage to get their code placed on the same physical hardware as yours (they don't have any control over this, or visibility of where you system is physically located -- which can change at any time). - The provider would have not taken action to close the vulnerability when it was disclosed to them (the major clouds frequently get these disclosures months in advance, and quietly update kernels before they are publicly disclosed) - Or, you would need to be using unencrypted connections to external servers that could hypothetically be captured and analyzed (also unlikely, and probably locked down in a VPS). The most realistic (added) _privacy_ risk to you is that the provider is subpoenaed without your knowledge and complies with the subponea, meaning that law enforcement could have a copy of your data without your knowledge. If you're doing extremely shady/illegal stuff, this could be a problem. If you're sailing the _open seas,_ it might be a problem, but it's more likely that if the VPS detects this traffic, they'll cut you off and that'll be the end of it. If you're using encryption-at-rest, and only supplying the key at system startup in a non-persistent way, then having a copy of the data is probably not enough to gain access to it. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-13 13:02 This stops MITM, reading unencrypted data, and possibly TCP hijacking’s as examples. And it works great for any TCP traffic. Https cannot be used for real time traffic such as SIPS or even some video protocols, very short “one packet” traffic such as BGP or DNS (server level, not end users), or any multicast or broadcast traffic, or even proxy traffic…SSL works but Wireguard is much faster. Https doesn’t even work for non-HTTP traffic without a modified protocol. SMTP for instance is supposed to have a default port 25 but almost all SMTP traffic is TLS now on port 587. And you can’t reverse proxy HTTPS on 587 and expect it to work. That’s why for instance Tailscale and Zerotier tunnels are incomplete solutions. They only work on web-like traffic. ---------------------------------------------------------------------- _nix-addict · 2023-10-13 13:28 Is your daughter playing Roblox? Just curious where children are finding malware these days ---------------------------------------------------------------------- azukaar · 2023-10-13 13:36 HTTPS is mandatory for any web traffic, because it's the only strategy that fully incorporate vetting from a publicly vetted 3rd party source (the CA), but of course has the name suggest, it's only Securing HTTP traffic... You are correct that Wireguard (or any VPN) is a good addition for non-HTTP traffic, that also needs securing. You can also of course mix HTTPS + VPN as well. But I do not think anyone misunderstood my message in a way that suggest HTTPS protects everything, because of course it doesn't... You should use all strategies available, not VPN alone ---------------------------------------------------------------------- phein4242 · 2023-10-13 14:25 A system is as secure as the operator configured it. In other words, its important to learn about security and to apply that knowledge to your server configuration. Once you are at that point, you know how to answer your question yourself. Personally, Id say, it depends on your opsec profile. ---------------------------------------------------------------------- madtice · 2023-10-13 15:30 You could also use a zerotier or tailscale service. Then you don’t need to open any ports. Ofcourse that comes with its own security questions. Or install wireguard vpn on your vps, only open those ports, use the services through that vpn. Or create a vpn tunnel from your router to the vps. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-13 15:44 So what if it's being scanned, if it doesn't run any service except ssh with key authentication? They can brute-force that until they're blue in the face. ---------------------------------------------------------------------- chronop · 2023-10-13 15:46 it's less secure than something which can't be attacked by default ---------------------------------------------------------------------- prairievoice · 2023-10-13 15:50 I've considered this as a method to hide passwords in plain sight: * Encode passwords into QR codes * Print them on to what look like business cards from acquaintances. You can use the business or a persons name on the card as a clue as to what the password is for. * Put cards in a roloex with actual business cards from acquaintances. * If you need a password just scan the QR code. If someone were to stumble across them while looking for your passwords, they would probably write it off as just a bunch of business cards. If someone were to scan the QR codes they would just get a random string and assume the qr code was encoded incorrectly or something. ---------------------------------------------------------------------- just_some_onlooker · 2023-10-13 15:55 Because of what everyone else on here or somewhere else says. It's really simple. Once you have it you do the following Disable ICMP responses Disable root login Disable pssword login and use ssh keys instead. Set up proper IPTables ---------------------------------------------------------------------- GolemancerVekk · 2023-10-13 15:57 > it's less secure than something which can't be attacked by default. But you have to expose *something* to do anything with that server, and when you expose services it makes no difference if you have a firewall or not because you have to let them through. If you don't allow anything through the firewall you might as well not have a server at all so what's the point. Let me ask you, what do you think is the practical difference between a server that doesn't expose any services and a server running a firewall that doesn't let anything through? ---------------------------------------------------------------------- MrSliff84 · 2023-10-13 16:01 Also a nice idea ---------------------------------------------------------------------- chaplin2 · 2023-10-13 16:07 It’s zero trust, not tier (Google’s buzzword for that is BeyondCorp). ---------------------------------------------------------------------- chronop · 2023-10-13 17:33 you don't need to expose anything. why do i need to expose ports for my internal backup server? or my local development server? why do i need to expose ports for my github runner? if i have a server which runs on some random raspberry pi which has a cron job to pull a git repo, build some ARM images, and upload them elsewhere... why do i need to expose anything? do i need to expose my internal DNS resolvers? if i set up cloudflare tunnels and want to use SSH over cloudflared, why do i need to expose anything? if i want to have a server at home which connects to a wireguard VPN (hosted elsewhere) and do stuff with the other hosts exposed from that wireguard, what do i need to expose on my home server? ---------------------------------------------------------------------- This-Gene1183 · 2023-10-13 18:10 Agreed ! I also keep personal/ family services at home. I use a wire guard connection between VPS and home server. With Treafik being on the VPS SERVER ---------------------------------------------------------------------- laffer1 · 2023-10-13 18:24 This does happen also. I had a two day outage due to an attack from Iran. Comcast business was able to block it eventually ---------------------------------------------------------------------- -quakeguy- · 2023-10-13 18:30 You are simultaneously both more AND less safe with a vps. For the exact same reason too, control/lack of control over local hardware. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-13 18:57 Why do you need a firewall for, then? 🙂 You seem to be under the impression that you "must" put up a firewall no matter what. Firewalls are used for specific purposes not just thrown on there just because "security". ---------------------------------------------------------------------- chronop · 2023-10-13 19:09 Because not every port that the services on servers listen on need to be publicly accessible. Why would you want them to be? Most VPS setups just allow all inbound traffic which means you can be brute forced, DoS, fingerprinted, etc… when the next vulnerability for a service comes out, guess who will get compromised? The people who have that service exposed via a public IP ---------------------------------------------------------------------- chronop · 2023-10-13 19:17 Take a recursive internal DNS resolver for example, which listens on port 53. I need it to listen on the port so I can use it for DNS for my internal network. But I don’t want it open to the public because I don’t want it to be used for amplification attacks and I don’t need to resolve DNS for anything outside of my network. What to do? In a home network, that is trivial - just don’t forward port 53 to it. On a VPS with a public IP, not so much…. You’ll want to drop the outside traffic before it even hits your service, which is where some type of firewall comes into play. What about malformed packets? Firewalls will drop malformed packets when they have proper rules in place. No firewall or a default allow all inbound? Your service has to fend for itself and figure out what to do with that garbage. You need some type of firewall, whether it’s a software service or hardware firewall, to prevent many different kinds of attack vectors ---------------------------------------------------------------------- kmisterk · 2023-10-13 20:21 Hey, Major-Dragonfruit-72! Thanks for your submission to selfhosted. Your post has been removed due to a violation of **Rule #5a:** ## It's Not Wednesday Posts that do not directly relate to a self-hosted tool, but relate to the process of self-hosting (Including dashboard posts, support tools, hosting options, local CLI tools, etc.) are only allowed to be posted on a Wednesday. If you believe this to be incorrect, please [message the mods](https:/ /www.reddit.com/message/compose/?to=/r/selfhosted&subject=Removed For Wednesday Only Content&message=[Removed Post](https://www.reddit.com/r/selfhosted/comments/176ub2b/-/\)) so that we can revisit or clarify the removal reason.