Worst case scenario after an attack reddit / selfhosted ---------------------------------------------------------------------- Suspicious-Iron-5526 · 2023-10-17 14:09 As title says, i'm curious about the worst case scenario in which an attacker tries to hit my system. The system configuration is the following: i have some services (important ones) accessible only trough VPN, like SSH (key-based auth only), Pihole... Others are publicly accessible, like Immich, Jellyfin (and so on...). Public ones are accessible via reverse proxy (Caddy) and protected by CrowdSec (which bans IPs outside my country and those failing auth 3 times). What could happen if an attacker finds out a vulnerability on some public service? Would he be only able to access service's files (like an appropriate login), or delete/encrypt data (as some cases of blackmail) or even pull out and steal my data? I'm wondering this because CrowdSec's rules described above so... Is this enough to secure a server? ---------------------------------------------------------------------- Digital-Chupacabra · 2023-10-17 14:30 Worse case none of what you did matters, attacker finds a way in, encrypts all your data holds it for ransom, blackmails you, steals your data goes on a shopping spree, and uses your personal pictures to generate a deep fake of you murdering puppies and sends it to all your friends. Worse case is by definition the worst case, you seem to be asking more about what is the the reasonable limits of your security setup. --- You are already segregating applications, which is a good start. I would ask what needs to be publicly accessible and to whom? If it's just a few friends and family why not set up the VPN for them to further minimize risk? > I'm wondering this because i want to know if CrowdSec+Docker (to preserve permissions on the system) is enough to secure a server. CrowdSec Is a handy tool for securing your server. I would encourage using it or something similar. Out of the box docker doesn't offer much in terms of security, it is more for easy of deployment, management and backups. If you are running docker as root you are actually widening your attack surface. The good news is it's pretty simple to run docker rootlessly, > enough to secure a server From what? Security isn't really an attainable thing, it's a goal and there is a large spectrum of what is secure. Random person who is self hosting services' threat model is mostly protecting against mass scan and exploit type attacks. so the less you have on the internet the better, and if you block repeated scans and bad logins you are doing more than most. ---------------------------------------------------------------------- Suspicious-Iron-5526 · 2023-10-17 14:40 Thanks for the reply. Yes you are right, i was looking for the worst- not-so-worst scenario. I'm actually serving some services trough rp because its uncomfortable (for me and my family) having to connect every time to vpn to use them. Also, I found some difficulties to setup HTTPS while on VPN, so the services that need HTTPS are unusable. My main concerns are about some important services like vaultwarden or immich and the danger of having them hacked. But maybe, as you said, i'm (obviously for a home server point of view) taking right precautions. Maybe, for me and others, do you have other tips to secure even more? ---------------------------------------------------------------------- WiseCookie69 · 2023-10-17 14:45 What is your worst case, if someone gains access to your stuff? We can't answer that. That doesn't necessarily depend on your applications, but more in the data behind them. Can be everything. From nothing to financial ruin through identity theft. ---------------------------------------------------------------------- Digital-Chupacabra · 2023-10-17 14:46 I would make vaultwarden publicly available with out HTTPS. Have you looked into [tailscale](https://tailscale.com/) as a VPN service? ---------------------------------------------------------------------- lilolalu · 2023-10-17 15:01 Depends on the vulnerability ---------------------------------------------------------------------- lilolalu · 2023-10-17 15:08 I think the most probable attack vector on an average non interesting person's server is the hacker looking for anything pointing to cryptocurrencies, looking for passwords / keys to bounce into other infrastructures, using your server as a jump pad for anonymity while commiting other crimes, or as an outpost of their botnet. I think even encrypting the server for ransom is a lot of work for the money you can squeeze out of the average human. ---------------------------------------------------------------------- chaplin2 · 2023-10-17 15:10 You are doing it wrong: SSH with key authentication is the most secure piece, and could even be public. Immich and Jellyfin surely have zero days and should be behind VPN ---------------------------------------------------------------------- Suspicious-Iron-5526 · 2023-10-17 15:24 Could you elaborate more on immich and jellyfin? I suppose you're referring to a brute force attack. Isn't a geoip block + 3 fail attempt to be banned secure enough? ---------------------------------------------------------------------- chaplin2 · 2023-10-17 15:29 I’m referring to ZERO DAYs. OpenSSH is a serious security product. Those web apps are written by random people and probably riddled with vulnerabilities not known to public. Here is the rule. Only a trusted vpn and ssh key authentication can be public. ---------------------------------------------------------------------- Suspicious-Iron-5526 · 2023-10-17 15:31 Sorry for the misunderstanding. Perfectly right. Thanks for that ---------------------------------------------------------------------- Suspicious-Iron-5526 · 2023-10-17 16:18 At first it was shocking, gonna say :) Anyway yes, but i'm with OpenVPN actually (i know, not the best option out there), but i think i'll give a try to it. To stay on topic, do you suggest me "classic" Tailscale or Headscale, just to have a full- selfhosted way? ---------------------------------------------------------------------- Digital-Chupacabra · 2023-10-17 16:35 if you want to go full-selfhosted Headscale is great! Tailscale is a bit easier if you want to have other people install it as well. ---------------------------------------------------------------------- HoustonBOFH · 2023-10-17 16:43 Worst case is that you lose everything. The only way to protect that is an out of band pull type of backup. One that you servers can not get to or see, but can see your servers. Best at another location as well to protect against fire. ---------------------------------------------------------------------- glotzerhotze · 2023-10-17 16:45 you lost your data and the confidence in your own ability to take care of „it“. life will go on - or not. it all depends on the data and context. ---------------------------------------------------------------------- phein4242 · 2023-10-17 18:08 Best case, you get pwnd and become another zombie network. Worst case, you’re targetted and end up with either legal threats and/or torture or pollonium, depending on which nation state you piss off ---------------------------------------------------------------------- EndlessHiway · 2023-10-17 18:59 Nothing. ---------------------------------------------------------------------- Gesha24 · 2023-10-17 19:05 Attacker gains full control of your systems through a vulnerability, does some illegal stuff, swat team shows up and kills all the house inhabitants during the raid as there was a perceived threat. Is that bad enough? I'm sure I can come up with something worse if needed. ---------------------------------------------------------------------- slyzik · 2023-10-17 19:14 it would be better if you could have two servers (could be virtual) one for public facing applications in DMZ and other for internal stuff in separate network. ---------------------------------------------------------------------- adamshand · 2023-10-17 19:17 The answer is, as always, it depends. Some exploits allow the attacker access to the application (in which case they can do whatever the application allows them to do). Some exploits allow the attacker to get shell access (in which case they can do anything the permissions of the user allow them to do). Some exploits allow the attacker to get a root shell (in which case they can do almost anything). Root exploits are much less common, and typically require much more skill, than application exploits. Getting root almost always requires exploiting an application, and then getting shell first. This is why security people talk about "defence in depth". If your application is exploited, what can you do to make it as hard as possible for the attacker to get a shell. If they get a shell, what can you do to make it as hard as possible for them to get root. If they get root, what can you do to restrict the amount of damage they can do. If they do damage, how do you know what they've done and what can you do to repair it. When people are relying on VPNs for security, they are building what security people refer to as the "crunchy on the outside, chewy on the inside" model. There's no defence in depth, once the attacker is in ... you're screwed. In a homelab, part of the fun is that we get to decide how much of this we can be bothered with. :-) ---------------------------------------------------------------------- Brilliant_Sound_5565 · 2023-10-17 19:18 Worst case I'd always say is if your data, by that I mean files, b personal files, get accessed and then encrypted. I'm not bothered about server config, it's all backed up, as are my files. But worst case for her would be loss of data. ---------------------------------------------------------------------- merizi · 2023-10-17 20:26 In nation state attack at least your government may be on your side. Probably worst case for an individual is that your network is used to store or transmit illegal content. Even if a law enforcement analyst tracking a person spreading this illegal content (CSAM) knows you are basically innocent, it’s much more likely you get caught up some other way with local law enforcement or similar. Initially, it may be hard to prove it’s not you because you are dealing with someone who is not an IT person first. This may spiral to losing your job or reputation should you do something like teach or run a club. Regular attacks against google and the like pivot through 20+ machines. Many compromised machines will never be encrypted because the attacker needs to sit undetected for as long as possible. ---------------------------------------------------------------------- hbp112358 · 2023-10-17 21:35 Use Cloudflare reverse tunnels. Then Cloudflare handles all the security and you don’t have a single port open on to the internet on your server. ---------------------------------------------------------------------- sebasdt · 2023-10-17 21:59 While I normally encourage usage of cloudflare tunnels its easy of use makes a bigger security risk. here from chirstian lempa: https://www.youtube.com/watch?v=oqy3krzmSMA ---------------------------------------------------------------------- DaMoot · 2023-10-18 00:18 Worst case is largely depending on what they actually are able to gain access to. Worst case worst case? They managed to get your PII and sell it on the dark web, ransomware all your files, demand a ransom which you of course pay because you have it recoverable files and like 90% of the people in the world don't have backups, and then they don't give you the decryption key like they usually don't. Another scenario is they are able to get your PII, sell it, you don't notice it, but they also leave a back door or two in your infrastructure that you don't notice for foo length of time and they exfiltrate data on a continuing basis. This happens to businesses on a very very regular occasion. It's more valuable to get a trickle of data over time than a fire hose all at once. An added scenario to the second one is that they use your infrastructure to infect/attack others. ---------------------------------------------------------------------- nefarious_bumpps · 2023-10-18 00:24 It depends on the goals, skill and patience of the attacker, but most opportunistic attacks follow similar playbooks: 1. Identify the target (via port scans) and identify vulnerabilities (by service type and version, usually reported in the connect header). 2. Select or craft an exploit and deliver it to establish initial access. This might include using password spraying or credential stuffing if the service doesn't adequately rate limit attempts, but in most opportunistic attacks the threat is unpatched known vulnerabilities. 3. Take steps to maintain access (persistence), avoid discovery and escalate privileges. 4. Harvest and/or create additional credentials. 5. Discover other systems/services on the LAN and attempt to pivot access to those systems using harvested credentials and/or additional known exploits. 6. Identify and collect data of interest (i.e., additional credentials, password databases, crypto wallets, PII, etc...) 7. Establish a command-and-control channel and exfiltrate data 8. Initiate a ransomware payload to encrypt and ransom the target's data. The entire playbook can be executed by one attacker, or there could be several different threat actors involve (e.g., one scans and sells data on vulnerable open ports, another establishes initial access and persistence and sells that access, and yet another steals the data and implants ransomware). Banning non-domestic IP's and rate-limiting failed logins offers a good measure of protection, but threat actors circumvent this by bouncing off VPN's, proxies, or rented/compromised machines in other countries. Crowdsec is a good option for identifying and blocking repeat offenders if you've got blockers setup on your reverse proxy and firewall (or via an iptables blocker on each host). Subscribing to vulnerability notifications for each of your services and promptly installing patches is essential for avoiding opportunistic attacks. Also, using a WAF (web application firewall, such as OWASP's Coraza, with their core ruleset) and periodically running vulnerability scans (such as OWASP's ZAP) will also help. An IPS with good threat feeds is another layer of protection. But all of this requires some investment in time and effort to review logs and tune detection and response rules. Having gone through all that I'll admit that, as an enterprise infosec architect, I'm quite a bit more paranoid than the average home selfhoster needs to be. In most cases. If you're keeping things patched, not using known, leaked passwords and correctly using Crowdsec, you're probably good against 99.99% of attackers. The remaining .01% is going to take considerably more effort to defend against. I'd start by evaluating what services you expose directly to the Internet and closing down direct public access for those that aren't essential. I.e., do you really need direct ssh access? Finally, be sure to backup all your important data in such a way that it's resistant to an advanced ransomware attack. This is a topic worth its own in-depth discussion, but a good article can be found here: [https://ransomware.org/how-to-prevent-ransomware/passive- defense/ransomware-backup-strategy/](https://ransomware.org/how-to- prevent-ransomware/passive-defense/ransomware-backup-strategy/).