1st time Headless Server reddit / selfhosted ---------------------------------------------------------------------- Punkemon-86 · 2023-10-27 03:22 I started to create my very own website. I originally had it on a raspberry pi 3b but upgraded to an optiplex 9020 usff , 1tb SSD, 8gb ddr3 running Ubuntu Server LTS I've spent more time on the backend than actually designing my site because I'm worried about security. This website and server will only be accessible within my network. So I'd like to know if the ufw rules I set up are a good start. ufw default deny incoming ufe default allow outgoing ufw allow from 192.168.1.0/24 to any port 22 proto tcp ufw allow from 192.168.1.0/24 to any port 80,443 proto tcp ufw limit 22/tcp I've also installed fail2ban. I've also managed to install webmin, but I also want to install cockpit, grafana, Prometheus, loki, and promtail but I don't want to overwhelm myself. My optiplex sits beside my router while I ssh from my laptop and work on it. Any recommendations for securing my server or monitor it would be very helpful as chatgpt is the only teacher I have until I stumbled on this subs. ---------------------------------------------------------------------- br0kenpipe · 2023-10-27 10:23 SSH: Disable Root login, only allow a specific unprivileged user, use private keys, change port 22 to a different/higher port. (also see: [h ttps://www.sshaudit.com/hardening\_guides.html#ubuntu\_22\_04\_lts](ht tps://www.sshaudit.com/hardening_guides.html#ubuntu_22_04_lts)) Do you have any evil local users? :P otherwise you dont need a firewall/restrict ports ---------------------------------------------------------------------- Affectionate-Pickle0 · 2023-10-27 10:29 > This website and server will only be accessible within my network If this is the case then your security is already a done deal. No real need for ufw (though you could argue that it is a good thing to have either way). You have no need for fail2ban if it is internal server, nobody can connect to it outside of your internal network, meaning you might only manage to ban yourself by accident. ---------------------------------------------------------------------- Punkemon-86 · 2023-10-27 10:46 So by default nobody can access my server even if enable ssh? I'm only enabling it, because it's headless and I gotta use putty and visual code to edit my files. I just thought that enabling ssh would expose my server to the outside world. Or is that only if I open ports in my router, which I didn't do. ---------------------------------------------------------------------- _nix-addict · 2023-10-27 10:52 You must open ports on your router to explode any device on your network to inbound requests. You might as well configure public/private key authentication and change the port number anyways. It's just good practice ---------------------------------------------------------------------- Punkemon-86 · 2023-10-27 10:54 It's just me. I just didn't understand how ssh worked. ie: a server that's exposed to the Internet vs a local server that only gets ssh within the network. Does one have to open ports on a router to expose it to the web, say if my website were to go live? Vs just having a website that can be accessed only inside my network ---------------------------------------------------------------------- br0kenpipe · 2023-10-27 10:55 >I just thought that enabling ssh would expose my server to the outside world. Or is that only if I open ports in my router, which I didn't do. No. To open it to the internet, you need to open a port in your router and forward it to Port 22 on your local server. ---------------------------------------------------------------------- Punkemon-86 · 2023-10-27 10:56 Oh now I understand. So all those ufw rules don't really apply inside my network if it's just me and my dad in my network. I did manage to lock myself out several times using because of failban. I'll change my port number and use keys instead though thanks for the info. ---------------------------------------------------------------------- _nix-addict · 2023-10-27 10:58 They apply, they just won't have a ton of impact and they'll only affect users on your network. Not bad practice by any means though :) ---------------------------------------------------------------------- Punkemon-86 · 2023-10-27 10:59 So if my server isn't exposed to the outside Internet is it safe to use webmin, cockpit, grafana etc? Someone told me those tend to create security risks. But is that only if I'm exposing my server to the Internet? ---------------------------------------------------------------------- br0kenpipe · 2023-10-27 11:00 you can also host your website on the internet over port 80/443. You have to open port 80 and 443 on your router, portforward 80 and 443 from router to your server and create the firewall rules (ufw allow && ufw allow https). SSH is not exposed to the internet (because it's on another port). But you can add an ufw rule to make sure only your local network can reach the service ---------------------------------------------------------------------- br0kenpipe · 2023-10-27 11:08 if they are running locally, no issues. you need some good authentication if you expose them to the internet (webmin and cockpit).