Personal domain or not? reddit / selfhosted ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 10:06 I have a personal domain name. I got it because my first name was available with my country tld. I use it for email, which I will most likely keep forever, but how about my self-hosted stuff? I use Slack's Nebula to access my self-hosted resources externally. Would you mind exposing your VPS:es IP:s to the world by adding them as subdomains? In my case lighthouse1.myname.tld and lighthouse2.myname.tld? I feel much more secure using DuckDNS for those IP:s as it should make it much harder to identify my attack surface. Does it make sense or am I just paranoid? I really don't like the idea of my attack surface being easily identifiable just by my email or first name. ---------------------------------------------------------------------- ImpossibleTracker · 2023-10-31 10:15 I would rather go with Cloudflare Tunnel. It will not only protect your public IP but also will be able to add an additional layer of protection. ---------------------------------------------------------------------- yakzazazord · 2023-10-31 10:16 More security can't hurt. I just dns proxied everything through cloudflare and all you can see through a nslookup is Cloudflare IPs. ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 10:24 I won't say I fully understand it yet, but I'd rather not involve identity providers etc. I like to realy on my certs and private keys. I also failed to mention that I enjoy the mesh feature of Nebula for remote replication etc. ---------------------------------------------------------------------- revereddesecration · 2023-10-31 10:54 It’s easy enough to run Authelia in front of all of your subdomains. Suddenly you’re back to one attack vector. ---------------------------------------------------------------------- tech2but1 · 2023-10-31 11:38 Meh. If you're going to get attacked it'll by bots, unlikely that having a domain pointing at your lab will make any difference at all to likelihood of being attacked, and if you are then the domain is irrelevant anyway. Spend your time hardening your lab, IDS, fail2ban etc... ---------------------------------------------------------------------- ImpossibleTracker · 2023-10-31 11:40 In that case, nginx, authelia and wireguard can be the best way to protect your network ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 11:43 Yeah you're probably right ---------------------------------------------------------------------- nzipsi · 2023-10-31 12:02 IPs are exposed to the world by default. Bots will happily sit there 24/7 scanning the entire IPv4 range, so you’re unlikely to see any impact from having a subdomain vs not. As others have said, you’re better off focusing on making sure your VPS is secure - SSH keys only, HTTPS only, reverse proxy with authentication and strong passwords, etc, maybe configuring the firewall to completely drop packets that aren’t from your home IP to non-VPN ports (and use a VPN from outside the house). Alternatively, if it’s just you and maybe one or two others, you could look at something like Tailscale or Cloudflare Tunnel, in which case the VPS would be calling out to someone else to open a tunnel, and you wouldn’t need any ports open. That adds a dependency on someone else, though, which may not be ideal. ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 12:26 Yeah the IP:s are there for the world to see, but you won't easily know they belong to me unless I point to them from my domain. I'm running a server at home without portforwarding. I connect to it using Nebula on VPS, which is like Tailscale without having to trust anyone. ---------------------------------------------------------------------- valdecircarvalho · 2023-10-31 13:29 What makes you think that DuckDNS will hide your ip? ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 13:33 I don't think it will hide my ip, but you won't automatically know that kgkskzkd.duckdns.org is mine compared to myname.tld ---------------------------------------------------------------------- tech2but1 · 2023-10-31 13:34 > Yeah the IP:s are there for the world to see, but you won't easily know they belong to me unless I point to them from my domain. As has been pointed out though, it makes no difference and no-one cares. No-one is manually cross referencing IP's and domains, and besides, what difference will it make anyway? I've heard this argument before with someone saying they use DDNS on all customer sites instead of static IPs as it's "more secure" because there's a website out there with exposed desktops listed on it. ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 13:38 I guess it's unrealistic, but if you want to break into someone's house, it's easier if you know where they live. Far easier than finding a list of all addresses in the world and knocking on all doors until you find the correct persons house. ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 13:42 But yeah, shouldn't really matter anyway. Even a comprimised Nebula Lighthouse shouldn't be a problem as it can't communicate with my other clients either way. Even if the comprimised server could communicate with the rest of my clients nothing is open anyway. ---------------------------------------------------------------------- tech2but1 · 2023-10-31 14:31 Well, therein is the point I was making, people aren't looking for your house specifically, they are just trying all the handle and getting in to whatever is open/weak. ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 14:35 What, automated attacks are given, but I don't think that rules out targeted attack if you're a bit paranoid. ---------------------------------------------------------------------- krimsonstudios · 2023-10-31 14:36 My approach is using Nginx and wildcard subdomains. The specific subdomain name that accesses the service is not listed in DNS anywhere and just knowing the IP address doesn't get you anything since m.y.i.p:443 is just getting you an nginx landing page. ---------------------------------------------------------------------- nzipsi · 2023-10-31 15:47 Unless you have a really good reason to believe that someone is interested in *you, personally*, that’s not super-relevant (and that can change without you being aware of it, but… I think it’s rare enough that I’m kot worrying about it myself). The slightly bigger issue is that it can reveal what services you’re hosting that might be interesting to attackers, but cryptic sub-domains will fix that, and a reverse proxy plus authentication will prevent attackers from actually reaching them. ---------------------------------------------------------------------- PatochiDesu · 2023-10-31 16:17 i usually only expose vpn and i also have a domain and a public dns. never had a problem. if a port is forwarded people always try to get in. its on you to protect the stuff on a different layer if you allow dataflow. if you expose a website you use something like oauth to prevent unwanted access. if you access from a static ip use a firewall and block all other ips. etc. there are a lot things someone can do to protect exposed services. most secure services are unreachable isolates services not connected to a network (hardware) you have to know what risks you are willing to take. ---------------------------------------------------------------------- Silencer306 · 2023-10-31 16:26 How does this work? You open your nginx to the internet and that then routes your traffic accordingly? Authelia for authenticating? And wireguard for? Sorry im still new to these ---------------------------------------------------------------------- Johannesboy1 · 2023-10-31 17:00 Cloudflare has access to all transferred data though ---------------------------------------------------------------------- Gabe_Isko · 2023-10-31 18:33 No, not paranoid. This is a good idea. I have a domain that I use for self hosted stuff. Ports 80 and 443, and that's it, managed by crowdsec. I don't give it out to people - it's for my personal use only. DuckDNS is fine - I just wanted to have a more static domain solution. Keep in mind that the TLD for this kind of thing doesn't matter because you don't have to worry about SEO type things for your private domain, and you can get some really good deals on certain TLDs. So, if you need a more static solution, buying another domain and keeping it private is what I recommend on the basis that you can do it very inexpensively. Otherwise, stick with a dynamic DNS. I treat it like my home address - if I tell someone that domain that means that they can send traffic to my homeserver. The same way they could come to where I live if they knew my street address. I think it is a good idea to not give your address out to anyone who wants to send you an email. ---------------------------------------------------------------------- death_hawk · 2023-10-31 19:38 Paranoid. For ease of use though (especially if any of it is going to be public or semi public) having an alternate domain is nice. ---------------------------------------------------------------------- thisiszeev · 2023-10-31 20:13 You are very paranoid. It's a good thing and a bad thing. It's good because you are aware that you are vulnerable and the long term risks it can bring. It's bad because you are not putting enough effort in locking yourself down. When you leave your home you don't hide your front door in another building. Sure it obscures everything, but your front door is not necessarily closed and locked. I am a white hat, and I have been perfecting my art since the days of 300 baud modems and BBS services. Oh those were the days... But a few years ago I was owned. Me, a security aware hacker, got OWNed. And not just, my Facebook got hacked and sent my grandmother busty Asian teens... No... Everything was compromised. I changed my passwords every month, still do. Each one was unique, still is. They were all 16+ characters with uppercase lowercase digits and symbols. How? I did not consider my Gmail to be important. I used it to watch YouTube and try out websites I didn't trust and didn't want to put my primary email in to sign up. Don't want any of those busty Asian teens in my inbox. So the Gmail password was the same since I created it. I saw it as zero risk. But... I was using chrome and saving my passwords in my browser. I had two legal matters on the go with two separate people who at some point had unrestricted access to my computer. So most likely one of them tried, or got someone to try, my Gmail password and they got in, got all my other passwords, and ruined my day, week and month. There is no such thing as too much security. But in the words of Thomas Jefferson, or some other dead US president... He who gives up freedom in exchange for safety, will have neither. My subdomains are pointing to a CNAME which is the cloud domain of my mikrotik router board. Using Reverse Proxy and or Port Forwarding I then direct the various domains to my various selfhosters services. I check check check and check constantly for any way to get in... Did I leave the window open? Firewall, block IP address blocks from high risk countries, my servers update their software every 4 hours automatically, and everything else I could think of. I have full freedom to move about and I am comfortable that I am secure, but also vigilant to ensure I stay secure. ---------------------------------------------------------------------- djgizmo · 2023-10-31 20:14 What you want is a proxy. Either dns by itself will still expose your homelab IP. ---------------------------------------------------------------------- Sajberspejs · 2023-10-31 20:16 I'm using Nebula mesh vpn so my homelab ip is not exposed. ---------------------------------------------------------------------- djgizmo · 2023-10-31 20:17 ahh. Understood. Then any domain will work internally. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-10-31 21:12 No you wont. If i start a scan now i got your ip within max 12 hours. Everyone knows your ip + the ip gets attacked at least hourly. They dont know who you are, but why should they care ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-10-31 21:17 If you dont know how to host a Service that helps you nothing, apart from traffic offloading from ddos script kiddys.... If you know how to host a Service you can publish your ip and it does not matter. There is 0 more security. Maybe in Terms of loadbalancing, speeding up traffic and ddos protection. But no security gained ---------------------------------------------------------------------- ImpossibleTracker · 2023-10-31 22:28 Wireguard will be the VPN Service. You will establish a VPN connection to your home network via a client, once connected you can have another layer of protection to put all your apps behind reverse proxy. But before you access the apps, authelia will add the layer of identity management. ---------------------------------------------------------------------- Gabe_Isko · 2023-10-31 22:54 There are botnets that continuously scan all of IPV4. They have everyone's ip. I guess I don't know what you are saying. If you need to make a computer available through a domain, and that computer is meant to be only accessed by you, don't share the domain. If you don't want the computer available from a domain, use tail scale or a vpn or something. ---------------------------------------------------------------------- Gabe_Isko · 2023-10-31 22:59 You should have crowdsec, but you are generally right. If crowdsec security controls aren't secure enough, than you should not have any ports forwarded period, and you definitely shouldn't point a domain at your IP. Even a dynamic one. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-01 01:16 Do you ever have a need for someone to access your stuff without the VPN? For example sharing out a link to a large file? Or login other than through the VPN? Those are use cases for an external name. But there are often less personalized names you can use for free. For instance duck DNS or the default name on Tailscale. If you never have any of these use cases then no, no need. ---------------------------------------------------------------------- Silencer306 · 2023-11-01 05:05 So you connect to the Wireguard VPN, does it have any password protection? Or will it only accept your device mac and ip? Is it Wireguard -> Authelia -> Nginx -> apps? ---------------------------------------------------------------------- Verum14 · 2023-11-01 07:43 ngl the wildcard sub idea is a good one