How dangerous is a Windows Server exposed in the internet reddit / selfhosted ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 14:32 Hi guys, i have Windows Server 2022 DC exposed in the internet. There is some VMs Running with Nextcloud on Debian and a PBX System of 3CX. I have a software firewall which denies all incoming traffic except for the ports which i allowed. 80,443,5006 etc… What can i do to prevent my Win Srv getting hacked. On my linux systems i have a good security with fail2ban and encrypted drives with MFA. But i‘m not so sure about my windows server. I am thankful for every advice of u guys. Thanks a lot! ---------------------------------------------------------------------- djzrbz · 2023-11-05 14:42 DON'T EXPOSE YOUR DC TO THE INTERNET! Thanks for coming to my TED Talk. ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 14:51 Datacenter* ---------------------------------------------------------------------- XxCrazyMikeyxX · 2023-11-05 14:55 VERY dangerous! DCs should only be DCs with no other roles installed. at the very least use a Reverse proxy server and put the web apps on a different server. ---------------------------------------------------------------------- djzrbz · 2023-11-05 14:56 Still, if it is acting as your hypervisor, don't expose it. If you need to expose the VMs, get a proper firewall in front and good A/V. ---------------------------------------------------------------------- ElevenNotes · 2023-11-05 14:58 As dangerous as exposing any other OS. Only expose the ports you need. Use reverse proxy for almost everything. Patch your OS (automatically). Better would be to use containers to expose the services. For the people who can't read: OP means Windows Server 2022 data centre not domai controller. ---------------------------------------------------------------------- Common_Scale5448 · 2023-11-05 15:00 You're probably already powned. ---------------------------------------------------------------------- This-Gene1183 · 2023-11-05 15:11 Yeah don't expose hypervisor. That's just insane. ---------------------------------------------------------------------- Jackster22 · 2023-11-05 15:12 What is the best software based firewall you can use in front of Windows? ---------------------------------------------------------------------- CyberHouseChicago · 2023-11-05 15:15 there are millions of windows servers exposed to the internet if you know what you are doing the risk is minimal. ---------------------------------------------------------------------- Exzellius2 · 2023-11-05 15:16 I quite like opnSense. ---------------------------------------------------------------------- 0pointenergy · 2023-11-05 15:19 I use a combination of secure tunnels and VPN depending on the service and if other people need access. Ngrok and Tailscale, both have free tiers ---------------------------------------------------------------------- eshuaye · 2023-11-05 15:25 Had an old laptop and was learning networking. I put Linux on it, setup ssh, a really long root password, and setup port forwarding for ssh on 222. Took three days for the system to run out of disk space. 200gb of failed login attempts. Back to OP. If you want to have some fun and dip a toe in ‘cyber security’ on what not to do. Sure put a server out in the wild and make sure it’s in some DMZ ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 15:28 I have a software firewall „stateless firewall“ in front and use the windows firewall as well. I only have the ports exposed which are needed and don‘t use reverse proxy. Do you think it‘s still dangerous? I am thinking about switching to ubuntu server lts and taking the windows server down ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 15:30 But i have some services running on the hypervisor, like PBX for example. ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 15:32 I use fail2ban and my log won‘t have 200GB of login attempts.. so idk ---------------------------------------------------------------------- ElevenNotes · 2023-11-05 15:37 If you want the least amount of attack surface on the host OS go Alpine Linux and skip Ubuntu. ---------------------------------------------------------------------- Im1Random · 2023-11-05 15:40 Windows Server :/ ---------------------------------------------------------------------- ScribeOfGoD · 2023-11-05 15:41 Just don’t 🤦🏼‍♂️ ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 15:51 Everybody saying just don‘t or don‘t do it. But what would u guys do? Alternatives? I need Nextcloud and PBX System. Would Ubuntu Server LTS be safer? ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 15:52 Okey thank you for the advice, i‘ll check it out ---------------------------------------------------------------------- ElevenNotes · 2023-11-05 16:01 Use Alpine as your host OS for containers. Get familiar with reverse proxies like Traefik and Nginx. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 16:09 Then this is your first Problem. Learn how to use Hypervisors! For fuckssake, we do not need more Bots in botnets. Either secure ur Server and use as intended or dont get a Server. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 16:14 Tho. It might be a good idea to tell OP. With each Services hosted you got another attack vector. And with a single Win Datacenter Server, if a Software has a zerodays, rce's or just badly configured it can lead to All Services beeing affected. Imho, that would be something for either: Docker / HyperV / Proxmox / Vmware. Just my 2 Cents. There is a reason people use separate Networks and different VM's for the Services. But, who am i telling that, you are a Datacenter Tech. You know exactly what iam talking about. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 16:19 I would do it no other way than Proxmox! Opnsense in a VM => Firewall and reverseproxy Nextcloud in a VM PBX in a VM Use different VLAN's for each VM. That way if one Service gets hacked you do still have the other Services up ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 16:22 Use Keyfile Auth, what the fuck. Password does shit. With ssh its either => Only password and accessible only with vpn Or Public with keyfile authentication + password. I dont know why anyone would use only a password. + if you dont have fail2ban it does not matter if your password has 4 or 8 chars. It will get bruteforced ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 16:23 Ey! It isnt any fun if it does not break the next Update ---------------------------------------------------------------------- olluz · 2023-11-05 16:23 Definitely, check out some best practice guides on how to improve security on your windows server. If you're looking for a fail2ban alternative check out [EvlWatcher](https://github.com/devnulli/EvlWatcher/releases). In general only open the ports you absolutely need. ---------------------------------------------------------------------- carl2187 · 2023-11-05 16:27 Keep it patched, and use good passwords. Keep any services exposed patched. Done. The fear mongering here is pathetic. For example people say exposing rdp is a death sentence. It's not. Use good passwords, Keep it up to date. It's fine. Like right now, there are 0 known exploits for RDP. Yes new ones will be found, but you patch right away to remove the exploits. It's actually remarkably rare that a 0 day exploits get used in mass in the wild. Yes, it happens, but people act like a fully patched system will be compromised in seconds. They just don't get how the infosec world actually works. The only problem is the constant patching. You must patch quick. So yea, you take the risk of your app or service breaking due to patches. No big deal. Way less risk in that than not patching and leaving your app or service vulnerable. ---------------------------------------------------------------------- telenieko · 2023-11-05 16:34 Check IPBan, https://github.com/DigitalRuby/IPBan ---------------------------------------------------------------------- lawk · 2023-11-05 16:40 You can use RDPGuard or EvlWatcher. I expose my server to the internet directly as well since I was old enough to use computers. If you want something to be conveniently accessible I dont see a problem. Just use crowdsec or fail2ban on linux and the above mentioned on windows, also keep the system updated obviously. a lof of the reverse-tunnel thingy stuff on self hosted is some crutch fetish because people have trouble exposing due to ISP cgnat junk etc.. ---------------------------------------------------------------------- solracarevir · 2023-11-05 16:48 The truth is that the internet only cares about what ports you have open and what services are you running through them. So as long as you only expose the services you need and they are secured (no vulnerability on them, fully patched, encrypted, blah blah blah) You'll be fine. ---------------------------------------------------------------------- ElevenNotes · 2023-11-05 16:54 I'm honetsly not sure if you just made fun of me or thanked me, well, which one is it 😜 ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 16:58 Second one. I Was too retarded to read your full post before that, and corrected after that with: You already know that as a Datacenter tech No pun intended and 100% my fault for not reading your first comment completly. Might not happen often on reddit, but that was Props to you with 0 pun intended. Have a nice evening mate ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 17:02 Thanks a lot ---------------------------------------------------------------------- iammilland · 2023-11-05 17:04 Just setup tailscale, if that is not possible only setup up that port to accept connection from that ip that needs the access. But not recomended in any way and then you need to always patch it. ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 17:06 I use the teamviewer patchmanagement so my server is always up to date. I know that i didn‘t got pwned cuz i‘m so paranoid, i always be checking all the logs and netstat connections but all the people here on reddit are like „windows is so insecure af“ etc ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 17:06 If you need help or got questions: r/proxmox is great and will help you with questions / Problems ---------------------------------------------------------------------- gustyxotwod · 2023-11-05 17:06 Nice man, thank you i‘ll check it out ---------------------------------------------------------------------- ElevenNotes · 2023-11-05 17:07 Thanks, you too mate 🍻. You can tell that to the mods over at /r/homelab who banned me for saying stuff like this. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 17:14 Well if someone has no arguments left / gets triggert because he is wrong it mostlikely results in a ban in the most subs here. ---------------------------------------------------------------------- ElevenNotes · 2023-11-05 17:26 True, but what world do we live in where you get banned because you said "one can't compare podman with k8s". ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-11-05 17:33 Ofcourse you can compare them. I too like to compare a Ferrari with my tracking Bike... Well if they dont want the knowledge thats great. I really love it when people do something i say dont, and then fuck their whole System. Has something magical too see their whole Network crumble and to tell them afterwards i told you so ---------------------------------------------------------------------- eirsik · 2023-11-05 18:07 There are millions of Windows servers exposed to the internet, not directly exposed, but behind reverse proxy. I work as a sysadmin for a major international IT company and we have thousands of windows servers behind ADC / Netscaler and F5 / Checkpoint. But domain controllers are pretty locked down and should never never be exposed at all. ---------------------------------------------------------------------- Lancaster1983 · 2023-11-05 18:48 Also, don't expose the Internet to your DC. Also, MFA with Duo. ---------------------------------------------------------------------- KervyN · 2023-11-05 20:07 100% ransomware in the next two days. ---------------------------------------------------------------------- joecool42069 · 2023-11-05 20:41 It depends what you have listening on those ports. The OS doesn't really matter. If you're running a web app with poor security on linux or windows and expose it to the internet, you're going to have a bad time. So the bigger question should be, how secure are the applications you're exposing. ---------------------------------------------------------------------- nyrosis · 2023-11-05 21:34 shitpost? umm... you probably already are "hacked". How to secure this? turn it off and try again without exposing it to the internet. maybe try wireguard next time... ---------------------------------------------------------------------- ella_bell · 2023-11-05 21:37 You’re going to have a baaaad time ---------------------------------------------------------------------- sjveivdn · 2023-11-05 21:49 “Really long root password” why do you intentionally make your life harder? ---------------------------------------------------------------------- sjveivdn · 2023-11-05 21:55 What is the reason for exposing a hypervisor to the Internet. Why are you doing that? ---------------------------------------------------------------------- DWolfUK40 · 2023-11-05 22:40 Not trying to be funny but why are you exposing entire servers to the internet at all, especially windows ones? Any services that need exposing should be dealt with individually. A reverse proxy for stuff you want others to access, use 2fa if you want but anything designed to be exposed usually has decent built in security. A vpn to access stuff you don’t want general access to. That’s 3-4 ports you need to open for that and is of little risk. Any vpn server is going to have decent security and is by design made to face attacks. You can go much further securing stuff but it sounds like you may need to do a little homework before somebody claims your server and does bad things with it. ---------------------------------------------------------------------- t1nk3rz · 2023-11-05 23:01 If you can, buy a cheap mini pc with a couple of ethernet interfaces and install pfsense or opnsense on it, you can also install suricata for IDS and IPS,i run this setup at home for more 5 years without issues.I also recommend you to install Proxmox as a hypervisor,its a solid beast. ---------------------------------------------------------------------- 8layer8 · 2023-11-06 00:14 I had a guy ask me if his network was secure and gave me the IP to scan. It was more open than yours, but I sent him a list of all his users, his file shares and the first ten files in each share, and printed a test page to each printer. I hope their security guy was demoted to janitor. Back in the day, we plopped a win 2k box with iis directly on the internet unpatched (and not connected to anything else) to see how long it would survive. 3 1/2 minutes is the answer. ---------------------------------------------------------------------- littelgreenjeep · 2023-11-06 00:23 “You’ll be fine” 🙃 ---------------------------------------------------------------------- betahost · 2023-11-06 00:35 The average time a server is attempted to be broken into once exposed to the internet is 13 seconds. Let that sync in ---------------------------------------------------------------------- somerandomguy101 · 2023-11-06 00:43 >You'll be fine Until the next 0-day drops. ---------------------------------------------------------------------- xkcd__386 · 2023-11-06 01:31 since there are already a lot of good answers... the way you phrased your question reminded me of an old joke man walking across a field to farmer: "is that bull safe?" farmer: "the bull is safe, you may not be if you go through the field" ---------------------------------------------------------------------- Raj-The-IV · 2023-11-06 02:15 Very dangerous, even with Windows Firewall… ---------------------------------------------------------------------- persiusone · 2023-11-06 03:48 You have zero business running a Server if you are exposing it in this manner. Start with no access to anything. Open from there as needed. Most servers do not need to be accessible from the entire internet, and looking at the replies (next cloud and a PBX), it sounds like the roles can be accomplished with a VPN to the services you need. Otherwise, it's just a matter of time before you are totally screwed and you just contribute to a larger issue. ---------------------------------------------------------------------- djgizmo · 2023-11-06 04:35 Wut. This is just asking for a 0 day exploit. ---------------------------------------------------------------------- lmux · 2023-11-06 04:58 A lot of commenter here might be over worrying. It all comes down to firewall config, aka does the incoming ports you allow cause a security issue. That aside, the only thing is your firewall being on the same platform. So you are trusting windows firewall being safe. A more secure implementation would be to have a physical pc acting as a dedicated firewall (that is not windows). That way an attacker would need to get through your physical firewall and windows firewall, which is a lot harder. ---------------------------------------------------------------------- gustyxotwod · 2023-11-06 05:52 This! ---------------------------------------------------------------------- gustyxotwod · 2023-11-06 06:10 That‘s what i am thinking. I have a stateless firewall in front and on top of that the windows firewall. The ubuntu lts has ufw so idk ---------------------------------------------------------------------- lmux · 2023-11-06 06:14 Yup then I'll consider this best effort as far as architecture goes. ---------------------------------------------------------------------- Inexces79 · 2023-11-06 06:40 Check Cloudflare tunnels, you can host a docker in your network that connects it cloudflare. Here you can deploy applications to expose them to the internet. It’s free with some limits. You can close your firewall for https/http apps this way. And your apps have a reverse proxy trough cloudflare, hiding your up adres for the world. ---------------------------------------------------------------------- JzJad12 · 2023-11-06 07:24 Yeah like is pbx it's own vm or do you literally have software pbx on the host/windows. ---------------------------------------------------------------------- gustyxotwod · 2023-11-06 11:36 I have PBX on host/windows 🤡 ---------------------------------------------------------------------- DyceFreak · 2023-11-06 11:56 Can't tell if DC means 'data center' or 'domain controller.' Directions unclear, DNS stuck in cieling fan. ---------------------------------------------------------------------- DyceFreak · 2023-11-06 11:59 After reading through the replies here and taking into account OP's percieved ignorance to certain practices... I'm convinced OP is simply marketing a honeypot with this post. ---------------------------------------------------------------------- bufandatl · 2023-11-06 12:00 Yes ---------------------------------------------------------------------- solracarevir · 2023-11-06 12:49 Ain't that how it works for everyone? Running either Windows or Linux behind the exposed servers? ---------------------------------------------------------------------- somerandomguy101 · 2023-11-06 14:00 No. The name of the game is risk management. Imagine you're running an Apache server, which only runs Apache, and only has 80 and 443 open externally. That is an entirely different risk profile than exposing your Hypervisor or DC (With all subsequent ports for multiple services open) directly to the internet. You need to segment, so a 0-day in one service doesn't lead to all other services immediately getting owned. I will also refer everyone to read up on the [Mitre ATT&CK Framework](https://attack.mitre.org/) if you haven't already. ---------------------------------------------------------------------- mats_o42 · 2023-11-07 21:06 That survived longer than expected. Unpatched XP or XP sp1 had an average lifespan of 11 sec before getting infected with sasser or a derivate. ---------------------------------------------------------------------- 8layer8 · 2023-11-07 22:24 It was probably less, it was a long time ago and on a class b IP range.