Best security practices when using a system like TrueNAS Core? reddit / selfhosted ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-10 06:06 I know that this is not the TrueNAS subreddit, but I wanted to get a fresh "outside of the box" opinion that might not be possible to get over there. I don't really know much about networking, but I do know that ideal networks would theoretically have a single server perform a single task (ie web/email/file storage) and that each server would have a firewall server between them. TrueNAS throws this out of the window because you can pretty much host everything together. My question is to ask you guys what best security practices could be implemented (other than keep everything patched/updated frequently) if I were to try to run NextCloud and Navidrome and Jellyfin. What threat mitigation tactics could I use inside and outside of this system to have reasonable security? The apps I listed seem to have pretty good support in TrueNAS Core, but maybe I should consider separate servers? I wanted to add that I have a [Sophos XG 115](https://www.corporatearmor.com/sophos-xg-115/) that I will be putting OPNsense on and learning how to configure, and I have various Linksys routers that I can throw OpenWRT on too. ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 06:23 Run them as rootless containers, this pretty much covers 90% already. If you don’t want them talking to the host or to each other, put a reverse proxy in front of them and set them each to their own container network with limited or no WAN access. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-10 06:25 This is a very good starting point for me to dig into. Thanks! ---------------------------------------------------------------------- ElevenNotes · 2023-11-10 06:28 Get familiar with container networking, it’s pretty easy to setup and understand and does exactly what best security means: Each service on its own network isolated from the rest. The rootless part is just important that the container itself is not run as root but as an unprivileged user like 1000 (de facto the standard docker UID/GID). I provide a few rootless containers [my self](https://hub.docker.com/u/11notes) by default:. ---------------------------------------------------------------------- Sudden_Cheetah7530 · 2023-11-10 09:17 It depends on what your threat model is. If you concern about CVE level issues like the privilege escalation, you would better run images as non-root user. But what you care about is general security stuff, following the general rules for your networking topology would be enough. ---------------------------------------------------------------------- Krieg · 2023-11-10 15:43 No open ports. I run my services as a combination of Cloudflare, Tailscale and reverse proxy. The only exception is Plex, I keep a port open for Plex because I heavily use remote streaming. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-11 15:19 Like I said, I'm a noob way out of my league here. I've been [reading into containers and jails](https://justanerds.site/freebsd-jails-vs- docker/) and I see that there is still a major security risk even when using these because they share the host kernel. Do you have any advice in this regard? ---------------------------------------------------------------------- ElevenNotes · 2023-11-11 18:40 There is no risk by using standard container namespaces. The only escalation attacks on containers work if the container is executed as privileged and allows therefore host access, which on its own should never happen. Run podman or rootless docker to increase security even more. If it would be unsecure as you stated, k8s multi tenant clouds would not work. ---------------------------------------------------------------------- Own_Career_7388 · 2023-11-11 21:31 Thank you for the reply. This might be too specific of a question (unless you've used TrueNAS) and it might be beyond the scope of my post, but do you have any opinion of running apps natively inside [jai ls](https://www.truenas.com/docs/core/coretutorials/jailspluginsvms/ja ils/creatingjails/) (iocage) in TrueNAS? ---------------------------------------------------------------------- ElevenNotes · 2023-11-11 22:32 I've never used any of these, only stock Linux.