How to confirm home server security reddit / selfhosted ---------------------------------------------------------------------- zubitti · 2023-11-29 18:33 Is there a way to confirm that my home server's security is sufficient for most common attacks? Externally, I only have the ports 80, 443 (Nginx-Proxy-Manager) and 51829 (Wireguard VPN) enabled on the router. I have a Rpi4 and a mini PC connected to the router via ethernet cable. And I am using NPM for reverse proxy. Also enabled SSL for local DNS so I don't have to keep typing the IP addresses for each server. All my apps are docker containers and they all use `network_mode: bridge`. And finally, I have only two services open to internet. The media server and the Wireguard VPN. Got the free DuckDNS domains and configured in the NPM. I haven't done any specific firewalls. Just using default Debian 12 settings and default Docker engine settings. ---------------------------------------------------------------------- lesigh · 2023-11-29 19:07 Hmm.. Nmap port scan from outside the network to confirm open ports? ---------------------------------------------------------------------- hdddanbrown · 2023-11-29 19:08 > All my apps are docker containers and they all use `network_mode: bridge`. Why? ---------------------------------------------------------------------- BelugaBilliam · 2023-11-29 19:16 Sounds pretty good to be honest. A few things you could do, although it probably won't matter, but I do to mine simply because it can't hurt: SSH keys, disable root login and disable password login. Plus makes signing in easy Fail2ban, probably irrelevant with ssh keys but I install it anyways Crowdsec, I'm new to this, don't know much about it, but it's very popular Ufw and block unused ports I know you don't expose ssh ports or anything, but those are some simple things you can do just to reduce any possible attack surfaces. Optionally, update docker containers or setup scripts to notify when there is a container update (there are services that do this) instead of watchtower so you don't break configs ---------------------------------------------------------------------- zubitti · 2023-11-29 19:34 Because I don't know what else I should be doing :) ---------------------------------------------------------------------- kaipee · 2023-11-29 19:51 Centralised logging, centralised metrics, altering, and SIEM. Those should be ready enough to deploy, except SIEM. You'll need to know what to look for though. You can also deploy things like HIDS and NIDS to alert on suspicious activity. Again, you need to know what you're checking and expect false positives until you fix them. ---------------------------------------------------------------------- Still-Snow-3743 · 2023-11-29 20:10 That all sounds pretty reasonable ---------------------------------------------------------------------- Simon-RedditAccount · 2023-11-29 20:29 Hire a professional security auditor `/s`. And seriously, the only valid answer is the same. You may completely miss the important thing, just because you forgot it. Otherwise, just use basic checklists. Update OS and apps regularly. Verify (and ideally test) the updates (however testing is difficult in a single-server scenario). Use rootless Docker. Use separate networking for each docker-compose app. Make only reverse proxy available from outside the RPi. Put the RPi in DMZ; or set up strict firewall rules. Use only pubkey SSH auth without root account. Add WAF (even a basic one like mod\_security or similar) and rate limiting (fail2ban); ideally on nginx's side. Make sure your router is secure as well. etc, etc. ---------------------------------------------------------------------- Lankiness8244 · 2023-11-29 20:47 Ssl labs and nessus scanner ---------------------------------------------------------------------- -JVT038- · 2023-11-29 22:20 The only other suggestion I have is to implement geoblocking. Suppose you live in country A, then just block all incoming connections that aren't from country A. If you're going on vacation to country B, just connect with a VPN from your own server. This will minimize any DDOS attempts and IP scanning from countries like Russia, China and India. ---------------------------------------------------------------------- ELKER54 · 2023-11-29 22:27 Wazuh is a good SIEM ---------------------------------------------------------------------- kaipee · 2023-11-29 22:35 Close the external ports until you do :) ---------------------------------------------------------------------- hdddanbrown · 2023-11-29 23:53 Then maybe start learning? /r/Docker is good. Specifiy network\_mode bridge for every container is completely pointless and can be a security risk. Considering you are asking about how to improve security, thats a thing i would change in your setup. ​ There is simply no need to to allow every container to connect to all other containers. Separate them. Plenty of discussions here exist on how good practice of a Docker setup like stacks with compose. ---------------------------------------------------------------------- Anycast · 2023-11-29 23:57 Minor security through obscurity thing you could implement: buy you own domain through cloudflare for ~$10/year. Use their proxy so that your public IP doesn’t resolve to your home public IP like it does now with DuckDNS. If you want to get fancy, you can also use their API with fail2ban to block connections after a predefined number of login failures. ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-11-30 01:49 Go to public.cyber.mil and download the appropriate stigs for your stuff, review them, and apply the settings. Always a good start to improving the security. ---------------------------------------------------------------------- david007co · 2023-11-30 02:44 This sounds ideal. It would reduce the amount of attacks quite a lot. How could geoblocking be implemented ? ---------------------------------------------------------------------- Cybasura · 2023-11-30 03:27 I recommend you dont touch network_mode unless you absolutely need it Most services shouldnt need the network_mode, just gotta port forward/translate most of the time ---------------------------------------------------------------------- eve-collins · 2023-11-30 04:43 I love your honesty 😁 ---------------------------------------------------------------------- kindrudekid · 2023-11-30 04:57 Audit-ssh and testssl. Audit ssh shows all the algorithm in use and setting and shows then colored format like red bad and so on… Same with testssl, which tls supported ? Https redirect ? What cipher suites etc … again all color coded. Both available via homebrew for Mac. If you use Mozilla recommended for ssh and ssl you should be fine ---------------------------------------------------------------------- kindrudekid · 2023-11-30 04:59 Crowdsec is very handy for HTTPS I have it integrated and it can detect brute force login attempts and other malicious vectors for known CVE … One time I configured an api key incorrectly for an influx bucket and my home ip got banned for 24 hours lol…. Funny thing is I was setting up grafana dashboard for crowdsec ---------------------------------------------------------------------- kindrudekid · 2023-11-30 05:00 Nothing beats splunk, a dev license is good enough for home use. There is also open search that is getting really good lately ---------------------------------------------------------------------- ithilelda · 2023-11-30 06:14 yes, there are professional third party cybersecurity auditors you can hire, but I doubt anyone here would ever need them. Please people, stop being paranoid about your security. close up all unnecessary ports, and that's what you can do on your end. whatever else, if the service binding to an open port has security vulnerabilities you don't know, the project team may very well be unaware of it either, and there's nothing you could do. also, if you have multiple users using your service, then it's their password strength that you should be worrying the most, not your infrastructure. ---------------------------------------------------------------------- chaplin2 · 2023-11-30 07:19 What does it do for self hosters? ---------------------------------------------------------------------- chaplin2 · 2023-11-30 07:25 Frankly these are useless. SSH is secure by default and will never support algorithms that could be possibly broken. Same for TLS 1.3 ---------------------------------------------------------------------- peekeend · 2023-11-30 09:52 Check Wazuh and Greenbone, but it requires a high learning curve so have fun learning the basics ---------------------------------------------------------------------- ardaingeal · 2023-11-30 13:20 I used Cloudflare for this and then set up a WAF rule for geo blocking. Then in Nginx I blocked all incoming traffic that doesn't orignate from CloudFlare. ---------------------------------------------------------------------- PassiveLemon · 2023-11-30 15:04 Sounds very similar to my setup. All I would recommend is SSH through keys (and disable root login) and don’t put everything into the Docker network bridge. If you have containers that need a database or other container(s), make a network for those. Obviously keep up to date with new updates. There are many services that can automatically notify you for updates like Watchtower. You can also set it up automatically update the container but it’s not always recommended in case of breaking changes. ---------------------------------------------------------------------- Simplixt · 2023-11-30 15:16 It's as secure as your media server is hardened for direct internet access. So always ask yourself, if the convenience of port-forwarding NGINX Proxy Manager worth it, or do you just stay with WireGuard. ---------------------------------------------------------------------- kindrudekid · 2023-11-30 20:45 They are not for security enforcement but to help you in understanding your config and making changes based on results. ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-12-01 02:12 This might be what you're looking for https://github.com/NOXCIS/Wiregate