Home Server Security Recommendations reddit / selfhosted ---------------------------------------------------------------------- 1c34 · 2023-12-01 03:51 I've set up a small Linux server with NextCloud and Vaultwarden running on Docker containers, through Nginx Proxy Manager for reverse proxying, and integrated fail2ban for security measures. Are there any other recommended tools (or specific configurations) I should consider to further fortify my server's security? Your help is greatly appreciated!! ---------------------------------------------------------------------- zfa · 2023-12-01 03:56 Assuming both of those services are now public just keep on top of their updates and make sure your creds on them are strong. Make sure you don't have anything else exposed that shouldn't be and you're pretty much done. ---------------------------------------------------------------------- g0-0se · 2023-12-01 05:25 Nice job setting up fail2ban! Also look into CrowdSec for blocklists and brute force attacks. Nginx proxy manager has some limitations with crowdsec at this time so possibly be ready to switch to something like traefik which really isn’t that hard to use once you figure it out. Lots of people will recommend Cloudflare tunnels with zero trust and running two factor authentication through that. It also allows you to close all your ports which is nice. I personally use authelia for my two factor with Cloudflare tunnels. Cloudflare is definitely more secure. Some sort of two factor is pretty important. Added bonus if you setup a Cloudflare tunnel is that you can set security levels for ips outside of your home country. That’s how I stopped a lot of bots. ---------------------------------------------------------------------- kevdogger · 2023-12-01 09:56 Regarding two factor..I've setup my vaultwarden with Duo two factor. It was pretty easy to do. If you don't want to use CF, you're could also use software at the router level to filter depending on your router type. ---------------------------------------------------------------------- joshthegeeek · 2023-12-01 14:14 Asking because I want to know too, is there any way to include SSO? ---------------------------------------------------------------------- g0-0se · 2023-12-01 14:43 Look into authelia or authentik if you want it self hosted. You can also use cloudflare zero trust to have a sign in further upstream. ---------------------------------------------------------------------- g0-0se · 2023-12-01 14:49 I think the more you scale the more sense it makes to include something like authelia/authentik or zero trust. One, it’s way quicker to set it up once for every service. I can add three lines to any docker compose file and I’ll have a sign on page with two factor in like ten seconds. I also trust a self hosted solution devoted to security more than a bunch of services whose primary goal is like image hosting that happens to have a login page too. But I like hearing about solutions other than cloudflare. I know using it is a tad controversial, but for me, the benefits out weigh the risks. ---------------------------------------------------------------------- captainmustard · 2023-12-01 15:57 [ufw-docker](https://github.com/chaifeng/ufw-docker) If you’re using ufw and weren’t already aware of this, docker by default bypasses ufw rules and all container published ports are accessible from outside. This script fixes that.