Security Virtual Server Hosting reddit / selfhosted ---------------------------------------------------------------------- unknownmind1 · 2023-12-10 22:37 Hello everyone, I have built a backend which I now want to deploy on a virtual server. The backend communicates with a Postgres Database which I plan to also deploy on the same virtual server. The main task of the backend will be to authenticate and authorize users and sent updates of a desktop application to the users which were successfully authorized. For the beginning there will be only a very small amount of users, below 10, so there should not be any kind of problem with performance when I use a shared physical server. I am planning to use a legitimate server provider like Hostinger or Hetzner. So, I am a somewhat (too) paranoid person and I've asked myself some questions about security. I will host the source code and the executables to my desktop application on this server and I definitely want to make sure that no one gets access to any of these files. Let's say I have secured my virtual server with every common security measurement, that is closing ports, 2FA, etc. would you still consider a virtual server a good choice for my goal, especially in terms of security? I am somewhat concerned that since the physical server is shared with others, that other people may be able to access the files on my behalf, eventhough everything is supposed to be seperate through virtualization. Is that a valid concern or are there any other concerns which may speak against using a virtual server for an application which is not supposed to get in the hands of unauthorized people? I am happy to hear your answers and thoughts. ---------------------------------------------------------------------- latkde · 2023-12-10 23:41 > I am somewhat concerned that since the physical server is shared with others, that other people may be able to access the files on my behalf, eventhough everything is supposed to be seperate through virtualization. There are roughly four different ways how confidentiality of your data might be violated: * There's a remote attack via one of the services you've exposed over the network. You mitigate this by staying on top of security updates, minimizing which services you expose, and configuring those services securely. It seems you have taken good steps towards that. But most likely, the weakest point is the backend software that you created yourself. * There's a bug in the virtualization software that can be exploited by another tenant. Some virtualization is better than others. Some hosters only offer some kind of lightweight virtualization that is more like Linux containers, which shares some resources with other tenants. No software is bug-free, but most real virtualization is now really good. * There's a bug in the CPU that allows side channel attacks by other tenants. This is impossible to defend against, other than hoping that there are firmware updates, and that your hosting/cloud provider quickly applies those updates. * Staff from the hosting provider can access your data. Some providers like AWS have memory encryption or disk encryption features that supposedly prevent this, but they generally either rely on provider- managed keys or on CPU features that have proven to be less than reliable. Ultimately, "the cloud" is just "someone else's computer". Most people consider these risks to be OK, especially since things that are your fault (like service misconfiguration, problems in your own code) are a bit more likely than the alternatives. If you trust the hosting provider but don't trust virtualization or your CPU, then you should consider a bare-metal server. If you also don't trust the hosting provider, the next step up would be to rent an entire rack in a colocation facility that's locked in a cage. But this would be a bit disproportionate for a 10 user app. Since this is r/selfhosted, can I interest you in a business-class internet contract with a stable IP that lets you run public servers at home, and a Raspberry Pi to be that server? ---------------------------------------------------------------------- unknownmind1 · 2023-12-10 23:53 Thanks a lot for your very detailed answer! In that case, a selfhosted variant may really be a valid choice here. Userbase is very low and it gives me all kind of safety - if set up correctly of course. Since I don't know much about self hosting a server, do you have some recommendations for ressources regarding running a Raspberry Pi at home? ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-12-11 06:25 A used mini PC could be cheaper and more powerfull with just a bit more power usage. And if have a CG-NAT you also can't do portforwarding but there is something like cloudflare tunnel (not selfhosted) that could help with that.