What setups/softwares do you use to secure your server?
All I do is run the process as user with no login shell.
The topic came to mind after reading this post Is Authelia enough without fail2ban or crowdsec?
You must log in or register to comment.
My stuff is only accessible from my LAN (because I haven’t figured out how to set up a tunnel or reverse proxy yet).
I’m in this boat too, my security is awful, bad practices everywhere, my solution: don’t let it go out in public…
Tailscale is your friend.
Screw Tailscale, ZeroTier and specially cloudflare, all centralized, all with changable terms.
Use a VPS, lowest spec but good bandwidth, and use Wireguard VPN for your VPS and homeserver, and nginx or caddy to make a Reverse Proxy
All agreed but not every homelabber can spend money for something that is not the main job or contributed to work. Tailscale for now works well enough for free.
Cloudflare agreed is not something I would trust.
I’m so close to doing this. Cloudflare makes me nervous. Have you heard of Rathole? That was recommended to basically do what my cloudflared tunnel is already doing. The only trouble I could see was I was going to have to keep the cloudflared access controls.
I’ve tried to use ZeroTier because Tailscale still has centralized servers for starting the connection, but had trouble getting it to work. Maybe I should stop letting the perfect be the enemy of the good.
it’s so secure not even I, the owner can get in
(I forgot the password to truenas scale)They’d be helping you out by cracking your password, log us both in 😂
My setup is airgapped (everything is wireless).
Can’t tell if joke.
I operate SSH, nginx, and uvicorn like this:
SSH
- pubkey auth only
- not on default port
- AllowUsers var in sshd.conf is set
nginx
- runs as its own user
- serves static files or forwards to uvicorn
- rate limits are set
- returns 444 on requests that aren’t in sitemap.xml (nonsense and probing)
uvicorn
- runs as its own user
and a firewall runs on top of everything in a hardened kernel. I’m self taught, so I could be missing something obvious and this setup has been reliable for me for a few years.
Reverse proxy for services for friends and family
Tailscale for my remote services
Basically everything is in docker containers.
Any middlemen between the proxy and services?
I’m a little paranoid, so this is my security set up.
SSH, blocked at firewall level, only allowing specific local IP to access port 22. Also authentication is done by key, with password disabled.
Most services are local only and I access them through wireguard VPN when I’m outside my home.
For services that need a domain name and be public facing, I use a reverse proxy, with the following protections:
- Very restrictive geoIP block, only my country can access.
- Restrictive rate limiting.
- Crodwsec, with community lists, a pluging for open lists, community rules and my own very restrictive set of rules for banning attackers. (For instance as soon as the requested path contains “.env” that’s an instant ban, no second chances).
- Monitoring through grafana.
- Some complex services that need a valid tls handshake but I only want to use them myself have a setup when they are technically open to the net, to get let’s encrypt, but the server rejects every IP request but mine.
Recently I also reduced some noise, surface attack, deleting the A register from my second level domain and using an obscured target for the CNAME records. I also want to delete the www subdomain as it gets a lot of uneeded noise.
Secure enough I suppose.
f2b at the FW, auth with MFA for anything exposed, anything local only has restricted access at the FW level, with exposed (via proxy) and local-only (separate proxy) on different vlans. Each service is (typically, with some exceptions) an LXC, with additional rules and templated out based on use case. The few cases where docker is involved is local-only and that has its own vlan with additional rules.
I tend to go overboard on security, or so I’ve been told.
Walking to the setup you would stub your small toe a few times, that alarm is enough.
For my server, secure enough. Just the basic recommendations, non-standard ssh port, default deny on firewall, fail2ban, etc. It doesn’t need a lot of security because its just a static website. For most projects this is enough.
I will say, a honeypot can be useful and I’m getting one set up but its a low priority for me.
I don’t have anyone to share it with, so it’s not open.
your NSA agent is very upset you haven’t thought about their feelings on the subject.
I have 3 subnets. One for me, one for family members and one for the publicly accessible services I expose. Each process has limited access to the file system, no root shell and even in the case someone gains full control of it they can’t reach other subnets. I use fail2ban too.
For the “me” part, I connect through a VPN. I’d like to run rootless docker services tho, or by using Podman
Rootless LXC containers, TLS. In my case, I have both VPS and my own hardware, so every sensitive data is hosted on the hardware only.
softwares
Not a word. That’s like saying “2 helps” or “5 happies”.
Go check SLSA.dev .
Grammar is for sheeps.
Pierogis
