What setups/softwares do you use to secure your server?
All I do is run the process as user with no login shell.
The topic came to mind after reading this post Is Authelia enough without fail2ban or crowdsec?
You must log in or # to comment.
Reverse proxy for services for friends and family
Tailscale for my remote services
Basically everything is in docker containers.
Any middlemen between the proxy and services?
Rootless LXC containers, TLS. In my case, I have both VPS and my own hardware, so every sensitive data is hosted on the hardware only.
My stuff is only accessible from my LAN (because I haven’t figured out how to set up a tunnel or reverse proxy yet).
I’m in this boat too, my security is awful, bad practices everywhere, my solution: don’t let it go out in public…
Tailscale is your friend.
Screw Tailscale, ZeroTier and specially cloudflare, all centralized, all with changable terms.
Use a VPS, lowest spec but good bandwidth, and use Wireguard VPN for your VPS and homeserver, and nginx or caddy to make a Reverse Proxy
I’m so close to doing this. Cloudflare makes me nervous. Have you heard of Rathole? That was recommended to basically do what my cloudflared tunnel is already doing. The only trouble I could see was I was going to have to keep the cloudflared access controls.
All agreed but not every homelabber can spend money for something that is not the main job or contributed to work. Tailscale for now works well enough for free.
Cloudflare agreed is not something I would trust.
I’ve tried to use ZeroTier because Tailscale still has centralized servers for starting the connection, but had trouble getting it to work. Maybe I should stop letting the perfect be the enemy of the good.
it’s so secure not even I, the owner can get in
(I forgot the password to truenas scale)They’d be helping you out by cracking your password, log us both in 😂
It’s more difficult to steal my data when it’s only stored in a single place without backups.
Brilliant!
- Begins project to print out all essential data and move it into three ring binders, then format hard drive.
deleted by creator
I don’t have anyone to share it with, so it’s not open.
your NSA agent is very upset you haven’t thought about their feelings on the subject.
I tend to go overboard on security, or so I’ve been told.
Secure enough I suppose.
f2b at the FW, auth with MFA for anything exposed, anything local only has restricted access at the FW level, with exposed (via proxy) and local-only (separate proxy) on different vlans. Each service is (typically, with some exceptions) an LXC, with additional rules and templated out based on use case. The few cases where docker is involved is local-only and that has its own vlan with additional rules.
My setup is airgapped (everything is wireless).
Can’t tell if joke.
Walking to the setup you would stub your small toe a few times, that alarm is enough.
I have 3 subnets. One for me, one for family members and one for the publicly accessible services I expose. Each process has limited access to the file system, no root shell and even in the case someone gains full control of it they can’t reach other subnets. I use fail2ban too.
For the “me” part, I connect through a VPN. I’d like to run rootless docker services tho, or by using Podman
User process makes sense, but login shell is probably limited value. If your service gets pwn’d the attacker will spin up a reverse shell, and that isn’t protected by the login shell. You ideally want to use selinux/apparmor to prevent execution, or containers to limit the available execution environment.
I operate SSH, nginx, and uvicorn like this:
SSH
- pubkey auth only
- not on default port
- AllowUsers var in sshd.conf is set
nginx
- runs as its own user
- serves static files or forwards to uvicorn
- rate limits are set
- returns 444 on requests that aren’t in sitemap.xml (nonsense and probing)
uvicorn
- runs as its own user
and a firewall runs on top of everything in a hardened kernel. I’m self taught, so I could be missing something obvious and this setup has been reliable for me for a few years.
Do you have any sort of access limiting, either by whitelist (e.g. Tailscale), or blacklist (e.g. Crowd-Sec)?
Nope, I’m accessible on the WAN and the webserver is intentionally public facing.
Edit: AllowUsers in sshd.conf is my access control
I use ssh keys… And some firewall rules.
I do have an internet only and a LAN only VLAN at least.
