What steps do you take to secure your server and your selfhosted services?

[relativearea1@sh.itjust.works]

Enable firewall and block all ports you're not using(most firewalls do this by default)

this one haven't failed me....yet.

PS: please don't pentest me

[lorentz@feddit.it]

My Synology has an auto block feature that from my understanding is essentially fail2ban, what I don’t know is if such a feature works for all my exposed services but Synology’s

I'd be surprised if it works for custom services. Fail2ban has to know what's running and haw to have access to its log file to know what is a failed authentication request. The best you can do without log access is to rate limit new tcp connections. But still you should know what's the service behind because 5 new SSH sessions per minute and IP can be reasonable 5 new http1.0 connections likely cannot load a single html page.

[justenoughducks@feddit.nl]

Dropping instead of blocking might technically be better because it wastes a bit more bot time and they see it as "it doesn't exist" rather than an obsticle to try exploits on. Not sure if that is true though.

For me:

• ssh server only with keys

• absolutely no ssh forwarding, only available to local network via firewall rules

• docker socket proxy for everything that needs socket access

• drop non-used ports, limit IPs for local-only services (e.g. paperless)

• crowdsec on traefik for the rest (sadly it blocks my VPN IPs also)

• Authelia over everything that doesn't break the native apps (jellyfin and home assistant are the two that it breaks so far, and HA was very intermittent so I made a separate authelia rule and mobile DNS entry for slightly reduced rules)

• proper umask rules on all docker directories (or as much as possible)

• main drive FDE with a separate boot drive with FDE keyfile on a dongle that is removed except for updates and booting to make snatch-and-grabs useless and compromising bootloader impractical

• full disk encryption with passworded data drives, so even if a smash and grab happens when I leave the dongle in, the sensitive data is still encrypted and the keys aren't in memory (makes a startup script with a password needed, so no automated startups for me)

For more info, I followed a lot of stuff on: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server

[irmadlad@lemmy.world]

• Fail2ban
• UFW
• Reverse Proxy
• IPtraf (monitor)
• Lynis (Audit)
• OpenVas (Audit)
• Nessus (Audit)
• Non standard SSH port
• CrowdSec + Appsec
• No root logins
• SSH keys
• Tailscale
• RKHunter

[dannyboy@sh.itjust.works]

Tailscale and being at my house is the only two ways in so I feel those are pretty good for me.

[irmadlad@lemmy.world]

My new strategy is to block EVERY port

Wow! All 65535 +/-, in and out? That's one way to skin a cat.

[gamer@lemm.ee]

ez pz:

#!/usr/sbin/nft -f
table inet filter {
    chain input {
        type filter hook input priority raw; policy accept;
        iif "lo" accept
        ct state established,related accept
        iif "enp1s0" udp dport 51820 accept
        iif "enp1s0" drop
    }

    chain forward {
        type filter hook forward priority raw; policy accept;
        iif "lo" accept
        ct state established,related accept
        iif "enp1s0" udp dport 51820 accept
        iif "enp1s0" drop
    }

    chain output {
        type filter hook output priority raw; policy accept;
    }
}

[irmadlad@lemmy.world]

I've seen it done as such:

[hperrin@lemmy.ca]

One thing I do is instead of having an open SSH port, I have an OpenVPN server that I’ll connect to, then SSH to the host from within the network. Then, if someone hacks into the network, they still won’t have SSH access.

[splashjackson@lemmy.ca]

I put up a sign that says, "No hackers allowed plz"

[chewy7324@discuss.tchncs.de]

I do the same, but with Wireguard instead of OpenVPN. The performance is much better in my experience and it sucks less battery life.

[chewy7324@discuss.tchncs.de]

Some I haven't yet found in this thread:

• rootless podman
• container port mapping to localhost (e.g. 127.0.0.1:8080:8080)
• systemd services with many of its sandboxing features (PrivateTmp, ...)

[qjkxbmwvz@startrek.website]

Fail2ban config can get fairly involved in my experience. I'm probably not doing it the right way, as I wrote a bunch of web server ban rules --- anyone trying to access wpadmin gets banned, for instance (I don't use WordPress, and if I did, it wouldn't be accessible from my public facing reverse proxy).

I just skimmed my nginx logs and looked for anything funky and put that in a ban rule, basically.

[ocean@lemmy.selfhostcat.com]

How has that been going?

[ikidd@lemmy.world]

"All your containers are belong to us."

[ikidd@lemmy.world]

I assume #2 is just to keep containers/stacks able to talk to each other without piercing the firewall for ports that aren't to be exposed to the outside? It wouldn't prevent anything if one of the containers on that host were compromised, afaik.

[Guest]

Caddy or any other (reputable) reverse proxy. I think Nginx Proxy Manager would be best for beginner thanks to GUI.

[Guest]

This is a valid solution but honestly how is using VPS not depending on third party?

[mangopenguin@lemmy.blahaj.zone]

They aren't on the internet mainly.

[mangopenguin@lemmy.blahaj.zone]

Containers can talk to each other without any ports exposed at all, they just need to be added to the same docker network.