What setups/softwares do you use to secure your server?
All I do is run the process as user with no login shell.
The topic came to mind after reading this post Is Authelia enough without fail2ban or crowdsec?
You must log in or register to comment.
I’m a little paranoid, so this is my security set up.
SSH, blocked at firewall level, only allowing specific local IP to access port 22. Also authentication is done by key, with password disabled.
Most services are local only and I access them through wireguard VPN when I’m outside my home.
For services that need a domain name and be public facing, I use a reverse proxy, with the following protections:
- Very restrictive geoIP block, only my country can access.
- Restrictive rate limiting.
- Crodwsec, with community lists, a pluging for open lists, community rules and my own very restrictive set of rules for banning attackers. (For instance as soon as the requested path contains “.env” that’s an instant ban, no second chances).
- Monitoring through grafana.
- Some complex services that need a valid tls handshake but I only want to use them myself have a setup when they are technically open to the net, to get let’s encrypt, but the server rejects every IP request but mine.
Recently I also reduced some noise, surface attack, deleting the A register from my second level domain and using an obscured target for the CNAME records. I also want to delete the www subdomain as it gets a lot of uneeded noise.
Wireguard VPN. I actually have a public hosted Oracle server that when authentic opens port 443 for that source IP temporary so no VPN will be needed. Computer visit free pub Oracle VM. Android Phone scan QR, start Wireguard and auth that user. Computer can now reach my home server on port 443 and 22 for 24 hours as the source IP is allowed.
I do this instead of crowdsec etc. I expect zero days vulnerabilities that someone will utilize so dont trust nginx and ssh to be wide open.
You have Authentik guarding your Wireguard key on a public server?
I’m not sure how this is different from having Authentik on your home server, unless the point is to hide your IP address
Not Authentik, something home made. Wireguard is unfortunately open for the whole world but as far as I know there has not been any security whole in it. But Wireguard is at least a security product. It is not about hiding my public IP. It is about closing the attack surface. Bots cant connect to my home server at all. This means zero days vun cant be used. Yes, Oracle server can be compromises but it itself cant connect to my home server and it cannot authenticate any user as it does not have my phone to do that. It just generate an internal adress that is only accessible when connected with Wireguard. So only those I manually add have a chance and I will notice if the source IP is wrong or if it was not generated by that server as I use public key that is just base64 encoded url
Reverse proxy for services for friends and family
Tailscale for my remote services
Basically everything is in docker containers.
If you’re talking about remote access specifically, I use tiers.
“Public” is open, but goes through crowdsec and anubis, and is on a DMZ network. This is my website, blog, Fediverse, etc.
“Private” is either secured with mtls or wireguard. This is stuff that’s only for me or family, like media or home assistant.
“Sensitive” is wireguard only. This is infrastructure management, Paperless, etc.
I don’t have anyone to share it with, so it’s not open.
your NSA agent is very upset you haven’t thought about their feelings on the subject.
Nothing to protect if you don’t expose it.
Plain and simple - Wireguard.
All services run as separate services user in rootless podman containers.
Only one nginx exposed to the open internet acting as reverse proxy to stuff where Wireguard requirement would be too inconvenient to be useful (shared calendar).
I tend to go overboard on security, or so I’ve been told.
i try to keep it secure by minimalism because the less complicated is the software the smaller is the chance of a vulnerability
so everything related to file transfer/access uses sftp (with accounts with no ssh permissions because: 1. i dont want the password to my server to be stored anywhere in some sftp software 2. im not the only user of this server) and for other services i just run a small local program and remote access it with ssh
i guess the biggest secuity threat is someone physically stealing the backup disk or the main hard drive because theyre both unencrypted
Walking to the setup you would stub your small toe a few times, that alarm is enough.
Secure enough I suppose.
f2b at the FW, auth with MFA for anything exposed, anything local only has restricted access at the FW level, with exposed (via proxy) and local-only (separate proxy) on different vlans. Each service is (typically, with some exceptions) an LXC, with additional rules and templated out based on use case. The few cases where docker is involved is local-only and that has its own vlan with additional rules.
Depends on how secure synology is.
It’s powered off.
i don’t have many servers exposed publicly other than apache2(+freshrss) and opensshd. server runs freebsd and apache2 runs on a jail. nothing special other than that, so i could theoretically get instantly pwned with a openssh 0day.
It’s more difficult to steal my data when it’s only stored in a single place without backups.
Brilliant!
- Begins project to print out all essential data and move it into three ring binders, then format hard drive.
Insecure enough so I can break in myself, in case I lose access or whatever.
