Inspired by this comment to try to learn what I’m missing.

  • Cloudflare proxy
  • Reverse Proxy
  • Fail2ban
  • Docker containers on their own networks

Another concern I have is does it need to be on a separate machine on a vlan from the rest of the network or is that too much?

  • Akatsuki Levi@lemmy.worldEnglish
    304·
    1 day ago

    Disable password authentication on SSH

    Enable firewall and block all ports you’re not using(most firewalls do this by default)

    Switch to a LTS kernel(not security related, but it keeps things going smooth… Technically it is safer since it gets updated less often so it is a bit more battle tested? Never investigated whenever a LTS kernel is safer than a standard one)

    Use Caddy to proxy to services instead of directly exposing them out

    HTTPS for web stuff(Caddy does it automatically)

    • JustEnoughDucks@feddit.nlEnglish
      8·
      1 day ago

      Dropping instead of blocking might technically be better because it wastes a bit more bot time and they see it as “it doesn’t exist” rather than an obsticle to try exploits on. Not sure if that is true though.

      For me:

      • ssh server only with keys

      • absolutely no ssh forwarding, only available to local network via firewall rules

      • docker socket proxy for everything that needs socket access

      • drop non-used ports, limit IPs for local-only services (e.g. paperless)

      • crowdsec on traefik for the rest (sadly it blocks my VPN IPs also)

      • Authelia over everything that doesn’t break the native apps (jellyfin and home assistant are the two that it breaks so far, and HA was very intermittent so I made a separate authelia rule and mobile DNS entry for slightly reduced rules)

      • proper umask rules on all docker directories (or as much as possible)

      • main drive FDE with a separate boot drive with FDE keyfile on a dongle that is removed except for updates and booting to make snatch-and-grabs useless and compromising bootloader impractical

      • full disk encryption with passworded data drives, so even if a smash and grab happens when I leave the dongle in, the sensitive data is still encrypted and the keys aren’t in memory (makes a startup script with a password needed, so no automated startups for me)

      For more info, I followed a lot of stuff on: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server

        • InvertedParallax@lemm.eeEnglish
          81·
          1 day ago

          There are ip lists that let you iptables drop all traffic from China and Russia.

          Strongly recommend.

          • ocean@lemmy.selfhostcat.comOPEnglish
            62·
            1 day ago

            I was auto banning all countries but my own but now I’m hosting one resource that has an audience including Chinese…

            Good advice outside of this use case! :)

            • InvertedParallax@lemm.eeEnglish
              31·
              1 day ago

              Yeah, there were other countries to ban, but those 2 cut my attacks down 90%.

              Also consider a honeypot that triggers when anyone tries to ssh it at all.

    • Shimitar@downonthestreet.euEnglish
      9·
      1 day ago

      This, but I prefer nginx.

      And no real need for tailscale or cloudflare. If you do not like to depend on a third party service, either port forward and ddns or an external vps+wire guard if you have gcnat