Inspired by this comment to try to learn what I’m missing.

  • Cloudflare proxy
  • Reverse Proxy
  • Fail2ban
  • Docker containers on their own networks

Another concern I have is does it need to be on a separate machine on a vlan from the rest of the network or is that too much?

  • Akatsuki Levi@lemmy.world
    link
    fedilink
    English
    arrow-up
    35
    arrow-down
    4
    ·
    2 days ago

    Disable password authentication on SSH

    Enable firewall and block all ports you’re not using(most firewalls do this by default)

    Switch to a LTS kernel(not security related, but it keeps things going smooth… Technically it is safer since it gets updated less often so it is a bit more battle tested? Never investigated whenever a LTS kernel is safer than a standard one)

    Use Caddy to proxy to services instead of directly exposing them out

    HTTPS for web stuff(Caddy does it automatically)

    • szszl@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      3
      ·
      8 hours ago

      Caddy or any other (reputable) reverse proxy. I think Nginx Proxy Manager would be best for beginner thanks to GUI.

        • InvertedParallax@lemm.ee
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          2 days ago

          There are ip lists that let you iptables drop all traffic from China and Russia.

          Strongly recommend.

          • Lka1988@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            3 hours ago

            My UDM has this capability. I’ve blocked quite a few countries that it logged as trying to get into my network. Great little internet cylinder.

          • ocean@lemmy.selfhostcat.comOP
            link
            fedilink
            English
            arrow-up
            7
            arrow-down
            2
            ·
            2 days ago

            I was auto banning all countries but my own but now I’m hosting one resource that has an audience including Chinese…

            Good advice outside of this use case! :)

            • InvertedParallax@lemm.ee
              link
              fedilink
              English
              arrow-up
              4
              arrow-down
              1
              ·
              2 days ago

              Yeah, there were other countries to ban, but those 2 cut my attacks down 90%.

              Also consider a honeypot that triggers when anyone tries to ssh it at all.

    • JustEnoughDucks@feddit.nl
      link
      fedilink
      English
      arrow-up
      7
      ·
      2 days ago

      Dropping instead of blocking might technically be better because it wastes a bit more bot time and they see it as “it doesn’t exist” rather than an obsticle to try exploits on. Not sure if that is true though.

      For me:

      • ssh server only with keys

      • absolutely no ssh forwarding, only available to local network via firewall rules

      • docker socket proxy for everything that needs socket access

      • drop non-used ports, limit IPs for local-only services (e.g. paperless)

      • crowdsec on traefik for the rest (sadly it blocks my VPN IPs also)

      • Authelia over everything that doesn’t break the native apps (jellyfin and home assistant are the two that it breaks so far, and HA was very intermittent so I made a separate authelia rule and mobile DNS entry for slightly reduced rules)

      • proper umask rules on all docker directories (or as much as possible)

      • main drive FDE with a separate boot drive with FDE keyfile on a dongle that is removed except for updates and booting to make snatch-and-grabs useless and compromising bootloader impractical

      • full disk encryption with passworded data drives, so even if a smash and grab happens when I leave the dongle in, the sensitive data is still encrypted and the keys aren’t in memory (makes a startup script with a password needed, so no automated startups for me)

      For more info, I followed a lot of stuff on: https://github.com/imthenachoman/How-To-Secure-A-Linux-Server

    • Shimitar@downonthestreet.eu
      link
      fedilink
      English
      arrow-up
      10
      ·
      2 days ago

      This, but I prefer nginx.

      And no real need for tailscale or cloudflare. If you do not like to depend on a third party service, either port forward and ddns or an external vps+wire guard if you have gcnat

        • Shimitar@downonthestreet.eu
          link
          fedilink
          English
          arrow-up
          1
          ·
          6 hours ago

          It is, but you are free to switch at any time provider, there is no technological lock in like with cloudflare or tailscale (i know there is a free self hostable version, not talking about that).

          So just rent a new one and switch your wireguard there.