Comment on fail2ban behind reverse proxy (nom)
tremble5218@programming.dev 3 days ago
Firstly, what’s your threat model - as in what are you trying to block? For SSH access, fail2ban works. For bots and scrapers, I’m not sure how effective it is. What jails have your enabled/configured for fail2ban?
I don’t have your setup, but like someone else here said, I use Caddy on Docker as a reverse proxy for all my self-hosted services running in Docker containers. One really effective means of blocking AI scrapers and bots is Anubis - github.com/TecharoHQ/anubis. It might be worth a shot. It works for me.
nibbs@lemmy.zip 2 days ago
Thanks for the suggestion, I will take a look at Anubis.
There are no SSH ports open to external, as everything I run is locally in my LAN, I do not have use for externals SSH access and don’t want to open that vector.
The services that I (want to) offer to the family, are the common selfhosters finest:
As I do not have a authentication provider yet, the services which require an authentication by user/password are prone to brute force attacks, I want to mitigate that first and foremost.
In the mid to long run, I plan to also deploy an authentication provider for those services like Authelia, TinyAuth, PocketID, Authentik or <you name it>.
As there are so many of them and the opinion of which is best differ wildly, I have not yet decided and am in kind of a analysis paralysis. :)
tremble5218@programming.dev 2 days ago
For auth providers, I’ve tried all the ones you named. Here’s my brief analysis:
With these services you mentioned you want to or are already hosting, you could use the following in the order they are listed:
I would recommend 2 and 3 as 1 is pretty useless against a determined attacker. Anything that’s on the public internet is bound to be attacked at some point, so follow best practices and perform server hardening on the host machine. Remember, you classify the sensitivity of the data you host and determine the severity of the risk if that data were to be exposed. So work with that in mind when choosing an option.
nibbs@lemmy.zip 1 day ago
Thank you for the very comprehensive write up.
Authentication will be my very next project after I solved another minor problem I’ve become aware of just yesterday.
It’s at least the second time, someone mentioned Anubis in this thread.
I’ve checked the site but have to do further digging about the concept. Mostly because “AI” isn’t something I adore that much, but that’s a me problem. :)
tremble5218@programming.dev 1 day ago
No problem. I hope you found it useful. Anubis is not AI. It discerns between bots/AI scrapers and legitimate users using a combination of heuristics and a mathematical challenge, thereby protecting the website that sits behind it. Check out the documentation at: anubis.techaro.lol