Meanwhile my entire homelab except for HA is hosted on a VPS
Comment on My Homelab Got Hacked - A Postmortem – Phunky Cafe
gaylord_fartmaster@lemmy.world 1 day ago
I don’t think I will ever be convinced to leave anything on my home network open to the internet no matter how convenient it is.
UnfairUtan@lemmy.world 16 hours ago
leds@feddit.dk 17 hours ago
I gave up , don’t have the time to maintain it anymore. Changed DNS to make my domain point to local lan IP so everything still works but only at home.
gedfromgont@piefed.ca 19 hours ago Yeah same. I am really bad at keeping stuff updated so I rather keep it local too.
lemmyvore@feddit.nl 22 hours ago
It’s fairly safe as long as you add a strong enough form of access control. For example if you put it behind a VPN, or a SSH tunnel, or require mTLS. Even a key in a custom HTTP header or Basic HTTP auth can be good enough if the key is strong enough.
You can further decrease the probability of drive-by bots reaching a publicly exposed service by merely scanning IPs and ports if you use a reverse proxy and hide your service FQDNs and IP.
You can do this by using TLS certs on wildcard domains rather than explicit domains, using explicit CNAMEs for the service subdomains rather than a wildcard domain, and keeping the A/AAAA records on an obfuscated subdomain rather than the base domain. If the bots can’t figure out a FQDN they’re not getting past the reverse proxy even if they find the IP and port.
This is obfuscation not real security but it cuts down tremendously on bot hits.
wewbull@feddit.uk 17 hours ago
I wouldn’t count “behind a VPN” as “open to the internet”.
frongt@lemmy.zip 17 hours ago
The VPN service is open to the Internet. But it’s only one service, versus however many things you are running behind it.
hietsu@sopuli.xyz 21 hours ago
I have knockd listening on one very high port number, and only after accessing that reverse proxy whitelists the source ip. Sure some scanners might do a full port scan and try http only after that, but FQDN is required too. Plus I have geo ip list blocking all but my country. Oh and Crowdsec. So far so good…