Comment - FBXL Lotide

Comment on Improving security by separating server duties

I respect what you said about your own firewall, however I disagree with it! ISP modem/firewall’s are rarely if ever updated/upgraded. I thought I was fine without a hardware firewall until I started getting into some of my more darring adventures into home labbing. I was using DuckDNS for things, but decided I wanted to be able to do more so I needed a static IP. Luckily my ISP offers two static IPs for free so I got those.

I hope part of your hardening SSH is changing the port number! If you want to keep your LAN safer with a firewall, and something small like a pi zero (I use a pi zero 2), you can setup a honey pot vLAN. Again I realize you said not interested in a firewall, but I am saying a honepot helps.

original

Sort:hotnew top

LewdLemon@sh.itjust.works ⁨6⁩ ⁨days⁩ ago
Thanks for your input. It is correct that a lot of ISPs/consumer grade hardware is poorly maintained. Mine is a rare exception, however: I’m running an AVM FritzBox, which are somewhat famous for still receiving updates even after 10+ years on the market. They have only recently pushed a security update my way, so I’m good enough on that front - for now.

I shall consider a firewall in the future though.

I hope part of your hardening SSH is changing the port number!

I used to do that, but then realised that doing so will do very little. Scanning all possible ports is a matter of seconds, and SSH (unlike Wireguard) will signal to a potential attacker that it’s listening on port X instead of just remaining silent. In other words: in my eyes, it’s security by obscurity and will have very little effect.

What I have done to harden SSH is:

set up pubkey authentication and disable password authentication

disable root login

not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard

I have also tried out IP whitelisting (which may harden my setup against attacks from the LAN), but found it may be overkill for now. I might turn it back on just for shits and giggles.
original
- Reannlegge@lemmy.ca ⁨6⁩ ⁨days⁩ ago
  What I have done to harden SSH is:
  
  set up pubkey authentication and disable password authentication
  
  disable root login
  
  not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard
  
  I have done those things as well, but I have also
  
  changed my port, to some four digit number.
  
  port forwarded port 22 to its own vLAN that goes to a pi 0 2 that runs crowdsec as a honey pot.
  
  I am looking for additional things to run on either that pi or vLAN for security.
  
  original