your text formatting is very cool! where have you learned this style?
Comment on Improving security by separating server duties
LewdLemon@sh.itjust.works 1 week agoThanks for your detailed reply and expertise! I really appreciate it!
First question you have to ask yourself is so what?
You’re right to call out my lack of threat modeling. I am aware that the “cost” of what I’m planning here likely outweighs the actual risks. That’s a deliberate choice though: one of my objectives in homelabbing is to “learn how the big guys do it”, i.e. learning and implementing, bit by bit, networking and security best practices.
That said,
- all of my drives are (LUKS) encrypted (although this will only help against evil maid attacks physically stealing my disks, since data is only encrypted at rest, not while the server is in operation)
- I do have some CPU monitoring in place
- I have applied the principle of least privilege (as far as I can see at least)
- I have set up an off-site backup server running (although I need to improve automation and deduplication; I’ll probably go with Borg here)
Thank you also for pointing me towards OWASP Docker cheat sheet! I didn’t know this resource yet, although I seem to have found others that said the same thing. I already have in place:
- no docker socket exposed to services
- user set for every service that didn’t give me a headache doing that (some assume root and won’t accept setting a user)
- username remapping is active
- all containers have their caps dropped and selectively only put those back in which they need
- I expose almost no container ports, and only those necessary; instead, communication with the containers is handled on my reverse proxy’s network (i.e. via the internal docker network)
- privilege escalation is disabled
I have played around with rootless docker (again, stubborn containers assuming root prevented me from going all-in) and considered Podman, although just putting containers in a VM looks like a more frictionless route to me.
All things considered, your advice seems to be:
- to first consider whether I actually need all this security. I really don’t, yet I want to learn how to set it up anyway.
- to first explore and all other hardening avenues. I have, to a certain degree, and beyond that run into brick walls.
If I might exhaust a little more of your time, I’d be curious how you judge the next step I’ve suggested: splitting duties between separate servers, thus segmenting public from private physically, or going the virtual route (again, by splitting into a public and a private VM and separate them through strict software firewalling).
WhyJiffie@sh.itjust.works 1 week ago
LewdLemon@sh.itjust.works 1 week ago
I’m not an LLM if that’s what you’re getting at. ;)
WhyJiffie@sh.itjust.works 4 days ago
I’m sorry, yeah I was trying to figure that out. sorry for that. if it means anything, I’m not happy that I feel I have to find out.
LewdLemon@sh.itjust.works 4 days ago
No offense taken. You’re right to be suspicious. I get that the bullet-point-ish style of my OP gives people ChatGPT vibes.
werebearstare@lemmy.ca 1 week ago
I’ll start again with the threat modelling. How worried are you about an adversary acting with a compromised container? Is it just fear of an attacker or are you trying to protect something specific? If so, identify that service and/or data and isolate it. Start with what you want to protect. Does it need to be on a different physical device? If not, do you need kernel level separation (VM) between systems? That separation will have overhead associated with it. Does the compute cost reduce your risk enough to justify the separation? Moving onto multiple different boxes has its challenges as well. Yes you are more segmented but do you have the network bandwidth to support the services you want? Also, do you need those publicly available services actually exposed to the internet? If you are already using wireguard, what difference does it make to create keys for your other devices to be able to access the environment? In this age of AI running rampant, reducing your external attack surface is the single greatest thing you can do to protect yourself.
Opinion time. Build on what you have and know. If you haven’t physically separated your machines yet and everything is running on docker, look into building docker networks. If you have the networking expertise and multiple devices to run things, bite the bullet and migrate to a new set of systems. From what it sounds like, you don’t have much experience with Proxmox and that is fine. Running a few Ubuntu servers with vms and containers works great as well. Look into your firewall rules. You can use AI to help you draft a firewall table. What services need to talk to what systems? Whitelist those and blacklist everything. Once you have an understanding, look into VLANs. I personally have 3 machines running on my home domain and they are separated by functionality with like 8 separate vlans woven between them. Adversaries care about home servers for two reasons (mainly): crypto mining and botnets. Your description of the hardening already manages most of these threats. Physical or virtual both work but build your controls and networks around what you want and know. Does that make sense?