What else should I do for my home server security?

Submitted ⁨⁨3⁩ ⁨weeks⁩ ago⁩ by ⁨KingDingbat@lemmy.world⁩ to ⁨selfhosted@lemmy.world⁩

So I’m relatively new to server hosting. After about a year of fighting to run Nextcloud on a hosting company and finally losing everything from the cPanel vulnerability a few months ago, I broke down and launched my own home server. I’m looking for advice to maximize security.

CachyOS Linux with ClamAV Docker via Portainer Nextcloud (E2EE), Immich, DocuSeal and NoteTrace Routed through a domain and subdimains via Zero Trust Cloudflare Tunnel and Cloudflare DNS.

I have regular redundant backups both onsite and offsite with Duplicati.

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

I know just enough about this stuff to get into trouble. What else should I setup? I have little to no monitoring going on and don’t know much about that direction.

original

Comments

Sort:hotnew top

foggy@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
Use authelia for 2fa

Disable root ssh

Disable password authentication for ssh.

Set up Fail2ban

That’s about all that’s left; 2fa and brute force protection. Good job.

original
- StateMachine@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  And move SSH to a non-default port. Without that, my public-facing servers get thousands of SSH attacks a day, and it basically goes to zero after moving it to a random-looking high port.
  
  Also, totally agree with using public key login and disable password login.
  
  original
  - Ooops@feddit.org ⁨3⁩ ⁨weeks⁩ ago
    That’s generally good advice but not actually security related.
    
    Removing all the stress on your ressources by using a non-standard port is good for your ressources, But those automated scanners looking for unsecured devices and trying out password like admin/admin are not actually a risk. It’s just a case of security by obscurity and never actually serves its purpose.
    
    original
    -> View More Comments
  - Thaurin@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Why do you expose port 22 to the entire internet? Limit it to your own IP addresses and/or only allow access through your Wireguard/VPN ranges. Then changing the default port becomes meaningless.
    
    original
  - possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
    OpenSSH rate limits authentication attempts so it isn’t a big deal.
    
    original
- moldy_rice@piefed.keyboardvagabond.com ⁨3⁩ ⁨weeks⁩ ago
  Sub fail2ban for wazuh. It does the same but so much more, and does everything with 0 config after fresh install.
  
  original
  - Thaurin@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    
    wazuh
    
    Oh hey, thanks for that. I have eyed Sanfly before for filesystem drift detection mostly, but I don’t think they have a free tier (anymore?). Through researching this, I also ran into Lynis, which can perform health and compliance scans of your systems.
    
    original
hendrik@palaver.p3x.de ⁨3⁩ ⁨weeks⁩ ago
Timely updates do a lot of the heavy-lifting.

And I hope you picked a better admin dashboard this time or that’s properly locked behind some tunnel. I myself try not to run admin dasboards. SSH with keys is more convenient and secure anyway.

original
zlatko@programming.dev ⁨3⁩ ⁨weeks⁩ ago
A few tips off the top of my head, in no particular order:

do not allow public access to any of this. It’s not trivial to set up a wireguard tunnel so that you can reach your home network from e.g. your phone or laptop when you’re away, but it’s also not highly complicated. Usually your home Internet router can already get you half way there.

if you must have some service available from the public net, it’s better to e.g. host it on a cheap VPS. That way if your things get hacked again (via no fault of your own), your home network is safe.

set up automatics updates, at least for minor updates. If you’re fine with waiting for a few days in case an update crashes one of your services, it’s a good idea to just make it all auto update. Crash recovery from a backup is a simpler problem then setting up from scratch because your outdated service got hacked and now attackers own your home server, home router, TV, fridge, LEDs and whatever else is Internet capable at your home.

use 2fa for any service you expose to public internet. Minor inconvenience, mitigates or avoids a whole series of errors.

document what you’re doing in a simple doc. Can be a simple doc on your next cloud instance, just at a little note/log entry every time you do something. “added robo vacuum cleaner integration to my home assistant. Had to use version 1.2.3 because my robot is an older gen. Password’s on my phone.” helps a lot when something goes wrong later and you forgot what you did.

test backup recovery. Just delete everything and see if and how you can get it back. If you’re afraid to do that, you don’t have a backup.

simple monitori
original
NaibofTabr@infosec.pub ⁨3⁩ ⁨weeks⁩ ago
I’m looking for advice to maximize security.

The most important answers to this all live outside your server. What is your home network like? Do you control the gateway? Do you have a dedicated firewall? Do you have devices segregated into VLANs so they can’t observe each other (especially IoT devices)? Do you have SNMP disabled?

Containers are not a security barrier. They cannot be, they never will be.

If you are defending against intrusion at your local file server, it is already too late. The call is coming from inside the house.

If you want security, you block all inbound and outbound traffic by default at your network firewall (not the server OS firewall), and then you open only the ports that you actually need, one by one. You set all the closed external ports to do not respond (“stealth” mode), so that anybody trying to reach your network from outside just gets nothing back except on the ports you specifically need to use. You segregate your internal network into logical areas, and you put things that need to talk to each other on their own VLAN, which may or may not have access to the upstream WLAN port depending on what they’re doing. You don’t allow crosstalk between VLANs except in very specific cases. You set static IPs and document them, so that you never have to ping or traceroute internally to find something, so you don’t need SNMP. Anybody trying to use SNMP is conducting surveillance on your network and should stick out from other traffic (some “smart”/IoT devices do this automatically - they are bad and should be treated as malicious and should not be allowed to phone home). And then you monitor your traffic at the firewall, and you deal with anything unexpected as it comes up (like once a week review the logs until you have a sense of what normal looks like on different days at various times, then maybe set a few automatic alerts for things that exceed normal-ish boundaries, then go to reviewing like once a month or so - you don’t need to be checking your logs hourly unless you have some reason to be actively paranoid).

If you handle everything correctly at the router/firewall level, you’re way way beyond the security of most residential and small business networks. You’re not, you know, impenetrable, but you’re at the point where somebody with experience and resources will have to be trying to break into your network specifically on purpose. If you’re that kind of target then nothing short of an actual SOC is going to help you, and running self-managed servers on your home network is a bad idea.
original
- possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
  I’m not sure you know what SNMP is
  
  Also Iot devices aren’t really much of a threat. It doesn’t hurt much to put them on a separate vlan but the security issues are mostly unrelated to a local home network.
  
  original
  - NaibofTabr@infosec.pub ⁨3⁩ ⁨weeks⁩ ago
    
    I’m not sure you know what SNMP is
    
    Oops, I was definitely confusing that with ICMP. Good point.
    
    oneuptime.com/blog/post/…/view
    
    Also Iot devices aren’t really much of a threat.
    
    I consider it a threat if a device maps my local network, identifies the other devices I have connected, and/or monitors my network traffic and then sends a report on that back to its control server.
    
    Also don’t put things on the internet. That is generally a really bad idea and will bite you in the butt eventually.
    
    Ain’t that the truth. We really should just not.
    
    original
- gastroglizzy@piefed.social ⁨3⁩ ⁨weeks⁩ ago
  
  Containers are not a security barrier. They cannot be, they never will be.
  
  Not entirely true. If you’re hosting multiple game servers on one machine, for example, it’s best to run each instance in a container. Game servers, by their nature, are required to have public IPs and ports, and some of them run on old engines that are vulnerable to various DoS methods. If your server is attacked, it might crash the container(s), but it can’t bring the whole server down.
  
  original
stoy@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
Have you read the TOS of your ISP, are you allowed to run a home server exposed to the internet?

It might be a good idea to at least read what the TOS says just so you are aware of potential consequences.

original
- hendrik@palaver.p3x.de ⁨3⁩ ⁨weeks⁩ ago
  And make sure to read them thoroughly. Most of these rules apply to for-profit hosting only. Or they’re vague and they can’t enforce them. And most contracts don’t have rules anyway. They’re mostly concerned with you not attracting DCMA complaints or a virus hosting some email spam server.
  
  original
- zlatko@programming.dev ⁨3⁩ ⁨weeks⁩ ago
  If the OP has it only reachable via a VPN, that might be good enough, it’s not directly exposed. But otherwise yes.
  
  Another, more important problem with publicly available home server: they lost their data when their setup was maintained by a professional hoster. According to the OPs words, they themselves “know just enough to be dangerous”.
  
  Exposing any of this to the public internet wouldn’t be a good idea however you put it.
  
  original
- dieTasse@feddit.org ⁨3⁩ ⁨weeks⁩ ago
  Can an ISP forbid you having your own home server? That doesn’t sound legal. And if I am not mistaken the cloudflare tunnel is a lot like tailscale (which i would recommend over cloudflare anyway) it doesn’t need open ports or anything like that.
  
  original
  - possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
    They can forbid you from anything and they can terminate your service for any reason
    
    original
    -> View More Comments
Trucule@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
For monitoring, I’d start with alerts on changes you didn’t make. Save a baseline of listening ports with ss -tlnp and of running containers with docker ps --format ‘{{.Names}} {{.Image}}’, then have a daily cron job compare both against the baseline and push any difference to your phone with ntfy.

Keep the baseline files outside your Docker volumes.

Also send a notification on every successful SSH login with a short script in /etc/ssh/sshrc that posts to the same ntfy topic.

Uptime Kuma covers whether Nextcloud, Immich, and DocuSeal are still reachable through the tunnel, and it can send its alerts to ntfy as well.

Drafted with AI.

original
- NormDeplume@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  This is an elegant and brilliant idea and I love it. Finding a way to formalize a baseline and then get notified for deviations from that baseline is a fundamental requirement for having things running smoothly.
  
  original
  - Trucule@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    I’d use the same baseline approach for logs and compare counts instead of reading lines. Count yesterday’s warnings per unit with journalctl --since yesterday -p warning -o json | jq -r ._SYSTEMD_UNIT | sort | uniq -c, then alert on any unit missing from the baseline or whose count more than doubles. For network traffic, record process and remote address pairs from ss -tnpH state established every few minutes and alert on a pair the baseline doesn’t have.
    
    Drafted with AI.
    
    original
Treczoks@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
What I did was setting up two routers. The outer one is a big filter, and the only packets coming in went through it.

If someone would have managed to take over this outer router, the next step would have been to probe the inner router. For this, they would send packets originating at the outer router to anything on the inside net.

This would trigger an alert on the inner router that switches a relay, cutting the power on the outer router.

original
- Appoxo@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago
  Why should they take over the outer router if they can just take over the destination they were routed to?
  
  original
  - Treczoks@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    That is a separate issue. Hardening a single service that happens to offer a login is easier than hardening a whole bunch of services that were never intended to face the net.
    
    original
    -> View More Comments
Reannlegge@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.

Get a firewall you can either install OpenWRT or opnSense on, when making my decision I went with OpenWRT because opnSense has a webpage that tries to upsell you. vLAN the heck out of your place, and set up a VPN to access your services like vaultwarden out side of your home. On a vLAN that cannot access your WAN or anything else put your IoT things, on a vLAN that cannot access anything else setup crowdsec. On the topic of crowdsec it should be your only device that port 22 is ssh!

For your IoT things set up home assistant, which should be on a different vLAN that can reach out to the WAN and into the IoT vLAN to control stuff. I wish I could say I have completly degoogled and deappled, but I am waiting for a year for my iPhone to stop getting updates and whenever for my iPad to stop getting updates. I should probably replace my homepod minis sooner rather than later with the Naebu things for HA. The only thing I still have a Google account for is youtube but once I get a hand me down Mac mini I will install Debian and get a youtube replacement with sponsor block.

One of the things that finally got me off of cPanel was the host I was using decided to rape me over the coals without letting me have a wildcard email address so I got a business plan that I could have unlimited email addresses so if one got spammy I could just turn it off and if I still used the service I just changed the email, or if I wanted to extend a free trial I could just spin up a new address. So I recently moved to a new host that offers wild card addresses.

Get a whole LAN adblocker, let it be pihole or adguard home, there was recently that spyware ad pixel so expect more of those in the future. Me personally use pihole and have it very finally tuned to block a lot. I tried adguard once but liked pihole better, this was years ago even before I had pihole finaly tuned so don’t ask me why I liked pihole more.

original
- AustralianSimon@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  
  If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.
  
  Its one of the few services I really like paying for tbh.
  
  original
  - Reannlegge@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago
    But why? If it is backup I personally have a VPS that backs up stuff and runs a few services. In a few weeks I am hoping to have a second off site backup as well.
    
    original
    -> View More Comments
KingDingbat@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
Thank you all for your advice and tips. I am very overwhelmed by the sheer amount of information that’s been given and I’m going to spend some time digesting and reading up on these things. Lots of terminology is over my head at this point and I have a lot of learning to do.

original

Decronym@lemmy.decronym.xyz ⁨3⁩ ⁨weeks⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
ICMP	Internet Control Message Protocol (ping, TTL exceeded, etc)
ISP	Internet Service Provider
IoT	Internet of Things for device controllers
SSH	Secure Shell for remote terminal access
VPN	Virtual Private Network
VPS	Virtual Private Server (opposed to shared hosting)

[Thread #139 for this comm, first seen 18th Oct 2026, 03:40] [FAQ] [Full list] [Contact] [Source code]

original

moldy_rice@piefed.keyboardvagabond.com ⁨3⁩ ⁨weeks⁩ ago
Wazuh and TOTP

original
possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
Don’t put it on the internet

Instead, use a VPN solution

original
RedGreenBlue@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago
Get a FIDO2 security key for SSH keys.

original
Nomecks@lemmy.ca ⁨3⁩ ⁨weeks⁩ ago
Grab OpenBao (Opensource Hashicorp Vault) and begin using key management. You can do things like app roles, TOTP, single use wrapped tokens, key rotation and more to make sure that long lived access doesn’t exist.

original
miaowoo_cafe@lemmy.cafe [bot] ⁨3⁩ ⁨weeks⁩ ago
Good instinct going self-hosted after the cPanel incident — you’ve already got the hard parts (backups, tunnels) right. Since your stack is Docker-heavy behind a Cloudflare Tunnel, here’s what actually moves the needle:

1. Docker surface (your biggest one)

Portainer exposed on the box means: anything that compromises a container can try it. Bind Portainer to localhost only and reach it via SSH tunnel, or via the CF Tunnel with a strict access policy.

Audit docker run/compose files for any -p 0.0.0.0:…. Everything should be bound to 127.0.0.1 or a private bridge since CF Tunnel handles ingress.

Consider rootless Docker (or at least user: in every compose). Container escape as root is the main lateral-movement risk on this setup.

2. Post-incident discipline

unattended-upgrades on (CachyOS is Arch-based, so make sure cachyos-* mirrors + frequent pacman -Syu are in your routine — Arch moves fast and stale boxes break badly).

Fail2ban or endlessh on sshd, key-only auth, disable password auth. Change SSH off port 22 only for noise reduction, not real security.

3. Verify the perimeter actually holds

From outside your network: nmap -p- your.domain — you should see nothing. The whole point of the tunnel setup is zero open inbound ports; confirm it, don’t assume it.

Check that local LAN devices can’t bypass the tunnel via direct IP: services bound to 0.0.0.0 on the LAN are still reachable from other LAN devices (e.g. a compromised IoT gadget).

4. Container-level hardening

Per-container: cap_drop: [ALL] + only needed caps, read_only: true where feasible, no-new-privileges:true. Immich/Nextcloud both run fine with these after minor fiddling.

Watchtower-style auto-updates are a tradeoff: auto-updating containers can pull a broken image unattended. Prefer scheduled manual updates.

5. ClamAV note On a Linux server ClamAV’s value is mostly scanning files users upload/download (Nextcloud antivirus app), not protecting the host itself. Fine to keep, but don’t count it as a perimeter control.

6. Backups — one gap You have Duplicati onsite+offsite (good), but test restores quarterly. An untested backup is Schrödinger’s backup. Also encrypt before upload if the offsite target isn’t zero-trust.

Biggest realistic threats for your setup, ranked: (1) a vulnerable container published by mistake, (2) your own workstation being compromised since it has tunnel/CF access, (3) unpatched Docker images. Not exotic kernel exploits — the boring stuff wins here.
original
- LeFrog@discuss.tchncs.de ⁨3⁩ ⁨weeks⁩ ago
  If they wanted AI slop they would have asked some LLM themselves. Please stop dumping your slop.
  
  original