How "secure" is your setup?

Comments

• irmadlad@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  I tend to go overboard on security, or so I’ve been told.

  lemmy.world/post/43533409

  original
• Tiger_Man_@szmer.info ⁨3⁩ ⁨weeks⁩ ago

  i try to keep it secure by minimalism because the less complicated is the software the smaller is the chance of a vulnerability

  so everything related to file transfer/access uses sftp (with accounts with no ssh permissions because: 1. i dont want the password to my server to be stored anywhere in some sftp software 2. im not the only user of this server) and for other services i just run a small local program and remote access it with ssh

  original
• littleomid@feddit.org ⁨3⁩ ⁨weeks⁩ ago

  There are a couple things that are public. Nothing that’s not containerized in an LXC. SSH is only available with VPN. I once locked myself out after not being at home as we had a blabkout, I found no way in after two days and had to get there physically. I think I’m fine.

  original
• PriorityMotif@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  youtu.be/40SnEd1RWUU

  original
• Mio@feddit.nu ⁨2⁩ ⁨weeks⁩ ago

  Wireguard VPN. I actually have a public hosted Oracle server that when authentic opens port 443 for that source IP temporary so no VPN will be needed. Computer visit free pub Oracle VM. Android Phone scan QR, start Wireguard and auth that user. Computer can now reach my home server on port 443 and 22 for 24 hours as the source IP is allowed.

  I do this instead of crowdsec etc. I expect zero days vulnerabilities that someone will utilize so dont trust nginx and ssh to be wide open.

  original

  • soyslurper2@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago

    You have Authentik guarding your Wireguard key on a public server?

    I’m not sure how this is different from having Authentik on your home server, unless the point is to hide your IP address

    original

    • Mio@feddit.nu ⁨2⁩ ⁨weeks⁩ ago

      Not Authentik, something home made. Wireguard is unfortunately open for the whole world but as far as I know there has not been any security whole in it. But Wireguard is at least a security product. It is not about hiding my public IP. It is about closing the attack surface. Bots cant connect to my home server at all. This means zero days vun cant be used. Yes, Oracle server can be compromises but it itself cant connect to my home server and it cannot authenticate any user as it does not have my phone to do that. It just generate an internal adress that is only accessible when connected with Wireguard. So only those I manually add have a chance and I will notice if the source IP is wrong or if it was not generated by that server as I use public key that is just base64 encoded url

      original
• lch361@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago

  Rootless LXC containers, TLS. In my case, I have both VPS and my own hardware, so every sensitive data is hosted on the hardware only.

  original
• tired_n_bored@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

  I have 3 subnets. One for me, one for family members and one for the publicly accessible services I expose. Each process has limited access to the file system, no root shell and even in the case someone gains full control of it they can’t reach other subnets. I use fail2ban too.

  For the “me” part, I connect through a VPN. I’d like to run rootless docker services tho, or by using Podman

  original
• hexagonwin@lemmy.today ⁨3⁩ ⁨weeks⁩ ago

  i don’t have many servers exposed publicly other than apache2(+freshrss) and opensshd. server runs freebsd and apache2 runs on a jail. nothing special other than that, so i could theoretically get instantly pwned with a openssh 0day.

  original
• femtek@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago

  Reverse proxy with fail2ban and crowdsec on only 443 for a couple things. Minecraft is forwarded for server. Everything else is behind VPN.

  original