I share services with the public, so... strong passwords on everything, MFA, host scanning, SSH MAC/KEX/ciphers tweaked to ultra modern set and exposed only with keys with f2b activating on first failure, constant backups and automatic updates and scheduled reboots. Has worked great for a decade+.
this post was submitted on 26 Aug 2023
24 points (100.0% liked)
Self Hosted - Self-hosting your services.
11440 readers
1 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules
- No harassment
- crossposts from c/Open Source & c/docker & related may be allowed, depending on context
- Video Promoting is allowed if is within the topic.
- No spamming.
- Stay friendly.
- Follow the lemmy.ml instance rules.
- Tag your post. (Read under)
Important
Beginning of January 1st 2024 this rule WILL be enforced. Posts that are not tagged will be warned and if not fixed within 24h then removed!
- Lemmy doesn't have tags yet, so mark it with [Question], [Help], [Project], [Other], [Promoting] or other you may think is appropriate.
Cross-posting
- [email protected] is allowed!
- [email protected] is allowed!
- [email protected] is allowed!
- [email protected] is allowed if topic has to do with selfhosting.
- [email protected] is allowed!
If you see a rule-breaker please DM the mods!
founded 3 years ago
MODERATORS
SSH key auth for terminal login, plus an nginx proxy and client cert auth on anything accessible by the outside world. I'll expose any internal service I want because nobody is getting through the client cert auth.
I use a non standard ssh port, Fail2ban, wiregusrd vpn for some services
TOTP MFA highly recommended on SSH and webconsole. The so called "google-authenticator" makes it easy and despite the name does not use any external Google services.
Yes, but if using an android phone, the Aegis app may be a better choice. Guaranteed to not have tracking, and secrets are encrypted
That is indeed what I am using as well. The "google-authenticator" is just an (badly named) open source software that runs on the server and is available in most Linux distro repositories.
Oh, you mean the PAM module?
It can function as that as well AFAIK.
A padlock
IP whitelisting
IP whitelisting
How do you do that? I understand how blocklisting would work but how does whitelisting work in practice? How can you know in advance from which IPs you will connect to your home network in the future? That just seems like a recipe for getting stranded in some hotel without a way into your network.
You could host a proxy on a vps, somewhere, and use that vps ip address for the whitelisting. At this point setting up a VPN sounds more convenient though
Blacklist everything then whitelist the IPs you know you'll be connecting from (work, cell phone, etc). I don't connect from random places usually. If I need to then I use cellular. You might be better off with a VPN if you need to connect from random places.
Blacklist everything then whitelist the IPs you know you’ll be connecting from (work, cell phone, etc). I don’t connect from random places usually. If I need to then I use cellular. You might be better off with a VPN if you need to connect from random places.
I see, thanks!
Is there any concern with whitelisting a cellular CGNAT's public IP? Presumably that would potentially whitelist thousands or tens of thousands of other mobile devices at once, wouldn't it?
Is there any concern with whitelisting a cellular CGNAT’s public IP?
It depends on how much you decide to whitelist. In my case I whitelist my cellular carrier's IP block. Which does expose those services a little more broadly but I'm willing to risk it.