What steps do you take to secure your server and your selfhosted services?

Inspired by this comment to try to learn what I'm missing.

Cloudflare proxy
Reverse Proxy
Fail2ban
Docker containers on their own networks

Another concern I have is does it need to be on a separate machine on a vlan from the rest of the network or is that too much?

load all comments

AkatsukiLevi 35 points a year ago

Disable password authentication on SSH

Enable firewall and block all ports you're not using(most firewalls do this by default)

Switch to a LTS kernel(not security related, but it keeps things going smooth... Technically it is safer since it gets updated less often so it is a bit more battle tested? Never investigated whenever a LTS kernel is safer than a standard one)

Use Caddy to proxy to services instead of directly exposing them out

HTTPS for web stuff(Caddy does it automatically)

save

path: 0 16180747, hotness: undefined, score: 35, children: 13

ZonenRanslite 21 points a year ago

This and fail2ban

save

path: 0 16180747 16180875, hotness: undefined, score: 21, children: 6

ocean 2 points a year ago

Anything else?

save

path: 0 16180747 16180875 16182027, hotness: undefined, score: 2, children: 5

Shimitar 10 points a year ago

This, but I prefer nginx.

And no real need for tailscale or cloudflare. If you do not like to depend on a third party service, either port forward and ddns or an external vps+wire guard if you have gcnat

save

path: 0 16180747 16181399, hotness: undefined, score: 10, children: 2

szszl 1 point a year ago

This is a valid solution but honestly how is using VPS not depending on third party?

save

path: 0 16180747 16181399 16213005, hotness: undefined, score: 1, children: 1

JustEnoughDucks 8 points a year ago

Dropping instead of blocking might technically be better because it wastes a bit more bot time and they see it as "it doesn't exist" rather than an obsticle to try exploits on. Not sure if that is true though.

For me:

ssh server only with keys
absolutely no ssh forwarding, only available to local network via firewall rules
docker socket proxy for everything that needs socket access
drop non-used ports, limit IPs for local-only services (e.g. paperless)
crowdsec on traefik for the rest (sadly it blocks my VPN IPs also)
Authelia over everything that doesn't break the native apps (jellyfin and home assistant are the two that it breaks so far, and HA was very intermittent so I made a separate authelia rule and mobile DNS entry for slightly reduced rules)
proper umask rules on all docker directories (or as much as possible)
main drive FDE with a separate boot drive with FDE keyfile on a dongle that is removed except for updates and booting to make snatch-and-grabs useless and compromising bootloader impractical
full disk encryption with passworded data drives, so even if a smash and grab happens when I leave the dongle in, the sensitive data is still encrypted and the keys aren't in memory (makes a startup script with a password needed, so no automated startups for me)

For more info, I followed a lot of stuff on: https://github.com/...

save

path: 0 16180747 16184526, hotness: undefined, score: 8, children: 0

szszl 3 points a year ago

Caddy or any other (reputable) reverse proxy. I think Nginx Proxy Manager would be best for beginner thanks to GUI.

save

path: 0 16180747 16212984, hotness: undefined, score: 3, children: 0

RelativeArea1 1 point a year ago

save

path: 0 16180747 16184201, hotness: undefined, score: 1, children: 0