• lch361@discuss.tchncs.deEnglish
    1·
    9 minutes ago

    Rootless LXC containers, TLS. In my case, I have both VPS and my own hardware, so every sensitive data is hosted on the hardware only.

  • K3CAN@lemmy.radioEnglish
    2·
    32 minutes ago

    If you’re talking about remote access specifically, I use tiers.

    “Public” is open, but goes through crowdsec and anubis, and is on a DMZ network. This is my website, blog, Fediverse, etc.

    “Private” is either secured with mtls or wireguard. This is stuff that’s only for me or family, like media or home assistant.

    “Sensitive” is wireguard only. This is infrastructure management, Paperless, etc.

  • zenforyen@feddit.orgEnglish
    4·
    13 hours ago

    Nothing to protect if you don’t expose it.

    Plain and simple - Wireguard.

    All services run as separate services user in rootless podman containers.

    Only one nginx exposed to the open internet acting as reverse proxy to stuff where Wireguard requirement would be too inconvenient to be useful (shared calendar).

  • Tiger_Man_@szmer.infoEnglish
    2·
    14 hours ago

    i try to keep it secure by minimalism because the less complicated is the software the smaller is the chance of a vulnerability

    so everything related to file transfer/access uses sftp (with accounts with no ssh permissions because: 1. i dont want the password to my server to be stored anywhere in some sftp software 2. im not the only user of this server) and for other services i just run a small local program and remote access it with ssh

    i guess the biggest secuity threat is someone physically stealing the backup disk or the main hard drive because theyre both unencrypted

      • fleem@piefed.zeromedia.vipEnglish
        7·
        22 hours ago

        like HOW ANNOYING is that shit these days? it is crazy how irked i get having to bring a monitor and keyboard over to the rack

        • Tiger_Man_@szmer.infoEnglish
          2·
          14 hours ago

          my only physical console option is composite video (its an rpi) connected to a crt (luckily the server is close to the crt so i dont have to move 16kg of leaded glass every time i want gui server access)

  • curbstickle_lw@lemmy.worldMEnglish
    5·
    21 hours ago

    Secure enough I suppose.

    f2b at the FW, auth with MFA for anything exposed, anything local only has restricted access at the FW level, with exposed (via proxy) and local-only (separate proxy) on different vlans. Each service is (typically, with some exceptions) an LXC, with additional rules and templated out based on use case. The few cases where docker is involved is local-only and that has its own vlan with additional rules.

  • grue@lemmy.worldEnglish
    57·
    1 day ago

    My stuff is only accessible from my LAN (because I haven’t figured out how to set up a tunnel or reverse proxy yet).

    • zebidiah@lemmy.caEnglish
      5·
      21 hours ago

      I’m in this boat too, my security is awful, bad practices everywhere, my solution: don’t let it go out in public…

      • Solrac@lemmy.worldEnglish
        52·
        18 hours ago

        Screw Tailscale, ZeroTier and specially cloudflare, all centralized, all with changable terms.

        Use a VPS, lowest spec but good bandwidth, and use Wireguard VPN for your VPS and homeserver, and nginx or caddy to make a Reverse Proxy

        • reddit_sux@lemmy.worldEnglish
          4·
          18 hours ago

          All agreed but not every homelabber can spend money for something that is not the main job or contributed to work. Tailscale for now works well enough for free.

          Cloudflare agreed is not something I would trust.

          • seang96@spgrn.comEnglish
            1·
            12 hours ago

            You can get some pretty cheap ones like sub $10/year. My current ones 2 cpu 3.5gb ram 64gb ssd for $33 a year.

            • CausticFlames@sopuli.xyzEnglish
              1·
              9 hours ago

              Where are you finding rates like that? Racknerds’ cheapest option is around that price but doesn’t even have 1 full gig of ram.

      • grue@lemmy.worldEnglish
        4·
        20 hours ago

        I’ve tried to use ZeroTier because Tailscale still has centralized servers for starting the connection, but had trouble getting it to work. Maybe I should stop letting the perfect be the enemy of the good.

        • lemmyvore@feddit.nlEnglish
          3·
          18 hours ago

          If you have good IPv6 connectivity both at home and away you can look into the Yggdrasil network. It facilitates node-to-node encrypted communications, but it’s decentralized and community-run. Unlike Tailscale, each node can do both communication and relay.

          You run the Y client on each device you want to use and if you want to keep things completely private (and you have at least one device that’s not behind CGNAT) you can only add your own devices as peers. If you need to bypass CGNAT you can use one of the community-supplied nodes to act as relays, or set up your own node on a VPS.

          The cool feature of Y is that if you’re trying to communicate between nodes A and B and there isn’t a single node that’s peered with both A and B, you can still communicate as long as there are nodes somewhere in the network that know them both. The network will search for you and calculate the optimal relay path. Ofc like I said this is irrelevant if you decide to stick to your own devices, basically you will have your own personal mini Y network completely separate from the main public network.

          Even when using the public network there’s no privacy issue, relay nodes cannot snoop on communications only facilitate the connection or not, and once relay to a node has been accomplished the nodes will communicate directly thanks to ICE+STUN, if possible, like Tailscale does.

          Please note that nodes are identified by 2001:: random addresses. While the 2001:: address space is huge it’s still only obscurity not security. You still need to have a decent firewall setup on each node, Y does not enforce ACLs or anything like that. It’s also up to you to set up DNS and anything else you might need.

  • tired_n_bored@lemmy.worldEnglish
    1·
    17 hours ago

    I have 3 subnets. One for me, one for family members and one for the publicly accessible services I expose. Each process has limited access to the file system, no root shell and even in the case someone gains full control of it they can’t reach other subnets. I use fail2ban too.

    For the “me” part, I connect through a VPN. I’d like to run rootless docker services tho, or by using Podman