Selfhosted

40183 readers

508 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

182

What are the most paranoid network/OS security measures you've implemented in your homelab? (lemmy.world)

submitted 9 months ago by [email protected] to c/[email protected]

132 comments fedilink hide all child comments

As the title says, I want to know the most paranoid security measures you've implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I'm wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 16 points 9 months ago* (last edited 9 months ago) (15 children)

Only remote access by wireguard and ssh on non standard port with key based access.

Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns

Logs are encrypted and mailed off site daily

System updates over tor connecting to onion repos.

Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.

Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.

I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.

Linux only on the main network.

I also make sure to backup often.

[–] [email protected] 8 points 9 months ago (2 children)

Can you explain why you use onion repos? I've never heard of that, and I've heard of kind of a lot of things.

[–] [email protected] 10 points 9 months ago* (last edited 9 months ago) (2 children)

Onion repositories are package repositories hosted on tor hidden services. The connection goes through six hops and is end to end encrypted. In addition to further legitimizing the tor network with normal everyday usage it has the benefit of hiding what packages have been installed on a system.

Here are some notes about them if you want to read more.

https://blog.torproject.org/debian-and-tor-services-available-onion-services/

https://www.whonix.org/wiki/Onionizing_Repositories

[–] [email protected] 2 points 9 months ago

That's pretty neat. I might start doing that, just for kicks.

[–] [email protected] 1 points 9 months ago

That is very interesting, thanks!

[–] [email protected] 7 points 9 months ago* (last edited 9 months ago)

With Debian it's just the apt-tor package, and the project maintains an official list at.. onion.debian.org iirc?
I don't know if serving onion traffic is more expensive for Debian/mirror maintainers so idk if this is something everybody should use

load more comments (12 replies)