Selfhosted

My security is fairly simplistic but I'm happy with it

• software protection

  • fail2ban with low warning hold
  • cert based login for ssh (no password Auth)
  • Honeypot on all common port numbers, which if pinged leads to a permanent IP ban
  • drop all firewall
  • PSAD for intrusion/scanning protection (so many Russian scanners... lol)
  • wireguard for VPN to access local virtual machines and resources
  • external VPN with nordVPN for secure containers (yes I know nord is questionable I plan to swap when my sub runs out)

• physical protection

  • luksCrypt on the sensitive Data/program Drive ( I know there's some security concerns with luksCrypt bite me)
  • grub and bios locked with password
  • UPS set to auto notify on power outage
  • router with keep alive warning system that pings my phone if the lab goes offline and provides fallback dns

• things I've thought about:

  • a mock recovery partition entry that will nuke the Luks headers on entry (to prevent potential exploit getting through grub)
  • removing super user access completely outside of local user access

Notifications on system file access

Notifications on root login/sudo

Declarative OS, tmpfs root, disabled sudo

Bastion server, but right now I don't have a proper router to do it at home

Yubikey, or a separate phone on Graphene OS for otp, keys, etc

Authelia + fascist fail2ban (or some CSF)

Most of these are pretty normal, but usually you don't do them all at once 😄 also, I don't really like hiding my services from the open internet, authelia is fine tuned to let people only access what they are supposed to. And regular users of my server usually don't notice that I even have it

One day I will setup my security onion, but I'm procrastinating

Air gapping? I keep a offline backup just in case.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

15 acronyms in this thread; the most compressed thread commented on today has 16 acronyms.

[Thread #493 for this sub, first seen 6th Feb 2024, 16:55] [FAQ] [Full list] [Contact] [Source code]

NAT 🥴

• Custom Router/Firewall running OPNsense and the Sensei plugin
• Extensive DNS filtering through Pihole
• Redirecting all DNS requests to my Pihole through OPNsense
• My entire network is behind a multi hop VPN
• I don't let any Windows systems connect to the internet, instead, I have a Linux server which is connected to the internet (through a VPN of course) and runs a browser, and I use X2go to access the browser which is running on the Linux server

Never used it "in anger" but:

I have my firewall plugged into a metered outlet (plugged into a UPS). I have it set up to send me alerts if power draw increases beyond a certain threshold. I've tested it and wireguard is measurable (yay) but so are DDOS attacks. If I get that alert, I can choose to turn off that plug and take my whole network offline until I get home and can sort that out.

Gotten a few false positives over the years but mostly that is just texting my partner to ask what they are doing.

Really all I do is setup fail2ban on my very few external services, and then put all other access behind wireguard.

Logs are clean, I'm happy.

I've replaced reconnaissance commands (a handful of them found here: https://www.cybrary.it/blog/linux-commands-used-attackers) -- whoami, uname, id, uptime, last, etc

With shell scripts which run the command but also send me a notification via pushover. I'm running several internet-facing services, and the moment those get run because someone is doing some sleuthing inside the machine, I get notified.

It doesn't stop people getting in, I've set up other things for that -- but on the off chance that there is some zero-day that I don't know about yet, or they've traversed the network laterally somehow, the moment they run one of those commands, I know to kill-switch the entire thing.

The thing is, security is an on-going process. Leave any computer attached to the internet long enough and it'll be gotten into. I don't trust being able to know every method that can be used, so I use this as a backup.

Logcheck. It took ages to make sure innocent logs are ignored, but now I get an email as soon as anything non-routine happens on my servers. I get emails with logs from every update, every time I log in, etc. This has given me the most confidence that nothing unexpected is happening on my servers. Of course, one needs to make sure that the firewall is configured well, and that you use ssh keys etc., but logcheck is how I know I'm doing enough.

Using SPA firewall knocking (fwknop) to open ports to ssh in. I suppose if I was really paranoid, the most secure would be an air gap, but there's only so much convenience I'll give up for security.

Nice try, attacker trying to get me to do their reconnaissance work for them. I'm on to you.

Following for my own edification!