Minor security through obscurity thing you could implement: buy you own domain through cloudflare for ~$10/year. Use their proxy so that your public IP doesn’t resolve to your home public IP like it does now with DuckDNS. If you want to get fancy, you can also use their API with fail2ban to block connections after a predefined number of login failures.
this post was submitted on 29 Nov 2023
2 points (100.0% liked)
Self-Hosted Main
502 readers
1 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
- Service: Dropbox - Alternative: Nextcloud
- Service: Google Reader - Alternative: Tiny Tiny RSS
- Service: Blogger - Alternative: WordPress
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists
- Awesome-Selfhosted List of Software
- Awesome-Sysadmin List of Software
founded 1 year ago
MODERATORS
Go to public.cyber.mil and download the appropriate stigs for your stuff, review them, and apply the settings. Always a good start to improving the security.
I recommend you dont touch network_mode unless you absolutely need it
Most services shouldnt need the network_mode, just gotta port forward/translate most of the time
Audit-ssh and testssl.
Audit ssh shows all the algorithm in use and setting and shows then colored format like red bad and so on…
Same with testssl, which tls supported ? Https redirect ? What cipher suites etc … again all color coded.
Both available via homebrew for Mac.
If you use Mozilla recommended for ssh and ssl you should be fine
Frankly these are useless. SSH is secure by default and will never support algorithms that could be possibly broken. Same for TLS 1.3
yes, there are professional third party cybersecurity auditors you can hire, but I doubt anyone here would ever need them.
Please people, stop being paranoid about your security. close up all unnecessary ports, and that's what you can do on your end. whatever else, if the service binding to an open port has security vulnerabilities you don't know, the project team may very well be unaware of it either, and there's nothing you could do.
also, if you have multiple users using your service, then it's their password strength that you should be worrying the most, not your infrastructure.
Check Wazuh and Greenbone, but it requires a high learning curve so have fun learning the basics
Sounds very similar to my setup. All I would recommend is SSH through keys (and disable root login) and don’t put everything into the Docker network bridge. If you have containers that need a database or other container(s), make a network for those.
Obviously keep up to date with new updates. There are many services that can automatically notify you for updates like Watchtower. You can also set it up automatically update the container but it’s not always recommended in case of breaking changes.