Software Engineer & DevOps Architect. Mbin creator/maintainer.

I host many server instances and websites. To cover all the costs, please donate me. Thank you!

Homepage • Mastodon • Matrix • Telegram • Donate me

Ps. No the photo is not from my holiday, I just wish it.

  • 0 Posts
  • 31 Comments
Joined 3 years ago
Cake day: June 20th, 2023
  • melroy@kbin.melroy.orgtoSelfhosted@lemmy.world•Using Fail2ban to protect exposed services
    14·
    10 months ago

    Yes, I run many services and website on the public web from my homelab. Harden your server first. Like disabling root ssh login.

    Also enable auto updates on your server. Use your router/server to block some counties using geoip (especially if those services are meant for only a couple of people within your county maybe?). You could also use block lists, there any many bad ip lists out there.

    Configure rate limits in Nginx.

    You also mentioned fail2ban. You can define many rules and actions. Like blocking ips that might go over your previously defined rate limits. Or 4xx action for ips that request a lot of non existing pages (404 errors) .

    Also captcha won’t cut it anymore today. Try https://github.com/TecharoHQ/anubis

    Of course expose only what you want to expose, so only open ports in your firewall you really want to open. Ideally put everything behind a reverse proxy like Nginx.

    Let’s start with all of the things mentioned above. Ping me later if want to know more or have questions.

  • melroy@kbin.melroy.orgtoSelfhosted@lemmy.world•Do you actually audit open source projects you download?
    7·
    1 year ago

    Yes. It’s important to verify the dependencies and perform audits like automated scans on the source code and packages from repositories like PyPi and npm. Which is done on my day job.

    Also before mirroring data, I look at the source code level if I see anything suspicious. Like phoning home or for example obfuscated code. Or other red flags.

    Even at home, working on ‘hobby projects’, I might not have the advantage of the advance scanning source code tools, but I’m still suspicious, since I know there is also a lot of sh*t out there.

    Even for home projects I limit the amount of packages I use. I tent to only use large (in terms of users), proven (lot of stars and already out for a long time) and well maintained packages (regular security updates, etc.). Then again, without any advance code scanning tool it’s impossible to fully scan it all. Since you still have dependencies on dependencies with dependencies that might have a vurnability. Or even things as simple as openssl heartbleed bug or repository take overs by evil maintainers. It’s inevitable, but you can take precautions.

    Tldr: I try my best with the tools I have. I can’t do more then that. Simple and small projects in C is easier to audit then for example a huge framework or packages with tons of new dependencies. Especially in languages like Python, Go and Javascript/typescript. You have been warned.

    Edit: this also means you will need to update your packages often. Not only on your distro. But also when using these packages with npm and PyPi, go or php composer. Just writing your code once and deploy is not sufficient anymore. The chances you are using some packages that are vulnerable is very high and you will need to regularly update your packages. I think updating is just as important as auditing.