Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
First you've got to determine where threats can come from, then which surfaces are vulnerable and eventually the reach. In short what I mean:
SSH port (default 22) is high on the threat encounter level. Lots of bots try to scan every host they can find for an open SSH port. The risk is high because this is a doorway to your network. There's honestly no good reason to have port 22 open to your home. Get tailscale vpn. There are alternatives, I use tailscale, it's great.
When youre hosting apps, they can also be vulnerable. Keep them updated and you'll mostly be fine. There are levels of security. Super super secure is creating seperate networks for these apps so they can't access others. Bit much imo. Use non-rooted docker, enough of a sandbox.
In the end you're a small fish in a big pond, not saying you should be a cowboy but with a few decent measures you should be OK.
Tl;dr
What's wrong with exposing port 22? I have password authentication disabled, ssh keys only. Isn't that secure enough?
I do as well on a non-standard port, although that doesn't really provide any extra security. I found ssh only login acceptably secure personally, but it's definitely less secure than tailscale which can operate with 0 open ports. The risk would be from os/sshd vulnerabilities that can be exploited. As long as you keep the router up to date it should be safe enough.
Why would you expose SSH on a home production server?
Hosting several dockerized apps for friends since years. Only 80/443 proxy ports are open. Apps are secured with 2FA and monitored by fail2ban + kept up-to-date. Never had any issue.
It's for the chance that I need to administer my cluster when I am not on my LAN. I can set up a port forward to the externally accessible port and everything works as normal like I'm on my LAN. Non-default port, password auth disabled, ssh with root disabled (so you have to have my user and ssh key) and limited ssh connection attempts before ban. I can toggle it on or off with a check box on my router. Yes, I understand there are other ways that are even more secure, yes I understand the risks, but for my circumstances this was a good balance of convenience and security. I've also never had an issue :).
Add VPN and you made the best out of it :)
If I am trying to fix problems with my cluster or the baremetal hosts they are running on, I can't rely on the VPN access running on those nodes, which means I need dedicated reliable hardware acting as a bastion. Right now all I have for that is my router. Home routers have awkward limitations for installing and configuring software even if you are running better custom firmware like FreshTomato or OpenWRT, making them an edge case for "just" set up a VPN. Yes I played around with making it work. Yes, I could make it work if I sunk enough effort in to it, but again, I found it acceptably secure to simply enable remote ssh access.
I do suggest talescale all the time for most people though. It's cool tech, their blog is fantastic. I'm looking forward to having a proper network switch one day and I'll revisit the issue.