this post was submitted on 25 Jun 2023
7 points (100.0% liked)

Selfhosted

40347 readers
398 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
7
Hosting securely at home (lemmy.world)
submitted 1 year ago* (last edited 1 year ago) by ThousandthStar@lemmy.world to c/selfhosted@lemmy.world
20 comments fedilink hide all child comments
 

Any guides on how to host at home? I'm always afraid that opening ports in my home router means taking the heavy risk of being hacked. Does using something like CloudFlare help? I am a complete beginner.

Edit: Thanks for all the great response! They are very helpful.

top 19 comments
sorted by: hot top controversial new old
[–] Invalid@kbin.social 4 points 1 year ago

Cloudflare yes. Even if you aren’t using tunnels it will help obfuscate your real ip. If you are hosting personal services you can also block access from countries you don’t expect to access them from.

Also it seems most bots scanning domains are checking www and the base domain url. I recommend pointing those at a vps or something like GitHub or substack if you don’t need it for something else.

Use a reverse proxy that 404s anything besides the subdomains you are actually using. Always use wildcard certs to avoid exposing subdomains and obfuscate your subdomains for common services to make them hard to guess.

Isolate your servers from the rest of your network with vlans if possible.

You will never be fully immune so all you can do is add more layers and roadblocks.

[–] terribleplan@lemmy.nrd.li 3 points 1 year ago* (last edited 1 year ago) (1 children)

There are ways to host things from home without opening ports in your router at all, this usually involves running something that calls/tunnels out of your network and back to some service and accepts incoming connections and sends them "baskward" over that connection. Cloudflare offers something called Tunnel, ngrok does something similar (though mainly aimed at development and not production hosting), and you can even host something yourself using something like frp (which is what I use, even for the Lemmy instance I am writing this from).

I haven't looked too closely at it, but there is an awesome-tunneling page someone put together that goes over these options and more.

Let me know if you want a bit more details on these options or specifics of how I've set up frp.

[–] Spezi@feddit.de 0 points 1 year ago* (last edited 1 year ago) (1 children)

Not OP and I don't have any specific questions right now, but if you got any general advice on frp you want to share, I'd be happy to read it :-)

Very basically, I set up a frps on the public server, and one frpc per service I want to have publicly accessible - where the frpc.ini defines all the specifics, so I don't have to touch the server regularly. Is that correct so far?

Edit: After typing it out, I came up with a question - what happens when the frpcs go offline? Will the server return an error, fallback, or just deny the connection?

[–] terribleplan@lemmy.nrd.li 2 points 1 year ago

Yeah, you're basically on the right track. I do a couple things in a possibly interesting way that you may find useful:

  1. I run multiple frpss on different servers. Haven't gotten around to setting up a LB in front or automatically removing them from DNS, but doing that sort of thing is the eventual plan. This means running as many frpcs as I have frpss. I also haven't gotten to the point of figuring out what to do if e.g. one service exposed via frps is healthy but another is not. It may make sense to run HAProxy in front of it or something... sounds terrible...
  2. I have multiple frpc.inis, they define all of the connection details for a particular frps then use includes = /conf.d/*.ini to load up whatever services that frpc exposes.
  3. I run frpc in docker and use volumes to manage e.g. putting the right frpc.ini and /conf.d/<service>.ini files in there.
  4. I use QUIC for the communication layer between frpc and frps using certificates for client authentication.
  5. I run my frpcs (one container per frps, I'm considering ways to combine them to make it less annoying to deploy) right alongside the service I am exposing remotely, so I run e.g. one for Traefik, one for ~~gogs~~ ~~gitea~~ forgejo ssh, etc. If you are using docker-compose I would put one (set of) frpc in that compose file to expose whatever services it has. Similar thought for k8s, I would do sidecar containers as part of your podspec.
  6. If I have more than one instance of a service, such as e.g. running multiple Traefik "ingress" stacks, I run a set of frpcs per deployment of that service.
  7. Where possible I use proxy protocol via proxy_protocol_version = v2 to easily preserve incoming IP address. Traefik supports this natively, which is the most important service to me as most of what I run connects over HTTP(s).
  8. I choose to terminate end-user SSL using Traefik within my homelab, so the full TLS session gets sent as a plain TCP stream. There is support for HTTPS within frp using plugin = https2http, but I like my setup better.

As to your question of "what happens when the frpcs go offline?", it depends on service type. I only use services of type = tcp and type = udp, so can't speak to anything beyond that with experience.

In the case of type = tcp your frps you can run multiple frpcs and the frps will load-balance to them, meaning if you run multiple you should get some level of HA because if one connection breaks it should just use the other, killing any still-open connections to the failed frpc. Same thought there as how e.g. cloudflared using their Tunnels feature makes two connections to two of their datacenters. If there is nothing to handle a particular TCP service on an frps I think the connection gets refused, it may even stop listening on the port, but I'm not sure of that.

Sadly in the case of type = udp the frps will only accept one frpc connection. I still run multiple frpcs, but those particular connections just fail and keep retrying until the "active" frpc for that udp service dies. I believe this means that if there is nothing to handle a particular UDP service on an frps it just drops the packets since there isn't really a "connection" to kill/refuse/reset, the same thing about stopping listening may apply here as well but I am also unsure in this case.

My wishlist for frp is, in no particular order:

  • frpc making multiple connections to a server
  • frpc being able to connect to multiple servers
  • Some sort of native ALPN handling in frps, and ability to use a custom ALPN protocol for frp traffic (so I can run client traffic and frp traffic on the same port)
  • frps support for loadbalancing to multiple UDP via some sort of session tracking, triple-based routing, or something else
  • frps support for clustering or something, so even if one frps didn't have a way to route a service it could talk to another frps nearby that did
    • or even support for tiering the idea of "locality", first it tries on the local machine, then it tries in the same zone/region/etc
  • It'd be super neat if there were a way to do something like Cloudflare's "Keyless SSL"

Overall I am pretty happy with frp, but it seems like it is trying to solve too much (e.g "secret" services, p2p, HTTP, TCP multiplexing). I would love to see something more focused purely TCP/UDP (and maybe TLS/QUIC) edge-ingress emerge and solve a narrower problem space even better. Maybe there is some sort of complex network-level solution with a VPN and routing daemons (BGP?) and firewall/NAT stuff that could do this better, but I really just want a tiny executable and/or container I can run on both ends and have things "just work".

[–] zebus@kbin.social 3 points 1 year ago

Tailscale, super easy install, sets up a VPN into your services, no port opening needed

[–] dustojnikhummer@lemmy.world 3 points 1 year ago

The most secure one would be not opening anything out, and using Tailscale to VPN into your home network.

If you want to open stuff, Cloudflare + letsEncrypt + good router/firewall will be a start.

[–] BrianTheeBiscuiteer@lemmy.world 2 points 1 year ago* (last edited 1 year ago)

Assuming you use Docker or some kind of container runtime I found a list of best practices: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

I misunderstood your post at first (my bad, not yours). Tailscale, ngrok, and other such services are a good first step. Locking down your runtime is the next.

[–] slashzero@hakbox.social 1 points 1 year ago

I think the safest option is to not host from your home network. If you aren’t up to date on security patches, you could potentially expose a lot of data from an insecure server running inside your network.

There are precautions you can take, like isolating any external facing servers from the rest of your network, for example, but I generally recommend using a hosted service instead.

[–] jadedctrl@sopuli.xyz 1 points 1 year ago* (last edited 1 year ago) (2 children)

From what I understand, opening a port isn’t a risk in and of itself — it’s only a risk if the software using the port is insecure! So long as you use reliable software and take care to configure things properly (following through with instructions from a site like ArchWiki or the official documentation helps), you’re good.

CloudFlare is more for DDOS protection, which you almost certainly don’t need . You could always set up DDOS protection later on, if the need ever arises.

[–] Tavesta@discuss.tchncs.de 1 points 1 year ago

Every single software is insecure. Generally servers should have their own networks sperated from your private network like an DMZ.

[–] i_am_not_a_robot@discuss.tchncs.de -1 points 1 year ago

Yeah, unless you're worried about people targeting your IP specifically, using a reverse proxy service seems like more complexity without more security. Not opening ports, and especially not opening well known ports, is just superstition. It just changes where somebody connects to the service without limiting access to or securing the service.

[–] x4740N@lemmy.world 1 points 1 year ago

One way to think of being secure is "how can this be abused"

Its a good way to think of how you can secure stuff

[–] midas@ymmel.nl 0 points 1 year ago* (last edited 1 year ago) (1 children)

First you've got to determine where threats can come from, then which surfaces are vulnerable and eventually the reach. In short what I mean:

SSH port (default 22) is high on the threat encounter level. Lots of bots try to scan every host they can find for an open SSH port. The risk is high because this is a doorway to your network. There's honestly no good reason to have port 22 open to your home. Get tailscale vpn. There are alternatives, I use tailscale, it's great.

When youre hosting apps, they can also be vulnerable. Keep them updated and you'll mostly be fine. There are levels of security. Super super secure is creating seperate networks for these apps so they can't access others. Bit much imo. Use non-rooted docker, enough of a sandbox.

In the end you're a small fish in a big pond, not saying you should be a cowboy but with a few decent measures you should be OK.

Tl;dr

  • don't open port 22
  • use a VPN (tailscale)
  • update apps
  • non-rooted docker
[–] iliketurtles@lemmy.world 1 points 1 year ago (1 children)

What's wrong with exposing port 22? I have password authentication disabled, ssh keys only. Isn't that secure enough?

[–] macgregor@lemmy.world 0 points 1 year ago (1 children)

I do as well on a non-standard port, although that doesn't really provide any extra security. I found ssh only login acceptably secure personally, but it's definitely less secure than tailscale which can operate with 0 open ports. The risk would be from os/sshd vulnerabilities that can be exploited. As long as you keep the router up to date it should be safe enough.

[–] easeKItMAn@lemmy.world 1 points 1 year ago* (last edited 1 year ago) (1 children)

Why would you expose SSH on a home production server?
Hosting several dockerized apps for friends since years. Only 80/443 proxy ports are open. Apps are secured with 2FA and monitored by fail2ban + kept up-to-date. Never had any issue.

[–] macgregor@lemmy.world 0 points 1 year ago (1 children)

It's for the chance that I need to administer my cluster when I am not on my LAN. I can set up a port forward to the externally accessible port and everything works as normal like I'm on my LAN. Non-default port, password auth disabled, ssh with root disabled (so you have to have my user and ssh key) and limited ssh connection attempts before ban. I can toggle it on or off with a check box on my router. Yes, I understand there are other ways that are even more secure, yes I understand the risks, but for my circumstances this was a good balance of convenience and security. I've also never had an issue :).

[–] easeKItMAn@lemmy.world 1 points 1 year ago

Add VPN and you made the best out of it :)

[–] passepartout@feddit.de -1 points 1 year ago* (last edited 1 year ago)

As an addition to the options the others have given you, you could achieve a really secure setup with a VPN either on your home router, or on a Raspberry pi / VM / Container / Whatever using e.g. PiVPN. You would have to open a port on your router and forward it to the PiVPN. When logging into the pivpn, your device will behave just like you're inside your home network (if you want it to). If you use wireguard and secure the machine with fail2ban you should be good. Wireguard uses UDP only, this means malicious packets coming to your VPN will simply be disregarded. This means the attacker won't see / recognise any open ports at all. I did the same in the past and configured my raspberry pi to check if my IP has changed (global IPv6, b.c. my ISP doesn't hand out native/routable IPv4 adresses) and then update a DNS entry pointing to my pi.

load more comments
view more: next ›