Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
Use authelia for 2fa
Disable root ssh
Disable password authentication for ssh. Keys only.
Set up Fail2ban
That's about all that's left; 2fa and brute force protection. Good job.
Sub fail2ban for wazuh. It does the same but so much more, and does everything with 0 config after fresh install.
And move SSH to a non-default port. Without that, my public-facing servers get thousands of SSH attacks a day, and it basically goes to zero after moving it to a random-looking high port.
Also, totally agree with using public key login and disable password login.
That's generally good advice but not actually security related.
Removing all the stress on your ressources by using a non-standard port is good for your ressources, But those automated scanners looking for unsecured devices and trying out password like admin/admin are not actually a risk. It's just a case of security by obscurity and never actually serves its purpose.
Very true. There are only ~65K ports. If someone decides they want to, trying all of them to see which one gives a valid response is trivial.
Literally a single nmap command will tell me where you "hid" your ssh port.
Like the poster you're responding to said, it is good advice but not for security. It takes you off the hacker spam list, essentially.
Rereading this it sounds like I am disagreeing with you sorry. Just trying to reiterate your point.
OpenSSH rate limits authentication attempts so it isn't a big deal. My public VPS gets pounded but it doesn't matter as it doesn't really use any system resources.