As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

Kata1yst
link
fedilink
106M

Really all I do is setup fail2ban on my very few external services, and then put all other access behind wireguard.

Logs are clean, I’m happy.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
36M

Standard and well-tested setup. Thanks for your reply!

My most paranoid config is disabling Ipv4

That’s it. If someone wants to attack me, they will need to adopt IPv6!

@thantik@lemmy.world
link
fedilink
English
15
edit-2
6M

I’ve replaced reconnaissance commands (a handful of them found here: https://www.cybrary.it/blog/linux-commands-used-attackers) – whoami, uname, id, uptime, last, etc

With shell scripts which run the command but also send me a notification via pushover. I’m running several internet-facing services, and the moment those get run because someone is doing some sleuthing inside the machine, I get notified.

It doesn’t stop people getting in, I’ve set up other things for that – but on the off chance that there is some zero-day that I don’t know about yet, or they’ve traversed the network laterally somehow, the moment they run one of those commands, I know to kill-switch the entire thing.

The thing is, security is an on-going process. Leave any computer attached to the internet long enough and it’ll be gotten into. I don’t trust being able to know every method that can be used, so I use this as a backup.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
46M

That’s a very good idea. Something to think about, especially if you have open ports and are paranoid enough (aren’t we all? Hehe). Thanks

Nice try, attacker trying to get me to do their reconnaissance work for them. I’m on to you.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
106M

It would be funny if that were the case. I was just hoping to be a little more paranoid from you lot and maybe improve on the things I’ve thought about

Yeah, just having a little fun in the role of a paranoid admin. My setup isn’t worth mentioning since it fits my threat model (i.e. nobody gives a shit about my network, just don’t be the low hanging fruit) but I’m interested in other replies. Hope you get some useful responses here.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
46M

I’d love to play paranoid admin over my network. Thanks!

@hakunawazo@lemmy.world
link
fedilink
English
3
edit-2
6M

No, honestly I’m not an attacker, but your local bank. We just need your help to update our systems. Please provide us the following credentials to continue using our phish- *ugh* services.

Credit card number: _____________
CVV: ___
Expiration date: ______

dr_robot
link
fedilink
106M

Logcheck. It took ages to make sure innocent logs are ignored, but now I get an email as soon as anything non-routine happens on my servers. I get emails with logs from every update, every time I log in, etc. This has given me the most confidence that nothing unexpected is happening on my servers. Of course, one needs to make sure that the firewall is configured well, and that you use ssh keys etc., but logcheck is how I know I’m doing enough.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
4
edit-2
6M

Very nice idea, and it’s quite simple too. Thanks

@JoeKrogan@lemmy.world
link
fedilink
English
2
edit-2
6M

Only remote access by wireguard and ssh on non standard port with key based access.

Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns

Logs are encrypted and mailed off site daily

System updates over tor connecting to onion repos.

Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.

Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.

I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.

Linux only on the main network.

I also make sure to backup often.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
26M

System updates over tor connecting to onion repos.

How does this help, assuming your DNS isn’t being spoofed?

@JoeKrogan@lemmy.world
link
fedilink
English
16M

Please see my reply below with links.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
26M

Thanks, never thought of that before. I’ll certainly try it, great way to help the network!

I am clearly not paranoid enough. For a while I was running an open source router inline between the network AP and the fiber to Ethernet box and running nids but the goddamn thing kept crapping out every few days so i took it back out until I can find a more stable solution.

I have plans if I can ever get around to it. I want the smart TV, printer and other shitty things on a separate network from the more trusted devices. I don’t know how yet but I would like to set up 802.1X for the trusted stuff.

@JoeKrogan@lemmy.world
link
fedilink
English
16M

You could not connect the TV and printer to the network but instead attach them to raspberry Pi or similar devices. This allows you full control and stops them calling home and spying.

Following for my own edification!

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
36M

Hope I get a lot of good answers!

@chayleaf@lemmy.ml
link
fedilink
English
4
edit-2
6M
  • full disk encryption on everything except the router (no point in encrypting the router)
    • the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
      • obviously, the SSH keys are different, so the server has a different IP in initrd. That said, I still don’t have any protection against malicious modification of initrd or UEFI
  • the server scans all new SSL certificates in realtime using certspotter and notifies me of any new certificates issued for my domains that it doesn’t know about (I use Cloudflare so it triggers relatively often, but I still do checks on who the issuer is)
  • firewall blocks outgoing 25 so nobody can impersonate my mailserver
@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
15M

Thanks, I’d like to know more about your public-facing setup using cloudflare

@chayleaf@lemmy.ml
link
fedilink
English
15M

there’s not much to know about it, I use Cloudflare simply because its routing is better than direct IP connections for many places on Earth. I can’t fully use Cloudflare anyway because I host many non-web services.

@refreeze@lemmy.world
link
fedilink
English
15M

You might be interested in setting up network bound encryption via Clevis and Tang. I use a hidden pi zero in my house acting as a Tang server. It’s great being able to reboot any of my encrypted servers without having to manually unlock disks.

@tapdattl@lemmy.world
link
fedilink
English
25M

Do you recommend any resources about this? I’d be interested in learning how to implement this.

@refreeze@lemmy.world
link
fedilink
English
25M

I’m using the recently merged Clevis module for NixOS. There was a recent talk at FOSDEM about it.

@chayleaf@lemmy.ml
link
fedilink
English
15M

I know about it, but it kinda defeats the purpose (the purpose being police raid protection)

@easeKItMAn@lemmy.world
link
fedilink
English
36M

I’m somewhat paranoid therefore running several isolated servers. And it’s still not bulletproof and will never be!

  • only the isolated server, ie. no internet access, can fetch data from the other servers but not vice versa.
  • SSH access key based only
  • Firewall dropping all but non-standard ports on dedicated subnets
  • Fail2ban drops after 2 attempts
  • Password length min 24 characters, 2FA, password rotation every 6 months
  • Guest network for friends, can’t access any internal subnet
  • Reverse proxy (https;443 port only)
  • Any service is accessed by a non-privileged user
  • Isolated docker services/databases and dedicated docker networks
  • every drive + system Luks-encrypted w/ passphrase only
  • Dedicated server for home automation only
  • Dedicated server for docker services and reverse proxy only
  • Isolated data/backup server sharing data to a tv box and audio system without network access via nfs
  • Offsite data/backup server via SSH tunnel hosted by a friend
@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
16M

Would you have to compromise on your security according to your threat model if you ran VMs rather than dedicated devices? I’m no security engineer and I don’t know if KVM/QEMU can fit everyones needs, but AWS uses XCP-ng, and unless they’re using a custom version of it, all changes are pushed upstream. I’d definitely trust AWS’ underlying virtualisation layer for my VMs, but I wonder if I should go with XCP or KVM or bhyve.

This is my personal opinion, but podman’s networking seems less difficult to understand than Docker. Docker was a pain the first time I was reading about the networking in it.

Really like your setup. Do you have any plans to make it more private/secure?

@easeKItMAn@lemmy.world
link
fedilink
English
0
edit-2
5M

I used VMs some time ago but never managed to look deeper into separation of bare metal vs VMs. Hence I can’t assess this reasonably.
Docker got me interested when it started and after discovering its networking capabilities I never looked back.
Basically I’m trying to minimize the possibility that by intercepting one dockerized service the attacker is able to start interacting with all devices. And I have lots of devices because of a fully automated house. ;) My paranoia will ensure the constant growth of privacy and security :)

Presi300
link
fedilink
English
1
edit-2
6M

Mine’s pretty simple, I have a “don’t open ports until ABSOLUTELY NECESSARY” policy, wireguard works well enough for everything else I need to access remotely. I also keep SSH disabled on any machine that has direct access to the internet.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
16M

Do you use a KVM to interact with machines that can access the Internet?

Presi300
link
fedilink
English
16M

No, as it’s just my main desktop, my laptop and an isolated PiHole VM

@Dehydrated@lemmy.world
link
fedilink
English
36M
  • Custom Router/Firewall running OPNsense and the Sensei plugin
  • Extensive DNS filtering through Pihole
  • Redirecting all DNS requests to my Pihole through OPNsense
  • My entire network is behind a multi hop VPN
  • I don’t let any Windows systems connect to the internet, instead, I have a Linux server which is connected to the internet (through a VPN of course) and runs a browser, and I use X2go to access the browser which is running on the Linux server
@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
46M

Since you’re running x86 for your router, do you actively prevent ME from trying to connect to the Internet?

@Dehydrated@lemmy.world
link
fedilink
English
16M

I am aware of the ME, but I can’t really do anything about it. Current ARM SBCs are not suitable for a router/firewall (at least in my experience). I’m not that concerned about it though.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
26M

OpenWRT isn’t half bad for usual “router stuff”, but advanced usage is a bit hard to do. Of course, that doesn’t eliminate the problem since ARM can have plenty of backdoors too

@Dehydrated@lemmy.world
link
fedilink
English
16M

I know, I tried OpenWRT on a Pi, but the experience wasn’t great (at least not as a home router).

@hperrin@lemmy.world
link
fedilink
English
2
edit-2
6M

I have Nginx Proxy Manager set up to let me access services running HTTP on other ports on the machine with a local network only access list just so my traffic even in my own network will use TLS. The likelihood that anyone is sniffing traffic on my own network is extremely small, but I’m paranoid. (Can’t let anyone see that I’m running Ubuntu Server. How embarrassing.)

@Treczoks@lemmy.world
link
fedilink
English
36M

I’ve got systems that can detect suspicious activities in the net, which result in a shutdown of the router. And not like “could you please shut down” but a hard power off type of shutdown.

@MigratingtoLemmy@lemmy.world
creator
link
fedilink
English
36M

Oh, you have a setup that signals to your power source to shut off internet when it detects an anomaly on the internet? That’s quite specific, and I’m having trouble trying to understand the use-case here, but it’s definitely included in the paranoid-list. Thanks!

@lntl@lemmy.ml
link
fedilink
English
16M

npftables blocks all incoming except a particular set of ips. any connections from those ips hit pubkey authentication.

I’ve never had a problem

Create a post

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.

Rules:

  1. Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

  • 1 user online
  • 12 users / day
  • 73 users / week
  • 195 users / month
  • 994 users / 6 months
  • 1 subscriber
  • 1.33K Posts
  • 7.59K Comments
  • Modlog