85
How can I keep my forwarded port secure?
(kbin.earth)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Sep 2024
85 points (96.7% liked)
Selfhosted
62371 readers
1313 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
You cant. You can only do your best to make it as secure as possible, but given enough time, someone can break it.
Basic tips:
For ssh specifically, lock down your sshd config, make sure only key-based auth is enabled, and maybe as an extra step, create a dedicated user, and jail it by only allowing it access for the commands you need to interact with.
Mind expanding on tip #2?
Not sure I can expand on it a ton more in a way that will make sense if it already doesn't sound familiar.
Basically, there are various methods to authenticate yourself to most services. Password is usually the weakest and most succeptible to brute-force and social engineering. There's certificates, key pairs, RBAC...etc. You can even setup TOTP/MFA really easily for anything that supports it these days. Just don't leave a service hanging out on the Internet to get brute-forced by password though.
If you're unfamiliar with this, start with SSH and key pairs. It's probably the simplest intro and you can be up and running to try it out in seconds.
Got it, I’m aware password auth can be brute forced, sadly many services don’t support more advanced auth methods so I’ve got a couple homelab apps that can only do password auth. I’m using very strong passwords and 2FA where available, and have been looking into an SSO solution like Authentik, but again not all services are supported.