2
- It's educational for those who have a lust for learning.
- It's fun.
- It's far more private than using commercial cloud services.
(mostly illegal sports streaming sites)
This doesn't accomplish what the legislature intends. It never does. For instance, in the US, Texas in all their wisdom that can't keep an electrical grid running smooth without duct tape and bailing wire, has decided to 'ban' PornHub. It makes all the christofascist's dicks hard because in their mind, they have rooted out evil and destroyed it. (See Satanic Panic in the 80s) However, their weak, little minds cannot comprehend the fact that for every technology, there exists an equal, yet undoing technology.
Do it for the children I hear them say, and I would agree in this example, that children should not be viewing porn. A better solution would be to make parents actually parent. You brought a service into your home that can be both highly detrimental and highly beneficial, and then you turn around give it all, including a cel phone, to a very inquisitive mind uninhibited, unmonitored, and uncontrolled in any manner. You're the problem, not porn.
/end soapbox
15
Verifying & Validating a Docker Container
(lemmy.world)
So, this has always bugged me. How do you validate a Docker container? No one wants to pull a laced up container, so there has to be a way one can check. Of course, sticking to original docker containers from Docker Hub would be one method I suppose. Is there some kind of scan one can do? I do this on my Windows computer; scan before installing. Besides looking at code that I would have no idea what is going on, what protocols do you guys use?
5
Secrets Management
(lemmy.world)
Lately, I've been thinking of implementing a secrets management system such as Infiscal, etc. Does anyone use this or something similar like Hashicorp?
How hard would it be to deploy on a pre-existing set up? How does that work? Do you call the required secret in your Docker compose? What makes a secret manager more secure than pulling secrets from an .env file?
Which secret manager is the most popular/better among selfhosters?
3
Logwatch
(lemmy.world)
In looking for an app to view logs that doesn't require a lot of overhead, I stumbled upon Logwatch. After running it through it's paces, it seems to be pretty capable from docker, fail2ban, to sys logs.
I got to wondering if there are other such log viewers I could try that are in the same genre. Logwatch doesn't greate pretty graphics and dialed out dashboards, but it's fairly quick, I can view from a range of dates and times, and a variety of logs.
I checked out GoAcces, but it seemed geared towards web related logs like webpage hits, etc. With other options requiring elastisearch, databases, etc, they just seemed heavy for my application.
Anyone have any suggestions. So far, Logwatch does what it says on the tin, but I'm curious what others have tried or still use.
ETA: Thanks all for the recommends. I'm still going over a couple of them, but lnav seems like what I'm looking for.
It would be embarrasing if I disclosed all the weird ways I have 'mounted' SSD / HDD in a case before. LOL
Pi-Hole always tops my list as a cool project that has definite benefits and will still be in service after the new wears off. It's been quite a while ago, but I built an Alexa with an RPI. That was kind of cool. Home Assistant on an RPI is pretty cool. In fact, there is a whole list of cool stuff to do with an RPI: https://pimylifeup.com/category/projects/ . There's also an Awesome list for the RPI: https://github.com/thibmaek/awesome-raspberry-pi.
As you probably know the crowdsec bouncer doesn't directly parse logs or do checks like F2B filters. It queries the crowdsec LAPI for decisions and applies them. The “allowed” or “whitelisted” IP logic is handled at the Security Engine or LAPI level, not by the bouncer itself.
You can whitelist an ip in /etc/crowdsec/whitelists.yaml or even whitelist decisions in the whitelist.yaml as such:
name: private-ips
description: Whitelist local and private IPs
whitelist:
reason: "Allow local and private IPs"
ip:
- "127.0.0.1"
- "192.168.1.0/24"
cidr:
- "10.0.0.0/8"
Then issue sudo systemctl reload crowdsec. Kind of the same concept as F2B's ignoreip option. If you are using Tailscale to administer the server, then it's easier to whitelist. IIRC, you can use cscli decisions add --type whitelist --ip 192.168.1.100 --duration 1y but it doesn't add them to the whitelist.yaml. Instead it keeps them in crowdsec's database managed by LAPI. To undo: cscli decisions delete --ip 192.168.1.100 --type whitelist
https://docs.crowdsec.net/u/getting_started/post_installation/whitelists/
Anyway, what I wanted to know is why do people self host?
Wow. That's a whole separate thread on it's on. I selfhost a lot of my services because I am a staunch privacy advocate, and I really have a problem with corporations using my data to further bolster their profit margins without giving me due compensation. I also self host because I love to tinker and learn. The learning aspect is something I really get in to. At my age it is good to keep the brain active and so I self host, create bonsai, garden, etc. I've always been into technology from the early days of thumbing through Pop Sci and Pop Mech magazines, which evolved into thumbing through Byte mags.
She sure has a lot of domains tho. That's not that unusual, just notable. I hope she finds inner peace.
Dude. Awesome blog.
Ok my brother, I'm back with great news. It is as easy as everyone in this thread has said it was. Honestly, it wasn't the set up that I was concerned with. My question was more concerned with any additional security considerations I may have to deploy before setting Tailscale up as an exit node and thus using it as a traditional VPN.
First, I am going to assume you already have Tailscale deployed on your server & laptop or desktop. That's going to make it a lot easier....hurr hurr.
So fire up your terminal and point it at your server. You can run sudo tailscale status to check the current status of Tailscale. After which you will need to issue this command: tailscale up --advertise-exit-node. This does what it says and tells Tailscale to use the current server as an exit node.
Having done that, in the Tailscale console online click the [Machines] tab. Click the [...] option at the far right of your server listing and select [Edit Route Settings]. This brings up a dialogue box. Check [Use As Exit Node].
Assuming a Windows laptop/desktop, click the Tailscale tray icon. You should see your server listed under [Recommended]. Choose that one.
You should now be connected to the server exit node. Check your IP Check your speed. Not too shabby. Conduct a DNS Leak Check
There you go. Jack's a doughnut, Bob's your uncle. To put your server back, use sudo tailscale up --advertise-exit-node=false
Somebody fact check me. LOL
OP, here is what I do. It might seem overboard, and my way doesn't make it the best, or the most right, but it seems to work for me:
- Fail2ban
- UFW
- Reverse Proxy
- IPtraf (monitor)
- Lynis (Audit)
- OpenVas (Audit)
- Nessus (Audit)
- Non standard SSH port
- CrowdSec + Appsec
- No root logins
- SSH keys
- Tailscale
- RKHunter
The auditing packages, like Lynis, will scour your server, and make suggestions as to how to further harden your server. Crowdsec is very handy in that it covers a lot of 'stuff'. It's not the only WAF around. There is Wazuh, Bunkerweb, etc. Lots of other great comments here with great suggestions. I tend to go overboard on security because I do not like mopping up the mess after a breach.
ETA: just looked up one of your attackers:
218.92.0.201 was found in our database! This IP was reported 64,044 times. Confidence of Abuse is 100%: ISP CHINANET jiangsu province network Usage Type Fixed Line ISP ASN AS4134 Domain Name chinatelecom.cn Country China City Shanghai, Shanghai
busy little cunts.
- Fail2ban
- UFW
- Reverse Proxy
- IPtraf (monitor)
- Lynis (Audit)
- OpenVas (Audit)
- Nessus (Audit)
- Non standard SSH port
- CrowdSec + Appsec
- No root logins
- SSH keys
- Tailscale
- RKHunter
IMHO, security measures are necessary. I have a tendency to go a bit heavy on security because I really hate having to mop up after a breach. So the more layers I have, the better I feel. Most of the breaches I've experienced were not some dude in a smokey, dimly lit room, wearing a hoody, and clacking away at a keyboard, while confidently announcing 'I'm In!' or 'Enhance!'. Most are bots by the thousands. The bots are pretty sophisticated now days. They can scan vulnerabilities, attack surfaces, et al. They have an affinity for xmrig too, tho those are easy to spot when your server pegs all resources.
So, for the couple days investment of implementing a good, layered security defense, and then the time it takes to monitor such defenses, is worth it to me, and lets me sleep better. To each their own. Not only are breaches a pain in the ass, they have serious ramifications and can have legal consequences such as in a case where your server became a hapless zombie and was orchestrated to attack other servers. So, even on the selfhosted side of things, security measures are required, I would think.
It takes about 5 minutes to set up UFW which would be the absolute minimum, I would think.
view more: next ›
irmadlad
joined 2 months ago