Maybe I’m using the wrong terms, but what I’m wondering is if people are running services at home that they’ve made accessible from the internet. I.e. not open to the public, only so that they can use their own services from anywhere.

I’m paranoid a f when it comes to our home server, and even as a fairly experienced Linux user and programmer I don’t trust myself when it comes to computer security. However, it would be very convenient if my wife and I could access our self-hosted services when away from home. Or perhaps even make an album public and share a link with a few friends (e.g. Nextcloud, but I haven’t set that up yet).

Currently all our services run in docker containers, with separate user accounts, but I wouldn’t trust that to be 100% safe. Is there some kind of idiot proof way to expose one of the services to the internet without risking the integrity of the whole server in case it somehow gets compromised?

How are the rest of you reasoning about security? Renting a VPS for anything exposed? Using some kind of VPN to connect your phones to home network? Would you trust something like Nextcloud over HTTPS to never get hacked?

  • effingjoe@kbin.social
    link
    fedilink
    arrow-up
    56
    ·
    edit-2
    1 year ago

    I think many of us are using reverse proxies, and opening port 443 (https) and maybe port 80 (http).

      • Aiden@lemmy.blahaj.zone
        link
        fedilink
        arrow-up
        6
        arrow-down
        1
        ·
        1 year ago

        For lots of things I self host that I wanna expose, I’ll just open a random port like 6952 and then reverse proxy w/ nginx on my web server. Not sure how secure it is, but it works

        • cestvrai@lemm.ee
          link
          fedilink
          English
          arrow-up
          9
          ·
          1 year ago

          Ports are probed and scanned constantly so a random port doesn’t make so much difference. I would use a strict firewall with the server IP whitelisted.

          • fuckwit_mcbumcrumble@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            Ever since I moved to a ridiculously high port I haven’t had any access attempts on my server. 6952 won’t do shit, but if you’re between 40000 and 65000 you probably won’t get anything.

            • Retiring@lemmy.ml
              link
              fedilink
              English
              arrow-up
              16
              ·
              1 year ago

              That’s security through obscurity and one should never rely on this strategy alone

              • fuckwit_mcbumcrumble@lemmy.world
                link
                fedilink
                English
                arrow-up
                7
                ·
                1 year ago

                If it’s your only form of security then it’s bad. But if it’s on combination with other measures then it’s a good thing.

                I wouldn’t let anyone who hits my ip/port directly into my openvpn. But not having china and russia bomboarding me with requests is nice.

          • Dandroid@dandroid.app
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            1 year ago

            Can they see what you are hosting on that port, though? Like say I want to open ssh to my server from the internet (I don’t do this and I wouldn’t unless it was temporary), but I don’t want to open it on port 22 because that’s too obvious. Are there bots that just try every protocol until they find one that your server responds to? Or is there a way to dig up information on what is being exposed behind that port?

        • HousePanther@lemmy.goblackcat.com
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          You could use a VPS as a proxy and set up a VPN tunnel between the home server and the VPS to avoid port forwarding altogether. I do this for my mastodon and lemmy instances. My home server is of course behind NAT but there’s no need for any kind of port forwarding. I should know because I have none configured.