Maybe I’m using the wrong terms, but what I’m wondering is if people are running services at home that they’ve made accessible from the internet. I.e. not open to the public, only so that they can use their own services from anywhere.

I’m paranoid a f when it comes to our home server, and even as a fairly experienced Linux user and programmer I don’t trust myself when it comes to computer security. However, it would be very convenient if my wife and I could access our self-hosted services when away from home. Or perhaps even make an album public and share a link with a few friends (e.g. Nextcloud, but I haven’t set that up yet).

Currently all our services run in docker containers, with separate user accounts, but I wouldn’t trust that to be 100% safe. Is there some kind of idiot proof way to expose one of the services to the internet without risking the integrity of the whole server in case it somehow gets compromised?

How are the rest of you reasoning about security? Renting a VPS for anything exposed? Using some kind of VPN to connect your phones to home network? Would you trust something like Nextcloud over HTTPS to never get hacked?

    • Aiden@lemmy.blahaj.zone
      link
      fedilink
      arrow-up
      6
      arrow-down
      1
      ·
      1 year ago

      For lots of things I self host that I wanna expose, I’ll just open a random port like 6952 and then reverse proxy w/ nginx on my web server. Not sure how secure it is, but it works

      • cestvrai@lemm.ee
        link
        fedilink
        English
        arrow-up
        9
        ·
        1 year ago

        Ports are probed and scanned constantly so a random port doesn’t make so much difference. I would use a strict firewall with the server IP whitelisted.

        • fuckwit_mcbumcrumble@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Ever since I moved to a ridiculously high port I haven’t had any access attempts on my server. 6952 won’t do shit, but if you’re between 40000 and 65000 you probably won’t get anything.

          • Retiring@lemmy.ml
            link
            fedilink
            English
            arrow-up
            16
            ·
            1 year ago

            That’s security through obscurity and one should never rely on this strategy alone

            • fuckwit_mcbumcrumble@lemmy.world
              link
              fedilink
              English
              arrow-up
              7
              ·
              1 year ago

              If it’s your only form of security then it’s bad. But if it’s on combination with other measures then it’s a good thing.

              I wouldn’t let anyone who hits my ip/port directly into my openvpn. But not having china and russia bomboarding me with requests is nice.

        • Dandroid@dandroid.app
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          1 year ago

          Can they see what you are hosting on that port, though? Like say I want to open ssh to my server from the internet (I don’t do this and I wouldn’t unless it was temporary), but I don’t want to open it on port 22 because that’s too obvious. Are there bots that just try every protocol until they find one that your server responds to? Or is there a way to dig up information on what is being exposed behind that port?

      • HousePanther@lemmy.goblackcat.com
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        You could use a VPS as a proxy and set up a VPN tunnel between the home server and the VPS to avoid port forwarding altogether. I do this for my mastodon and lemmy instances. My home server is of course behind NAT but there’s no need for any kind of port forwarding. I should know because I have none configured.