Started off by

  1. Enabling unattended updates
  2. Enable only ssh login with key
  3. Create user with sudo privileges
  4. Disable root login
  5. Enable ufw with necessary ports
  6. Disable ping
  7. Change ssh default port 21 to something else.

Got the ideas from networkchuck

Did this on the proxmox host as well as all VMs.

Any suggestions?

  • Zerafiall@alien.topB
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago
    1. Don’t bother with disabling icmp. You’ll use it way more then it’s worth disabling, and something like nmap -Pn -p- X.X.X.0/24 will find all your servers anyways (same can be said for ssh and port 22. But moving that does stop some bots)

    2. As long as i go out not exposing anything the the global internet, you really don’t need a lot. The fire wall should already deny all inbound traffic.

    The next step is monitoring. It’s one thing to think your stuff is safe and locked down. It’s another thing to know your stuff is safe. Something like Observium, Nagios, Zabbix, or otherwise is a great way to make sure everything stays up, as well as having insights into what everything it doing. Even Uptime Kuma is a good test. Then something like Wazuh to watch for security events and OpenVAS or Nessus, to look holes. I’d even though in CrowdSec for host based virus detection. (Warning, this will quickly send you down the rabbit hole of being a SOC analyst for your own home)

    • Internet-of-cruft@alien.topB
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Block outbound traffic too.

      Open up just what you need.

      Segment internally and restrict access. You don’t need more than SSH to a Linux Server, or perhaps to it’s web interface for an application running on it.

    • NevarroGuildsman@alien.topB
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I just set up Wazuh at work and pointed it at a non-domain, vanilla Windows 11 machine to test and it came back with over 300 events immediately. Not trying to scare anyone off as I think it’s a great tool, more just a heads up that the rabbit hole runs very deep.

  • EugeneBelford1995@alien.topB
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    Honestly, between the home lab being behind a RTR, NATed, patched & updated, and given the lack of users clicking on random crap and plugging in thumb drives from God Only Knows Where … I’d go out on a limb and say it’s already more secure than most PCs.

    There’s also no data besides what I already put on Medium and GitHub, so it’s not a very attractive target.

  • sysadminafterdark@alien.topB
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    Take a look at CIS benchmarks and DoD STIGs. Many companies are starting to harden their infrastructure using these standards, depending on the requirements of the environment. Once you get the hang of it, then automate deployment. DO NOT blow in ALL of the rules at once. You WILL break shit. Every environment has security exceptions. If you’re running Active Directory, run Ping Castle and remediate any issues. Audit often, make sure everything is being monitored.

  • jmartin72@alien.topB
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    Don’t expose anything to the outside world. If you do, use something like Cloudflare tunnels or Tailscale.

    • umbrella@lemmy.ml
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      1 year ago

      Or host a VPN on it and get in through that. Many of these microservices are insecure, and the real risk comes from opening them up to the Internet. This is important.

      Also set permissions properly if applicable

  • tango_suckah@alien.topB
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    I watch networkchuck on occasion, but some of his ideas are… questionable I think. Not necessarily wrong, but not the “YOU MUST DO THIS” that his titles suggest (I get it, get clicks, no hate).

    Of the ideas you mentioned, (2), (3), (4), and (5) are somewhere between “reasonable” and “definitely”. The rest are either iffy (unattended updates) or security theater (disable ICMP, change ports).

    Something to keep in mind for step (2), securing SSH login with a key: this is only as secure as your key. If your own machine, or any machine or service that stores your key, is compromised then your entire network is compromised. Granted, this is kind of obvious, but just making it clear.

    As for security theater, specifically step (6). Don’t disable ping. It adds nothing to security and makes it harder to troubleshoot. If I am an attacker in a position for ping to get to an internal resource in the first place, then I’m just going to listen for ARP broadcasts (on same subnet) or let an internal router do it for me (“request timed out” == host is there but not responding).

  • tabortsenare@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Internet > Firewall, IP Whitelist, IPS/IDS yada yada> DMZ / VLAN > > Proxmox /w FW:$true (rule only for game ports) > GameServer > Deny all traffic from GameServer to go anywhere but internet

    Proxmox server has firewall, all the hosts on proxmox have firewall enabled (in proxmox). Only allow my main device to access. No VLAN crosstalk permitted.

    I don’t bother with anything else internally, if they’re inside they deserve to SSH with my default root / password credentials

  • mss-cyclist@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Unattended updates can be tricky.

    Think of config changes which need manual adjustment, or a broken update. This is something you would probably not like to happen at night without notice. Could easily break your vital systems (e.g. homeassistant, authentication, vaults…)

    • Daniel15@alien.topB
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      +1

      Use unattended updates ONLY for bug and security fixes, nor for minor or major releases. Ensure you configure your auto-updaters properly!

      Debian unattended-upgrades only upgrades packages from the main and security repos by default, so it should be fine since no major updates are performed within a particular Debian version.

  • gscjj@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    I use practical security measures that match my level of exposure and don’t severely limit my convienience.

    If your lab isn’t exposed directly to the internet, at the very least update your servers from time to time, use a string root (admin users as well) password. That’s more than enough.

    If your lab is exposed, the same applies but update more often. Use SSH keys.

    Don’t go overboard - the majority of security incidents are from lack of basic security

  • jjaAK3eG@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Hosted reverse proxy and VPN servers. I have no open ports on my home network.

  • LAKnerd@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Air gapped, no Internet access. I don’t use Internet services for any of my stuff though so I can get away without direct Internet access

  • Professional-Bug2305@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Don’t worry about it, no one wants to hack your plex server xD just don’t expose things directly to the internet and you’ll be fine.

  • wallacebrf@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago
    1. strict 3-2-1 backup policy
    2. VLANs. all VLANs are controlled by my Fortigate FWF-61E (soon to be replaced by a FG-91G). the VLANs have strict access permissions on a per-device basis on what they can and cannot access.
      1. CORE network where the NAS live
        1. only specific devices can access this VLAN, and most only have access to the SMB ports for data access. even fewer devices have access to the NAS management ports
        2. this network has restrictions on how is accesses the internet
        3. I have strict IPS, web-filtering, DNS filtering, network level fortigate AV, deep SSL inspection, and intrusion protection activities
        4. everything is logged, any and all incoming and outgoing connections both to/from the internet but also any LAN based local communications.
      2. Guest wifi
        1. can ONLY access the internet
        2. has very restrictive web and DNS filtering
        3. I have strict IPS, web-filtering, DNS filtering, network level fortigate AV, basic SSL inspection, and intrusion protection activities
      3. APC Network Management Cards
        1. can ONLY access my SMTP2GO email client so it can send email notifications
        2. it does have some access to the CORE network (NTP, SYSLOG, SNMP)
        3. very select few devices can access the management ports of these cards
        4. I have strict IPS, web-filtering, DNS filtering, network level fortigate AV, basic SSL inspection, and intrusion protection activities
      4. Ethernet Switch / WIFI-AP management
          1. very select few devices can access the management ports of the switches
        1. ZERO internet access allowed
      5. ROKUs
        1. restrictive web and DNS filtering to prevent ads and tracking. Love seeing the space where ads SHOULD be and seeing a blank box.
        2. can access ONLY the IP of my PLEX server on the CORE network, on ONLY the PLEX port for the services PLEX requires.
      6. IoT devices
        1. Internet access ONLY except for a few devices like my IoTaWatt that needs CORE network access to my NAS on ONLY the port required for InfluxDB logging.
      7. Wife’s computer
        1. because of HIPPA due to her job, i have ZERO logging, and no SSL inspection, but do have some web and DNS filtering.
      8. print server
        1. zero internet access, and only the machines that need to print can access.
    3. as already indicated i have a fortigate router which has next generation firewall abilities to protect my network
    4. while i do not have automatic updates i am notified when updates are available for my router, my NAS, the switches, and APC network cards. i always like to look at the release notes and ensure there are no known issues that can negatively impact my operations. I do have most of my docker containers auto-update using watchtower.
    5. i keep SSH disabled and only enable when i ACTUALLY need it, and when i do, i use certificate based authentication
    6. i have disabled the default admin account on ALL devices and made custom admin/root users but also have “normal” users and use those normal users for everything UNLESS i need to perform some kind of activity that requires root/admin rights.
    7. on all devices that have their own internal firewall, i have enabled it to only allow access from VLAN subnets that i allow, and go even further by restricting which IPs on those VLANS can access the device
    8. changing default ports is fairly useless in my opinion as once someone is on your network it is trivial to perform a port scan and find the new ports.
    9. all windows based endpoint machines
      1. have a strict endpoint control using fortigate’s fortiguard software with EMS server. this allows me to enforce that machines have minimum specifications,
      2. i use group policy to enforce restrictive user environments to prevent installation of programs, making system changes, accessing the C: drive etc as this prevents a decent amount of malware from executing
      3. antivirus must be enabled and active or the endpoint becomes quarantined.
      4. if the system has unusual behavior it is automatically quarantined and i am notified to take a look
      5. even though the fortigate router blocks all ads and trackers i also use a combination of UBlock Origin to prevent ads and trackers from running in the browser as ADs are now one of the most common points of entry for malware
      6. i use ESET antivirus which also performs and ties into the fortiguard endpoint protection to ensure everything on the machines is OK
    10. for all phones/tablets i have Adguard installed which blocks all ads and malicious web sites and tracking at the phones level

    this is not even all of it.

    the big take away is i try to layer things. the endpoint devices are most important to protect and monitor as those are the foot hold something needs to then move through the network.

    i then use network level protections to secure the remaining portions of the network from other portions of the network.

    • zR0B3ry2VAiH@alien.topB
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Replace Fortinet with Pfsense (+Suricatta/Snort) for non-propriety. (I have a Fortinet firewall and I can’t bring myself to pay for their packages). One thing I’d recommend for you, as I host a lot of stuff is DNS Proxy though cloudflare, so the services I’m hosting are not pointing to my origin IP.

      • wallacebrf@alien.topB
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        None of my services are available outside my house without first logging into the fortigate SSL VPN. That is the only open port I have.

        The SSL VPN uses a loopback interface so only IPs from the US can access it, and I have strong auto block enabled and I add IPs of systems that try brute forcing into the box so they get blocked

        I did forget to mention that I use cloud flair already for the exact reason you mentioned so my home IP is not used.

        I also have a domain name with valid wildcard certificate. The domain is used to access the SSL VPN and I also then use the cert within my entire homelab so I have everything encrypted

        I was not a fan of PF sense, the fortigate has more security features that I wanted

    • radiantxero@alien.topB
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Anything that has internet access like your IoT can be C&C utilizing stateful connections. An outbound socket is built, and reflected traffic can come back in. Your IoT devices especially should not be exposed to the internet. They can’t even have an antivirus agent installed on them.

      • wallacebrf@alien.topB
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        True, and 100% agree except I forgot to mention

        1.) The fortigate has a known list of botnet command and control servers that are blocked 2.) I only allow them to access their home server domain names for the only purpose of allowing for firmware updates. They are not capable of accessing any other domains or IPs

      • tango_suckah@alien.topB
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        They can’t even have an antivirus agent installed on them.

        That’s actually no longer true… kinda. You can’t install AV on them, but there are security companies filling the niche of embedded IoT security. Now, you won’t see this in your average consumer device, but on the commercial market there is a growing demand for some way to secure an embedded device from malicious software/firmware modifications.

        • radiantxero@alien.topB
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          You can SPAN internal traffic to an IDS device currently. Or, if internal network throughput isn’t an issue, you can force east-west traffic through an IPS with DPI enabled instead.

          That’s historically how east-west would be mediated within an enterprise environment for devices incapable of being secured with agents.

          • tango_suckah@alien.topB
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            That’s historically how east-west would be mediated within an enterprise environment for devices incapable of being secured with agents.

            Absolutely, and I’ve implemented similar east-west controls (as either prevent-first or for detection). You’ll get no argument from me on that. I’m just noting an interesting trend as IoT devices become more ubiquitous in commercial and industrial environments, and some of those devices must (for whatever reason) have access to some part of the network or internet.

  • murdaBot@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Don’t expose unnecessary things to the internet, keep any client PCs patched, use some sort of malware protection … and that’s all you need to do.

    All these VLANs are such are just overkill unless you’re actively exposing things to the internet. They wind up breaking really useful stuff, especially stuff that relies on multicast.

    Besides, that Chinese IoT device can’t get hacked if it’s not open to the 'net in the first place.

  • lunakoa@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    My home lab and production network are separated by a firewall.

    I have backups and plans to rebuild my lab, I actually do it regularly.

    My labs do risky things, I get comfortable with those things before doing it in production.