Something tells me I need to update my security...
this post was submitted on 27 Jun 2023
14 points (81.8% liked)
Selfhosted
50575 readers
373 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
How many of you actually disable root and password based login, change the default SSH port, and setup fail2ban?
I just don't put SSH on the internet at all.
This is 100% the way to go. I spun up a new server for a public-facing site on my VPS and I wondered if I really needed fail2ban. Within ten minutes of setting it up it had already blocked four people.
Don’t open port 22 if you can help it. Use it on your local network and VPN in if you need to use it offsite.
This is actually solid advice to quell any worries
Is fail2ban not enough?
There's no reason to allow root login, it's asking for trouble. Password based login is even worse. Changing the SSH port just makes it harder for the drive-by bots trying the whole IPv4 range
That is part of my bootstrap ansible playbook, which in addition to create user, setting key, etc., will definitely disable root and password login, enable max tries and setup f2b. I am not necessarily afraid of exposing ssh to the internet (it is a service designed for it), but I drastically reduce the risk this way. I am thinking of also changing port to simply get less logs.