As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

  • JoeKrogan@lemmy.world
    link
    fedilink
    English
    arrow-up
    17
    arrow-down
    1
    ·
    edit-2
    4 months ago

    Only remote access by wireguard and ssh on non standard port with key based access.

    Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns

    Logs are encrypted and mailed off site daily

    System updates over tor connecting to onion repos.

    Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.

    Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.

    I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.

    Linux only on the main network.

    I also make sure to backup often.

    • constantokra@lemmy.one
      link
      fedilink
      English
      arrow-up
      8
      ·
      4 months ago

      Can you explain why you use onion repos? I’ve never heard of that, and I’ve heard of kind of a lot of things.

      • Semperverus@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        4 months ago

        If big corporations hoovering your data should be on everyone’s threat list, then yea, i’d say its a huge benefit.

      • JoeKrogan@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        4 months ago

        Well I dont trust closed source software and do what I can to avoid it when I can. At least foss can be audited. Also all the linux devices on the main network are devices I admin.

    • MigratingtoLemmy@lemmy.world
      cake
      OP
      link
      fedilink
      English
      arrow-up
      5
      ·
      4 months ago

      System updates over tor connecting to onion repos.

      How does this help, assuming your DNS isn’t being spoofed?

    • rekabis@lemmy.ca
      link
      fedilink
      English
      arrow-up
      2
      ·
      4 months ago

      Fail2ban bans after 1 attempt for a year.

      Fail2ban yes; one year, however, is IMO a bit excessive.

      Most ISP IP assignments do tend to linger - even with DHCP the same IP will be re-assigned to the same gateway router for quite a number of sequential times - but most IPs do eventually change within a few months. I personally use 3 months as a happy medium for any blacklist I run. Most dynamic IPs don’t last this long, almost all attackers will rotate through IPs pretty quickly anyhow, and if you run a public service (website, etc.), blocking for an entire year may inadvertently catch legitimate visitors.

      Plus, you also have to consider the load such a large blocklist will have on your system, if most entries no longer represent legitimate threat actors, you’ll only bog down your system by keeping them in there.

      Fail2ban can be configured to allow initial issues to cycle back out quicker, while blocking known repeat offenders for a much longer time period. This is useful in keeping block lists shorter and less resource-intensive to parse.

      • JoeKrogan@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        4 months ago

        My block list is very small actually due to the non standard ssh port. Everything else goes through wireguard.

        If it was open to the public then yes I’d have to reconsider the ban length.