Maybe I’m using the wrong terms, but what I’m wondering is if people are running services at home that they’ve made accessible from the internet. I.e. not open to the public, only so that they can use their own services from anywhere.

I’m paranoid a f when it comes to our home server, and even as a fairly experienced Linux user and programmer I don’t trust myself when it comes to computer security. However, it would be very convenient if my wife and I could access our self-hosted services when away from home. Or perhaps even make an album public and share a link with a few friends (e.g. Nextcloud, but I haven’t set that up yet).

Currently all our services run in docker containers, with separate user accounts, but I wouldn’t trust that to be 100% safe. Is there some kind of idiot proof way to expose one of the services to the internet without risking the integrity of the whole server in case it somehow gets compromised?

How are the rest of you reasoning about security? Renting a VPS for anything exposed? Using some kind of VPN to connect your phones to home network? Would you trust something like Nextcloud over HTTPS to never get hacked?

  • HousePanther
    link
    fedilink
    -31 year ago

    Port forwarding can be a recipe for disaster. I’d much rather make use of reverse proxying.

    • Aiden
      link
      fedilink
      51 year ago

      For lots of things I self host that I wanna expose, I’ll just open a random port like 6952 and then reverse proxy w/ nginx on my web server. Not sure how secure it is, but it works

      • @cestvrai@lemm.ee
        link
        fedilink
        English
        91 year ago

        Ports are probed and scanned constantly so a random port doesn’t make so much difference. I would use a strict firewall with the server IP whitelisted.

        • @fuckwit_mcbumcrumble@lemmy.world
          link
          fedilink
          English
          21 year ago

          Ever since I moved to a ridiculously high port I haven’t had any access attempts on my server. 6952 won’t do shit, but if you’re between 40000 and 65000 you probably won’t get anything.

            • @fuckwit_mcbumcrumble@lemmy.world
              link
              fedilink
              English
              71 year ago

              If it’s your only form of security then it’s bad. But if it’s on combination with other measures then it’s a good thing.

              I wouldn’t let anyone who hits my ip/port directly into my openvpn. But not having china and russia bomboarding me with requests is nice.

        • Dandroid
          link
          fedilink
          English
          2
          edit-2
          1 year ago

          Can they see what you are hosting on that port, though? Like say I want to open ssh to my server from the internet (I don’t do this and I wouldn’t unless it was temporary), but I don’t want to open it on port 22 because that’s too obvious. Are there bots that just try every protocol until they find one that your server responds to? Or is there a way to dig up information on what is being exposed behind that port?

    • thmct
      link
      fedilink
      41 year ago

      @housepanther @effingjoe Unless you’re running a router/firewall on the edge that can act as a reverse proxy, you kind of need to port forward to a reverse proxy if you’re behind NAT.

      • HousePanther
        link
        fedilink
        11 year ago

        You could use a VPS as a proxy and set up a VPN tunnel between the home server and the VPS to avoid port forwarding altogether. I do this for my mastodon and lemmy instances. My home server is of course behind NAT but there’s no need for any kind of port forwarding. I should know because I have none configured.