A story on home server security
raniseth.com
A story on home server security
1–10 of 287 posts
Re: A story on home server security
#2> None of the database guides I followed had warned me about the dangers of exposing a docker containerized database to the internet.
This is like IT security 101.
> A quick IP search revealed that it was registed with a Chinese ISP and located in the Russian Federation.
Welcome to the Internet. Follow me. Always block China and Russia from any of your services. You are never going to need them and the only thing that can come from them is either a remote attack or unauthorized data sent to them.
Re: A story on home server security
#3> None of the database guides I followed had warned me about the dangers of exposing a docker containerized database to the internet. This is like IT security 101. > A quick IP search revealed that it was registed with a Chinese ISP and located in the Russian Federation. Welcome to the Internet. Follow me. Always block China and Russia from any of your services. You are never going to need them and the only thing tha…
> Always block China and Russia from any of your services.
But does this add much security if bad actors are using VPNs ?
Re: A story on home server security
#4> None of the database guides I followed had warned me about the dangers of exposing a docker containerized database to the internet. This is like IT security 101. > A quick IP search revealed that it was registed with a Chinese ISP and located in the Russian Federation. Welcome to the Internet. Follow me. Always block China and Russia from any of your services. You are never going to need them and the only thing tha…
Yeah, the problem today is that there are many guides on MVPing software which don't tell you basic security.
The guy doesn't have a software background.
This is basically the problem with the 'everyone-should-code' approach - a little knowledge can be dangerous.
Re: A story on home server security
#5> None of the database guides I followed had warned me about the dangers of exposing a docker containerized database to the internet. This is like IT security 101. > A quick IP search revealed that it was registed with a Chinese ISP and located in the Russian Federation. Welcome to the Internet. Follow me. Always block China and Russia from any of your services. You are never going to need them and the only thing tha…
> Always block China and Russia from any of your services. But does this add much security if bad actors are using VPNs ?
They'd need to run a VPN with end point in a less hostile country and so there's an element of enforcement on those endpoints.
At any rate, blocking China and Russia isn't ever presented as a foolproof defence, it just raises the barrier to attack.
Re: A story on home server security
#6I’d recommend using something like Tailscale for these use cases and general access, there’s no need to expose services to the internet much of the time.
Re: A story on home server security
#7I’d recommend using something like Tailscale for these use cases and general access, there’s no need to expose services to the internet much of the time.
Tailscale also has funnel which would be more secure for public exposure.
Re: A story on home server security
#8> "None of the database guides I followed had warned me about the dangers of exposing a docker containerized database to the internet."
This prompts a reflection about, as an industry, we should make a better job in providing solid foundations.
When I check tutorials on how to drill in the wall, there is (almost) no warning about how I could lose a finger doing so. It is expected that I know I should be careful around power tools.
How do we make some information part of the common sense? "Minimize the surface of exposure on the Internet" should be drilled in everyone, but we are clearly not there yet
Re: A story on home server security
#9Tailscale is a great solution for this problem. I too run homeserver with Nextcloud and other stuff, but protected behind Tailscale (Wireguard) VPN. I can't even imagine exposing something like my family's personal data over internet, no matter how convenient it is.
But I sympathize with OP. He is not a developer and it is sad that whatever software engineers produce is vulnerable to script kiddies. Exposing database or any server with a good password should not be exploitable in any way. C and C++ has been failing us for decades yet we continue to use such unsafe stacks.
Re: A story on home server security
#10I think I'm missing something here - what is specific about Docker in the exploit? Nowhere is it mentioned what the actual exploit was, and whether for example a non-containerized postgres would have avoided it.
Should the recommendation rather be "don't expose anything from your home network publically unless it's properly secured"?