Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A story on home server security

raniseth.com

Post reply on HN
Print view View original

281–287 of 287 posts

Re: A story on home server security

#281

Post by evantbyrne »

smarx007 wrote: post #95
evantbyrne wrote: post #78

Earlier quoted context omitted.

You should try swarm. It solves a lot of challenges that you would otherwise have while running production services with compose. I built rove.dev to trivialize setup and deployments over SSH.

Interesting, in my mind Swarm was more or less dead and the next step after docker+compose or podman+quadlet was k3s. I will check out Rove, thanks!

That was rumored for a while, but Swarm is still maintained! I wouldn't count on it getting the latest and greatest compose format support though.

Re: A story on home server security

#282

Post by immibis »

diggan wrote: post #225
9dev wrote: post #210

Earlier quoted context omitted.

Also, many people don’t remember that those zeros in between numbers in IPs can be slashed, so pinging 127.1 works fine. This is also the reason why my home network is a 10.0.0.0/24—don’t need the bigger address space, but reaching devices at 10.1 sure is convenient!

I had no idea about this, and been computing for almost 20 years now, thanks! Trying to get ping to ping `0.0.0.0` was interesting $ ping -c 1 "" ping: : Name or service not known $ ping -c 1 "." ping: .: No address associated with hostname $ ping -c 1 "0." ^C $ ping -c 1 ".0" ping: .0: Name or service not known $ ping -c 1 "0" PING 0 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0…

0.0.0.0 is a reserved address to mean "this device". Also, 0/8 is a reserved subnet to mean "this network" (which no-one uses any more). I wouldn't have expected ping to substitute 127.0.0.1, but it's not that weird either.

Re: A story on home server security

#283

Post by zenoprax »

packtreefly wrote: post #204
zenoprax wrote: post #118

Earlier quoted context omitted.

I use HAProxy on PFSense to expose a home media server (among other services) for friends to access. It runs on a privileged LXC (because NFS) but as an unprivileged user. Is this reckless? Reading through all this makes me wonder if SSHFS (instead of NFS) with limited scope might be necessary.

That's a popular architecture, but I personally wouldn't run part of the application stack (HAProxy) on my network firewall, and would instead opt to move it to the media server. Suppose you have the media server in its own VLAN/Subnet, chances are good that the firewall is instrumental in enforcing that security boundary. If any part of the layer-7 attack surface is running on the firewall... you probably get the id…

Interesting, I never considered it part of the application stack. It routes a dozen or so separate services so it feels at home next to Wireguard, DHCP, and DNS.

Re: A story on home server security

#284

Post by Kerbonut »

malfist wrote: post #59
bluedino wrote: post #30

Earlier quoted context omitted.

Containers are widely used at our company, by developers who don't understand underlying concepts, and they often expose services on all interfaces, or to all hosts. You can explain this to them, they don't care, you can even demonstrate how you can access their data without permission, and they don't get it. Their app "works" and that's the end of it. Ironically enough even cybersecurity doesn't catch them for it, t…

Checklist security at it's finest. My team where I work is responsible for sending frivolous newsletters via email and sms to over a million employees. We use an OTP for employees to verify they gave us the right email/phone number to send them to. Security sees "email/sms" and "OTP" and therefor, tickets us at the highest "must respond in 15 minutes" priority ticket every time an employee complains about having lost…

Stop calling it a OTP and call it a temporary PIN :)

Re: A story on home server security

#285

Post by Igrom »

jeroenhd wrote: post #227
geye1234 wrote: post #84

Earlier quoted context omitted.

I am not a security person at all. Are you really saying that it could potentially cause Iptables to open ports without an admin's knowing? Is that shockingly, mind-bogglingly bad design on Docker's part, or is it just me? Worse, the linked bug report is from a DECADE ago, and the comments underneath don't seem to show any sense of urgency or concern about how bad this is. Have I missed something? This seems appallin…

> without an admin's knowing For people unfamiliar with Linux firewalls or the software they're running: maybe. First of all, Docker requires admin permissions, so whoever is running these commands already has admin privileges. Docker manages its own iptables chain. If you rely on something like UFW that works by using default chains, or its own custom chains, you can get unexpected behaviour. However, there's nothin…

>Imagine having to adjust your documentation to go from [...]

I sympathize with your reluctance to push a burden onto the users, but I disagree with this example. That's a false dichotomy: whatever system-specific commands Docker executes by default to allow traffic from all interfaces to the desired port could have been made contingent on a new command parameter (say, --open-firewall). Removing those rules could have also been managed by the Docker daemon on container removal.

Re: A story on home server security

#286

Post by MortyWaves »

anthropodie wrote: post #272
smarx007 wrote: post #100

Earlier quoted context omitted.

Is there a tool/tutorial that assumes that I already have a running docker compose setup instead of starting with some toy examples? Basically, I am totally excited about using systemd that I already have on my system instead of adding a new daemon/orchestrator but I feel that the gap between quadlet 101 and migrating quite a complex docker compose YAML to podman/quadlet is quite large.

Search for podlet. It lets you do what you want.

So does this really work for practically any docker compose file you may find in self hostable projects?

Re: A story on home server security

#287

Post by Fnoord »

immibis wrote: post #279
Fnoord wrote: post #257

Earlier quoted context omitted.

There's no reason Tor exit nodes need to access my home network. Zero. I do use BitTorrent but behind a VPN; this remains unaffected, though if it were I would block traffic which isn't supposed to go through Tor (since BitTorrent over Tor is not recommended). As a rule of thumb, I will gladly pass on Tor traffic, but no exit node, and I understand if network admins want to block entry node, too. It is a decision eve…

You don't have to help commercialize it.

Blocking Tor on a home network does that? Gee, I didn't know.
Post reply on HN