Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a Linux Server

kenhv.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Securing a Linux Server

#21

Post by mobilio »

techcode wrote: post #11
klaussilveira wrote: post #2

This is neat. Modern take and very pragmatic.

Modern take would be to simply not open anything to the outside world - except WireGuard (TailScale or such). From there everything is either considered "localhost" or a local network. You can setup one or two central boxes (actual home lab "server" where you already have HTTP based services, and a raspberry pi zero 2 for backup) with TailScale. With remote devices (including phones) in same tailscale network - you c…

I'm using similar approach but with ZeroTier.

Re: Securing a Linux Server

#22

Post by jasonrojas »

There are a few other posts on HN with the same title. Some things to also consider that I had not seen mentioned: PCI CIS Etc…

Include many more things specifically around ssh that you can do outside of fail2ban, also things that are requirements for the above….

These posts are good but slightly miss a lot of security practices that are “standard”. As always the best security is not allowing the system to be connected to anything. But in the event that you have to have a system with such availability, it’s always best to introduce at least CIS foundations and whatever you see fit for security. Just my .02..

Re: Securing a Linux Server

#24

Post by KenHV »

laweijfmvo wrote: post #10

After following this guide, all requests to my website time out, so I guess it's secure!

It might be a firewall issue or one of the Fail2Ban jails. If you're using all the Nginx jails, try disabling them and see if it fixes the issue.

Re: Securing a Linux Server

#25

Post by KenHV »

petesergeant wrote: post #3

Is there any point in Fail2ban if you're using keys and have disabled passwords? I guess defense in depth and all that

Fail2Ban doesn't do much for SSH other than keeping your logs cleaner if you're using key based auth. It's quite good for protecting other services like Vaultwarden for example. Of course, it's just one additional layer. The important part is to configure the services themselves to be more secure.

Re: Securing a Linux Server

#26

Post by KenHV »

jasonrojas wrote: post #22

There are a few other posts on HN with the same title. Some things to also consider that I had not seen mentioned: PCI CIS Etc… Include many more things specifically around ssh that you can do outside of fail2ban, also things that are requirements for the above…. These posts are good but slightly miss a lot of security practices that are “standard”. As always the best security is not allowing the system to be connect…

I have received a lot of feedback regarding this. I'm waiting for Ubuntu to update their CIS docs for 24.04, I'll update my post when they do. I keep a lot of my blog posts regularly updated, this post will be one of them.

Re: Securing a Linux Server

#27

Post by KenHV »

techcode wrote: post #11
klaussilveira wrote: post #2

This is neat. Modern take and very pragmatic.

Modern take would be to simply not open anything to the outside world - except WireGuard (TailScale or such). From there everything is either considered "localhost" or a local network. You can setup one or two central boxes (actual home lab "server" where you already have HTTP based services, and a raspberry pi zero 2 for backup) with TailScale. With remote devices (including phones) in same tailscale network - you c…

This setup is the most secure, but it's also the most limiting - it's feasible only if you're hosting services for yourself or a couple of people.
Post reply on HN