Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
That's very little actually
Move your SSH port from the standard 22 to one of the higher ones, like 53822
It'll remove 99.something% of your attacks as nobody bothers with those ports.
I do this too; I changed the actual port to something random and run endlessh-go on 22 to tarpit the skiddies
Wouldn't use a high port since they're unprivileged.
so everyone can open them... so what? attacker who already gained local access can crash your original sshd and spin up his own one? admittedly a thinkable scenario... but can this even be abused in a pubkey auth scenario?
I don't see a reason to worry about that. Only matters if the machine is alreay compromised, and then it doesn't matter either.
There are different levels of compromise: you could have local access or root access. This might allow a hacker to gain root access by faking an SSHd and asking for a password or something like that. Host key verification would save you in that case, but then again, there's probably funny MITM things you can do with an existing SSHd.
I have to admit it widens the attack surface. Not immensely, but every bit counts.
Yeah, exactly my sentiment :)
Mostly true, however the thing saving you would be host key verification, not pubkey authentication.
I'm just not into security by obscurity coupled with compromising the inbuilt mechanisms for making sure only root can open an SSHd.
Do you think high ports are irrelevant or only in this case for SSHd? If the former, why do you think the distinction exists in the first place?
host key veryfication, right, good point! non-root attacker won't have your servers key. but thats just on top. so even if you ack the new host key, what could they gain? give you a shell with their permission and wait for you to sudo-tell them their password maybe. until then trying to mimic the system they might not know too much about (whats in /root?)
Yep, that's one way. I bet creative hackers can chain some nice exploits together and figure out things we currently don't think of. Better give them the smallest surface possible :)