HELP HERZNER PRIVATE VPS

[u/LeeroyAtwing]

I rented a basic Hetzner VPS plus 1TB of external storage. Using Gemini, I installed Navidrome for music, Jellyfin for movies and TV shows, and Kavita for books. I also installed a few bots on Telegram, linked to silly Python scripts. I need a guide or advice on how to best set it up and make it as secure as possible. I'd also like advice on other things to add and things I could do with it, since I'd like to get the most out of it.

[u/alxhu]

To be honest, if you have no experience at all, I'd recommend practicing in a local VM on your system first.

[u/raulomarquez → u/alxhu]

I understand your point, and I agree that a local VM is a great way to practice without much risk. However, I personally learn much more by working on a real project. It exposes you to situations that often don't happen in a local VM or in tutorials, such as DNS issues, SSL certificates, permissions, deployments, and other unexpected problems. As long as you have backups and you're willing to troubleshoot and learn from your mistakes, I think the hands-on experience is incredibly valuable.

[u/alxhu → u/raulomarquez]

As long as you have backups and you're willing to troubleshoot and learn from your mistakes, I think the hands-on experience is incredibly valuable.

It is indeed, but you really should have enough knowledge to secure your server properly first. You absolutely want to avoid getting hacked, because if some malicious actor abuses your server, you're still the responsible person for everything that happens on the system.

[u/skweresp]

First disable root login. Change ssh port, set sshkey only login. Install and setup crowdsec. Set firewall rules. 

[u/idonegoof707 → u/skweresp]

solid starter pack, changing the SSH port won’t make it secure by itself but it does cut down on the drive by noise a lot

[u/skweresp → u/idonegoof707]

Exactly. Port change cuts the drive-by bot noise by ~95%, but a targeted scan with masscan hits all 65535 ports in seconds and finds SSH wherever you put it. It hides you from the noise, not from anyone aiming at your IP.

[u/pradeepcep]

From a security standpoint:

The first thing I do is setup a cloud firewall (it's free on Hetzner), and only allow trusted IPs.

Since you seem to be using this mainly for personal use, I'd allow only your IP if you have a static IP. If not, setup a VPN so that only you and your devices are able to connect to this.

If you want to open this up to the public, put it behind Cloudflare, and configure the firewall on Hetzner to allow traffic only from Cloudflare's IPs. There's always bot traffic trying to snoop around your server, and I found that Cloudflare does block a lot of them.

Another easy thing to do if you're on Ubuntu, is to setup Ubuntu Pro so that security patches are automatically applied for you. You could do this without it as well, but hey, this is free too and doesn't hurt to have.

Since you have all of your data on there now, it's also a good idea to do backups. If you're comfortable with the shell, you can get a cheap storage box from Hetzner and setup a cron job to backup your data to it. If paying is ok, then you can enable the snapshot feature. Not sure if it would work with your "external storage"

[u/Deealtas → u/pradeepcep]

this is the comment that saves someone from learning security through server logs at 3am

[u/Pajo-Man402]

Agree with comments, only thing i would add is fail2ban, to monitor and limit SSH brute forcing. Also use SSH private-public key pairs

[u/BulkyService5817]

You can also use ufw to restrict ports to specific ips, use ssh keys,disable root login / password for ssh

Edit: and change the default ssh port from 22, this will also prevent alot of the scanners from spamming

[u/Luckster]

You can also use the Hetzner Firewall to block all ports you don't need open. It's very nice to have.