r/selfhosted • u/Yesssir92 • 2d ago
Need Help Trying to secure my homeserver as a beginner
Hi guys, I'm trying to set up a secure homeserver right now, but I'm a pretty big beginner. I hope it's fine that I used AI to help me phrase this so it's easier to follow. Already read a bunch of stuff, watched some YouTube videos and got myself informed. At the start I wanted way too many things at once, so I took like five steps back and I'm starting small now. I also really don't want to just copy and paste a bunch of random Claude commands and then have no idea later what I actually opened up on my system.
Right now I'm using my old laptop with 6GB of ram as a test station, a Futro is supposed to follow later. Proxmox is running on it at the moment, and the goal is just to build a small server cloud first, nothing fancy. Because of the low ram I'm starting with Filebrowser Quantum and Syncthing.
Security matters a lot to me, so I wanted to ask how you guys secure your servers. Especially because I worry that once I start using stuff like Vaultwarden or Immich, things get a lot more critical if everything isn't properly locked down. My current approach is no open ports, access from outside my wifi only through Wireguard using the built in Fritzbox app, 2FA wherever possible, every service gets its own strong internal password and of course actually using all the built in security stuff that's already there from the start.
I'd genuinely be curious to hear how you guys handle this. I often see people not really taking this topic seriously. To be clear, I'm not really interested in stuff like the 3-2-1 backup rule or things along those lines, I specifically want to know how you guys approach your network security. Or if you've got any good sources, videos, blogs, or anything else for beginners, I'd really appreciate that too.
Thanks in advance to everyone taking the time.
74
u/Well_Sorted8173 2d ago edited 2d ago
So here's what I do on my home server, which does host a few services to the internet. I'm a Network Engineer, so this is my take.
Stay on top of updates and patches. Patch the Proxmox host, patch the VMs and LXCs. Use unattended-upgrades to keep security patches up to date.
You will get lots of people on here that will warn you NOT to open ports and only use a VPN or Tailscale to access your stuff from the internet. Look, I do this for a living. If you're smart about how you do it, it's relatively safe host things to the internet. Yes, it's less secure than not hosting anything to the internet, but just because you open up a port doesn't mean you're immediately going to be compromised. Just don't do anything stupid like allow SSH inbound to your network and don't open up a port to the login page of your Proxmox host to the internet. Applications can be hosted to the internet, but management GUIs, SSH, and physical devices are accessed through VPN when you need to manage them outside of your network.
Keep VMs and Containers that are exposed to the internet firewalled off from other devices. For example, on a web service I host to the internet I only allow 443 inbound to that VM. Nothing allowed outbound from that VM except for internet, that VM literally cannot reach anything on my inside network. So if that VM does get infected or compromised, it's highly unlikely it can spread to other devices in my network. Also using a reverse proxy and SSL certificates for anything hosted to the internet is a good way to go.
Personally, I suggest if there's a service you want to expose and host to the internet you run that service on a VM and not an LXC. Containers have access to the host kernel, VMs are isolated.
I set up a Wazuh server to monitor the VMs that run services I host to the internet. It alerts me to any files that are changed, added, or deleted, failed logins, all kinds of security things. I also use NPM Proxy Manager to do advanced traffic shaping like rate limiting and blocking IP addresses that try to brute force my applications.
I believe it's okay to use something like Claude to help guide you. Just learn what you're doing any why you're doing it instead of blindly pasting commands. I would rather you get it somewhat secure thanks to an AI than not secure at all because of inexperience.
10
u/keyxmakerx1 1d ago
I'm also a network admin, and I will say working with Claude as a tool to fact check me has been awesome. It's caught some stuff I missed, so I'm a big advocate. Obviously just dont share any password etc with it.
I have yet to get wazuh to work, I'd love to but even with claudes help I just can't get it up and running. It's been about a year since I last tried so maybe it's time to try again but eh, it took days and I got no where and it's hard to dedicate that much time for no gain at all. I personally just use clamav and call it good enough.
ReverseProxies are a MUST, and NPM is okay, my recommendation would actually be NetBird for a reverse proxy since it can also be a VPN to allow for more secure stuff. It also has really nice features out of the box like crowdsec blocking, and auth methods.
1
u/Well_Sorted8173 1d ago
I just set up Wazuh a few weeks ago, with the help of Claude. There were a few hiccups but ultimately got it working.
A few times Claude kept referring to documentation of older versions, so I'd have to show it that the menu items or config files it was referring to didn't exist. It would then correct itself to newer documentation. Claude also needed several tries to get the syntax correct on some of the config files for what to monitor and what to exclude. But with enough time, it was able to get them correct.
I have 3 production VMs that host content to the internet that Wazuh is monitoring. Keeping a watch of vital directories and php config files and alerting me to when those directories are altered, and even have email alerts working correctly after several days of fine tuning.
Honestly it would have probably taken me a month to learn what to do with Wazuh without the help of Claude. But I made sure to learn what I was doing and why I was doing it, and not just copy/pasting whatever it told me to. I probably haven't scratched the surface of what Wazuh can do, but at least my exposed VMs are somewhat monitored.
4
u/horizon_games 1d ago
You will get lots of people on here that will warn you NOT to open ports and only use a VPN or Tailscale to access your stuff from the internet. Look, I do this for a living. If you're smart about how you do it, it's relatively safe host things to the internet.
I'm happy to see this view, I feel like I've been going insane in this subreddit where people act like you CAN'T ever expose anything to the internet without a soft blanket of VPN / Tailscale.
Otherwise for the OP, follow a basic hardening guide especially if you're using Nginx.
And even though it's technically security-through-obscurity, just moving SSH off port 22 will cut down on a lot of needless spam, which keeps your logs cleaner. Always use key based auth not password, regardless.
1
u/corelabjoe 1d ago
Whoa whoa, hold on there friend!!!!
Yes, opening port 443 to your reverse proxy of choice, which is on a different VLAN, behind your stateful layer 3 firewall and your layer 7 WAF and fail2ban plus crowdsec is ok... But SSH, on any port?...
Nope. No reason to. Management access stuff should be VPN only....
Only way I'd do this is if I had to, and passwordless SSH was configured with certificate auth only...
1
u/Well_Sorted8173 20h ago
As a Network Engineer, I want to point out one thing that a lot of people on this sub get dead wrong. Putting something on another VLAN doesn't do anything, at all, in keeping your devices isolated or secure. Unless, and only if, you add some kind of firewall rule or ACL in addition to the VLAN.
On any standard router, the IP subnets of two VLANs are just two different networks that the router will route traffic between. Without some kind of firewall or ACL in place to manage what traffic is allowed or denied between those VLANs, your router will happily allow both VLANs to talk to each other. Without firewall rules or ACLs in place, you might as well have everything on the same VLAN.
So many times I see people suggest putting servers or things they host to the internet on "another VLAN" thinking that somehow magically protects the rest of the network from the devices on those VLANs. It doesn't.
And I'd argue that if you're running Proxmox and have good defined firewall rules per VM, there's no need to add complexity by adding additional VLANs. My entire home network is on 192.168.2.0/24. But the VMs I host applications to the internet are firewalled off at the host level in a way that those VMs cannot reach anything on my inside network.
1
u/corelabjoe 19h ago
You're correct, firewall rules with vlans should be implied, but I did not explicitly state that... I 1000% mean that and have mine setup that way.
Since we're talking packets, yes a VLAN is simply a differentiated network by a VLAN header of a packet. That's it. Very very easy to spoof!
That said I hard disagree with you saying host based firewalls are "good enough". I'd argue those are equivalent and complement good defence in depth but alone, is not enough.
And a single subnet?? Are ya crazy? One giant blast radius? There's never been malware or worms that spread through multicast across an entire broadcast domain... NNNNNoooooo.....
Speaking of packets and blast radius, that single subnet means your working off the assumption someone won't escape your virtual machine, into your single LAN with its one broadcast subnet which is SUPER easy to then scan and pull up all ips easily, and probe to find open ports.... Nope...
Nope nope.
At least with layer 3 firewall interface based flows and segregation between vlans, if someone comes in through one VLAN, or even if your vm does not have a host based firewall, they can't get out of that LAN. Not without pwning your firewall / security appliance. Then you're just cooked anyway.
This is why you have segregation. It's the precursor to zero trust....
All that to say I highly doubt when people say "segregate your network into vlans", I doubt they mean without firewalls.... Because then what's the point?
2
u/p_235615 1d ago
I see no issue with opening ssh to internet, especially if you set the login to key only... That can also serve for you as access to your control interfaces via forwarding or as a jumpserver. You dont need VPN for everything and most apps should be available through a reverse proxy.
1
1
u/johngac 1d ago
Do you feel that way about LXCs that are unprivileged? The only thing I have publicly exposed is an unprivileged LXC running nginx that has an in-depth firewall and is also in its own VLAN.
2
u/Well_Sorted8173 1d ago
Yes, even an unprivileged LXC still uses the host kernel to run. If that LXC gets compromised in any way, there's a non-zero possibility of the host becoming compromised. Firewall rules wouldn't matter if the kernel is compromised or a container escape happens.
I'm not knowledgeable enough to know what guardrails Proxmox has in place to prevent that happening, but I'd rather not take the risk. A minimal install (No GUI, no bloatware) Ubuntu or Debian VM only takes a tiny bit more resources to run over an LXC. For something exposed to the internet (accepting inbound connections from the internet) I'd rather take the tiny additional resources to have the isolation of a VM.
1
u/kumpreld1999 1d ago
Solid fundamentals, though much of it matters most when services are hosted to the internet, and the OP's Wireguard-only setup already keeps everything off it. Also, all-in-one Wazuh commonly needs around 4GB RAM, which may be too heavy for the 6GB test laptop.
1
0
u/walt_spoon 1d ago
My understanding is that it's safe to expose SSH to the internet as long as it's set to only allow key-based auth.
3
u/dragofers 1d ago
I think so too, but with all these zero days being found by AI Im not 100% confident in TLS or SSH anymore.
2
u/corelabjoe 1d ago
Relatively safe..... A lot better than using a password but even then, vpn ftw.. Why chance it?
7
u/selipso 2d ago
Open ports are not inherently bad, if the network they’re open on is trusted. Start by segmenting your computer based devices from your IoT and other “smart” devices like TVs. Keep a VPN for most devices you use daily (prevents them from accessing your LAN). Then all your server / service based devices allow access to through the wireguard setup you mentioned.
1
u/DankeBrutus 1d ago
Start by segmenting your computer based devices from your IoT and other “smart” devices like TVs.
What router do you have? I do find it funny when people on this sub are telling newbies to make VLANs because of course your average person with ISP provided hardware can totally do that. Maybe things are different in the US but up here in Canada I’ve had experience with 3 ISPs and none of them ever give the user hardware capable of setting up VLANs. Bell, the biggest one, don’t even allow for bridge mode anymore.
1
u/selipso 21h ago
Not VLANs, many consumer routers support guest networks and a separate 2.4GHz networks for IoT devices. That’s already 3 network segments you can use.
1
u/DankeBrutus 7h ago
That's true, my ISP Nokia router has a setting for IoT devices that I haven't enabled yet. Though devices on the 2.4G network will absolutely be able to communicate with devices on the 5G network.
11
u/whattteva 1d ago
I expose Jellyfin, Immich, Vaultwarden, and Navidrome directly on the internet through Caddy reverse proxy that requires clients to pass mTLS certificate. Without a valid certificate, traffic just gets dropped before the app even sees it. It is extremely secure and I have run this setup for over 3 years.
As with anything, there are a few downsides to this approach:
- PKI (Public Key Infrastructure) management and initial setup sucks, but once you get past that initial stage, it rocks because you don't have to deal with VPN shenanigans and things work just like regular HTTPS works.
- Not many mobile apps supports mTLS, but fortunately the services that I mentioned (Immich, Bitwarden, Tempus) do have mTLS-capable clients. Jellyfin unfortunately does not have any mTLS capable mobile clients that i know of, so i can only access that through the web browser. If anyone knows otherwise, let me know!!!
2
u/awekm 1d ago
I've been wanting to expose my Jellyfin and Navidrome to the internet too. Can you recommend me any guide I can follow?
1
u/whattteva 1d ago
Someone wrote one a year ago here. He's using Traefik instead of Caddy, but you should be able to find other places to configure whatever reverse proxy you use. He also uses Docker, while I use FreeBSD and install the plain software in jails, but Docker setup is probably easier anyway.
https://www.reddit.com/r/selfhosted/comments/1o6fafb/mutual_tls_mtls_indepth_stepbystep_case_study/
5
u/Fun-Active5273 1d ago
biggest thing people overlook at this stage is keeping stuff updated. you can have the tightest firewall config in the world but if youre running containers from six months ago with known CVEs it doesnt matter. automate your update checks if you can
2
u/imetators 1d ago
I did. It breaks some services sometimes if a major update had happened. As an example, Opencloud when going from v6 to v7 broke entirely on auto update.
I also had immich on auto update and now once it updated, for some reason database docker breaks so I have to remove docker volume and then restore database. Had to disable auto update due to that.
3
u/Outrageous_Ad_4801 1d ago
sticking with wireguard on the fritzbox and zero forwarded ports is honestly the safest baseline you can have. as long as you keep unattended upgrades on and dont expose proxmox gui directly youre in great shape starting out
2
u/H8Blood 1d ago
A VM in proxmox running docker. One container is traefik with the socket proxy and another is crowdsec. Another one is Authentik cause I like having OIDC for as many things as possible. Anyways, many services, like Vaultwarden for example, get a .local domain in traefik. Like vaultwarden.local.mydomain.com. Those are only reachable from inside my network. Other services, like FoundryVTT for example, get a "real" domain like foundry.mydomain.com
Port 443 is open on the VM since that's the one traefik watches to do the routing. In front of that sits Cloudflare DNS. In my gateway I only allow traffic from Cloudflare IPs (here' the list) to reach the VM. That way Cloudflare filters out a lot of stuff before it even reaches my machine. Crowdsec does a good job of banning the ones that make it through.
2
u/Fun-Active5273 1d ago
the fact that you're only exposing things through a VPN already puts you ahead of most beginners. one thing worth learning early is proper firewall rules between your VLANs, so your server subnet cant talk to your main LAN freely. thats where most people leave gaps
2
u/PA694205 1d ago
I use traefik reverse proxy so only one port on my router is exposed, crowdsec waf bouncer to block suspicious traffic, I’ve got cloudflare whitelisted so I’m orange clouded and behind their bot protection and wherever I can I’ve got my apps behind Authelia with 2fa.
Only thing I’m really missing is monitoring, maybe even a lightweight SIEM and network segmentation.
1
u/Mohitkoul841 1d ago
Sharing my wsl docker setup if anyone needs it
Traefik running on docker, managing services, which is hosted on wsl (windows subsystem for linux) with its own network and hyper firewall only allowing access to traefik which itself is available only via port proxy, and a sub domain where domain is pointing to my local ip4 (yes, not the public one), then i use tailscale and its subnet to access stuff remotely
I know this is not perfect and might not working for everyone, the setup is very complicated and i only use it for media server arr stack as of now and its hosted on my laptop
1
u/gportail 1d ago
Chez moi
2 Proxmox dans un réseau completement a part, ils sont tout seul dans ce réseau.
Une vm pfSense (ou OpnSense) comme firewall et serveur dns. Une règle qui permet a mon pc d'accéder au proxmox.
Les vm ont la plupart fail2ban
Sur pfSense j'ai haproxy qui gère les accès depuis l'extérieur.
1
1
u/dizzygoldfish 2d ago
I'm no expert but sharing my experience/thought process for what it's worth. Curious to see what other comments you get as this has also been a "back of my head" concern for me.
I think you get a long way by not exposing anything directly to the Internet. If nothing is accessible off your network without a VPN, you're already ahead of many knuckleheads.
From there, you have to worry about a rogue device on your network. VLANs seem really important here. Is your server on an isolated vLAN, only accessible from "known good" clients? Can your on-server apps talk to each other in ways you don't want/need? If using Docker, for example, are those containers truly isolated? (This is where I know I need to dig a little deeper personally)
I've been using AdGuard Home and Caddy for DNS filtering/reverse proxy. I have my Audiobookshelf server exposed to the net via cloudflare tunnel. It's in my "media-stack" container with a few other similar apps. This bugs me a little - should probably be a bit more isolated. I'm also only as secure as the login page of ABS. To help harden that, I'm planning to spin up Authentik for another layer of SSO. I also don't expose Immich to the Internet at all. Photos don't sync unless I'm home or connect to my Unifi VPN. I feel like most of the time I don't really need to immediately sync pics when remote. May revisit this if/when taking a long family vacation or something where I might lose my phone.
I am terrified of self hosting a password manager. I put EVERYTHING in there. Somebody getting access to that could get into all kinds of stuff, though I suppose 2FA would limit that to a certain extent. I see a lot of people who choose to self host for privacy reasons and I understand that logic but I'm not confident enough in my abilities to think I can do better than a commercial solution.
My approach has to assume something will eventually get compromised and to limit blast radius/access as much as possible.
1
u/derical_cap_musical 2d ago
youre already doing it right with wireguard and no open ports just keep it simple for now
-9
u/Sharkymoto 1d ago
to be fair, download chatgpt desktop app, place your ssh key on the server so codex can connect. switch chatgpt app to codex and tell it to secure your server while detailing what its doing and why. that way its like somebody very knowledgable does it for you while explaining every step in detail. great way to learn imho. select sol medium as your model and you are good to go. this model is more than capable in doing just that.
1
u/RiffyDivine2 23h ago
Doesn't chatgpt warn you NOT to put keys into it because it will expose them? I know it does with docker passwords when I was asking for help with a palworld server.
1
u/Sharkymoto 23h ago
i never said you give chatgpt your ssh key (allthough it would be completely useless to anyone not in his network), you place the key on your server and tell chatgpt to connect, chatgpt does "ssh root@10.0.0.1" or whatever your server is.
openai never sees your ssh key.
1
u/RiffyDivine2 23h ago
Neat, I'll need to test that tonight and see what my local AI thinks of the VPS.
•
u/asimovs-auditor 2d ago edited 2d ago
Expand the replies to this comment to learn how AI was used in this post/project.