140
How do I avoid becoming one with the botnet? (programming.dev)
submitted 9 months ago by to c/selfhosted@lemmy.world
67 comments fedilink hide all child comments
 

I find the idea of self-hosting to be really appealing, but at the same time I find it to be incredibly scary. This is not because I lack the technical expertise, but because I have gotten the impression that everyone on the Internet would immediately try to hack into it to make it join their bot net. As a result, I would have to be constantly vigilant against this, yet one of the numerous assailants would only have to succeed once. Dealing with this constant threat seems like it would be frightening enough as a full-time job, but this would only be a hobby project for me.

How do the self-hosters on Lemmy avoid becoming one with the botnet?

you are viewing a single comment's thread
view the rest of the comments
[–] 46 points 9 months ago (6 children)

Only expose services internally then use a secure VPN to access your services, this makes your network no more vulnerable in practice than not self hosting. If you need/want to expose something to the internet, make sure you setup your network right. Use a DMZ to separate that service and leverage something like CrowdSec along with good passwords, antivirus, and keep things patched.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 5 points 9 months ago (2 children)

    How do I check this? I route everything on my internal network only. But how should I make sure its not accessible remotely? I cannot just have these on an air gapped network.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 8 points 9 months ago

    You can run a port scan against your public IP from another network to see what is open. But if you haven’t specifically set something up for external access through port forwarding you are probably fine.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 9 months ago* (1 child)

    Should I do the same if I want to expose an OpenAI compatible API to access an LLM to chat remotely on local technical documents?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 6 points 9 months ago

    It doesn’t usually matter what the service is, the basic concepts are the same. If you want to access a service you host on your internal network from another external network you either need to use a VPN to securely connect into your network, or expose the service directly. If you are exposing it directly you should put it (or a proxy like NPM) in your DMZ. The specifics of how to do this though will vary from service to service and with your specific network config.

  • permalink
  • fedilink
  • source
  • parent