56
Deleted (aussie.zone)
submitted 3 months ago by to c/selfhosted@lemmy.world
25 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 3 months ago (2 children)

I think the problem has been slightly exaggerated. If you're not hosting several dozen services, you can reduce your attack surface down to one Nginx server. For an even stricter setup, just enable mTLS.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 1 point 3 months ago* (1 child)

    Prevent password logins where ever possible too, especially SSH. Use ed25519 keys. Perform server actions with least privilege users, prevent root logins. Immutable systems and containers are a helpful tool too.

    I also just host my public facing stuff on a VPS. DDOS protection and just otherwise isolated. 2FA on the VPS too.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 months ago*

    Just don't expose SSH to internet. It's a complex protocol with many CVEs. And you realyy don't need access to SSH from anywhere. Replace access from ineternet to a WireGuard tunnel that has almost zero attack surface area and properly configured iptables rules. And that’s it.

  • permalink
  • fedilink
  • source
  • parent