56
Deleted (aussie.zone)
submitted 3 months ago by to c/selfhosted@lemmy.world
25 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 3 months ago* (1 child)

Prevent password logins where ever possible too, especially SSH. Use ed25519 keys. Perform server actions with least privilege users, prevent root logins. Immutable systems and containers are a helpful tool too.

I also just host my public facing stuff on a VPS. DDOS protection and just otherwise isolated. 2FA on the VPS too.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 months ago*

    Just don't expose SSH to internet. It's a complex protocol with many CVEs. And you realyy don't need access to SSH from anywhere. Replace access from ineternet to a WireGuard tunnel that has almost zero attack surface area and properly configured iptables rules. And that’s it.

  • permalink
  • fedilink
  • source
  • parent