105
What else should I do for my home server security? (lemmy.world)
submitted 3 weeks ago by to c/selfhosted@lemmy.world
37 comments fedilink hide all child comments
 

So I'm relatively new to server hosting. (But experienced with remote web hosting from providers.) After about a year of fighting to run Nextcloud on a hosting company and finally losing everything from the cPanel vulnerability a few months ago, I broke down and launched my own home server. I'm looking for advice to maximize security.

CachyOS Linux with ClamAV Docker via Portainer Nextcloud (E2EE), Immich, DocuSeal and NoteTrace Routed through a domain and subdimains via Zero Trust Cloudflare Tunnel and Cloudflare DNS.

I have regular redundant backups both onsite and offsite with Duplicati.

My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

I know just enough about this stuff to get into trouble. What else should I setup? I have little to no monitoring going on and don't know much about that direction.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 weeks ago* (1 child)

This is an elegant and brilliant idea and I love it. Finding a way to formalize a baseline and then get notified for deviations from that baseline is a fundamental requirement for having things running smoothly.

I've been working on a way to automate daily log parsing to get to the same state but including performance metrics and network traffic would definitely round out the signal.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 weeks ago

    I'd use the same baseline approach for logs and compare counts instead of reading lines. Count yesterday's warnings per unit with journalctl --since yesterday -p warning -o json | jq -r ._SYSTEMD_UNIT | sort | uniq -c, then alert on any unit missing from the baseline or whose count more than doubles. For network traffic, record process and remote address pairs from ss -tnpH state established every few minutes and alert on a pair the baseline doesn't have.

    Drafted with AI.

  • permalink
  • fedilink
  • source
  • parent