udc@lemmy.world to Selfhosted@lemmy.worldEnglish · 2 days agoHow to Setup a Secure Ubuntu Home Server: A Complete Guidewww.davidma.coexternal-linkmessage-square19linkfedilinkarrow-up11arrow-down10
arrow-up11arrow-down1external-linkHow to Setup a Secure Ubuntu Home Server: A Complete Guidewww.davidma.coudc@lemmy.world to Selfhosted@lemmy.worldEnglish · 2 days agomessage-square19linkfedilink
minus-squaretruthfultemporarily@feddit.orglinkfedilinkEnglisharrow-up0·1 day agoThis is mostly nonsense. Why block outgoing? Its just going to cause issues for most people. If you’re going to do that, do it centrally (hw firewall) Why allow http and NTP incoming, when there is no http / NTP server running. If there is http server running no mention of https://ssl-config.mozilla.org/ and modsecurity If you’re using ufw anyway why not go with applications instead of ports? In a modern distro, the defaults are usually sane (maybe except TCP), most of the stuff in the SSH config is already default. Why change the SSH port of a home server, which most likely is not reachable from the outside anyway? Actually potentially impactful stuff like disabling services you don’t need, such as cups, is not mentioned unattended-upgrades not mentioned SELinux / AppArmor not mentioned LKRG not mentioned https://lkrg.org/ Fail2ban not mentioned Don’t just copy random config from the internet, as annoying as it is, read the docs.
minus-squareuranibaba@lemmy.worldlinkfedilinkEnglisharrow-up0·24 hours ago Why change the SSH port of a home server, which most likely is not reachable from the outside anyway? And if it is, why change it on the server and not in the fw?
minus-squaretruthfultemporarily@feddit.orglinkfedilinkEnglisharrow-up0·22 hours agoIf you change it, definitely change it on the server so it shows up in netstat and is consistent.
minus-squareuranibaba@lemmy.worldlinkfedilinkEnglisharrow-up0·11 hours agoI mean keep using port 22 on the server and redirect whatever port you want in your firewall (your router unless you have a dedicted fw) to port 22. Don’t change the ssh port on the server at all.
minus-squareMordikan@kbin.earthlinkfedilinkarrow-up0·1 day agoBut you need that legal banner in case your spouse acts up and you need to throw their ass in prison.
This is mostly nonsense.
Don’t just copy random config from the internet, as annoying as it is, read the docs.
And if it is, why change it on the server and not in the fw?
If you change it, definitely change it on the server so it shows up in netstat and is consistent.
I mean keep using port 22 on the server and redirect whatever port you want in your firewall (your router unless you have a dedicted fw) to port 22. Don’t change the ssh port on the server at all.
But you need that legal banner in case your spouse acts up and you need to throw their ass in prison.