As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

    • @MigratingtoLemmy@lemmy.worldOP
      link
      fedilink
      English
      105 months ago

      It would be funny if that were the case. I was just hoping to be a little more paranoid from you lot and maybe improve on the things I’ve thought about

      • @betterdeadthanreddit@lemmy.world
        link
        fedilink
        English
        125 months ago

        Yeah, just having a little fun in the role of a paranoid admin. My setup isn’t worth mentioning since it fits my threat model (i.e. nobody gives a shit about my network, just don’t be the low hanging fruit) but I’m interested in other replies. Hope you get some useful responses here.

    • @hakunawazo@lemmy.world
      link
      fedilink
      English
      3
      edit-2
      5 months ago

      No, honestly I’m not an attacker, but your local bank. We just need your help to update our systems. Please provide us the following credentials to continue using our phish- *ugh* services.

      Credit card number: _____________
      CVV: ___
      Expiration date: ______

  • @thantik@lemmy.world
    link
    fedilink
    English
    13
    edit-2
    5 months ago

    I’ve replaced reconnaissance commands (a handful of them found here: https://www.cybrary.it/blog/linux-commands-used-attackers) – whoami, uname, id, uptime, last, etc

    With shell scripts which run the command but also send me a notification via pushover. I’m running several internet-facing services, and the moment those get run because someone is doing some sleuthing inside the machine, I get notified.

    It doesn’t stop people getting in, I’ve set up other things for that – but on the off chance that there is some zero-day that I don’t know about yet, or they’ve traversed the network laterally somehow, the moment they run one of those commands, I know to kill-switch the entire thing.

    The thing is, security is an on-going process. Leave any computer attached to the internet long enough and it’ll be gotten into. I don’t trust being able to know every method that can be used, so I use this as a backup.

    • @MigratingtoLemmy@lemmy.worldOP
      link
      fedilink
      English
      45 months ago

      That’s a very good idea. Something to think about, especially if you have open ports and are paranoid enough (aren’t we all? Hehe). Thanks

  • @Treczoks@lemmy.world
    link
    fedilink
    English
    35 months ago

    I’ve got systems that can detect suspicious activities in the net, which result in a shutdown of the router. And not like “could you please shut down” but a hard power off type of shutdown.

    • @MigratingtoLemmy@lemmy.worldOP
      link
      fedilink
      English
      35 months ago

      Oh, you have a setup that signals to your power source to shut off internet when it detects an anomaly on the internet? That’s quite specific, and I’m having trouble trying to understand the use-case here, but it’s definitely included in the paranoid-list. Thanks!

  • @agent_flounder@lemmy.world
    link
    fedilink
    English
    15 months ago

    I am clearly not paranoid enough. For a while I was running an open source router inline between the network AP and the fiber to Ethernet box and running nids but the goddamn thing kept crapping out every few days so i took it back out until I can find a more stable solution.

    I have plans if I can ever get around to it. I want the smart TV, printer and other shitty things on a separate network from the more trusted devices. I don’t know how yet but I would like to set up 802.1X for the trusted stuff.

    • @JoeKrogan@lemmy.world
      link
      fedilink
      English
      15 months ago

      You could not connect the TV and printer to the network but instead attach them to raspberry Pi or similar devices. This allows you full control and stops them calling home and spying.

  • @Dehydrated@lemmy.world
    link
    fedilink
    English
    35 months ago
    • Custom Router/Firewall running OPNsense and the Sensei plugin
    • Extensive DNS filtering through Pihole
    • Redirecting all DNS requests to my Pihole through OPNsense
    • My entire network is behind a multi hop VPN
    • I don’t let any Windows systems connect to the internet, instead, I have a Linux server which is connected to the internet (through a VPN of course) and runs a browser, and I use X2go to access the browser which is running on the Linux server
      • @Dehydrated@lemmy.world
        link
        fedilink
        English
        15 months ago

        I am aware of the ME, but I can’t really do anything about it. Current ARM SBCs are not suitable for a router/firewall (at least in my experience). I’m not that concerned about it though.

        • @MigratingtoLemmy@lemmy.worldOP
          link
          fedilink
          English
          25 months ago

          OpenWRT isn’t half bad for usual “router stuff”, but advanced usage is a bit hard to do. Of course, that doesn’t eliminate the problem since ARM can have plenty of backdoors too

  • @lntl@lemmy.ml
    link
    fedilink
    English
    15 months ago

    npftables blocks all incoming except a particular set of ips. any connections from those ips hit pubkey authentication.

    I’ve never had a problem

  • @hperrin@lemmy.world
    link
    fedilink
    English
    2
    edit-2
    5 months ago

    I have Nginx Proxy Manager set up to let me access services running HTTP on other ports on the machine with a local network only access list just so my traffic even in my own network will use TLS. The likelihood that anyone is sniffing traffic on my own network is extremely small, but I’m paranoid. (Can’t let anyone see that I’m running Ubuntu Server. How embarrassing.)

  • @JoeKrogan@lemmy.world
    link
    fedilink
    English
    2
    edit-2
    5 months ago

    Only remote access by wireguard and ssh on non standard port with key based access.

    Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns

    Logs are encrypted and mailed off site daily

    System updates over tor connecting to onion repos.

    Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.

    Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.

    I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.

    Linux only on the main network.

    I also make sure to backup often.

  • Presi300
    link
    fedilink
    English
    1
    edit-2
    5 months ago

    Mine’s pretty simple, I have a “don’t open ports until ABSOLUTELY NECESSARY” policy, wireguard works well enough for everything else I need to access remotely. I also keep SSH disabled on any machine that has direct access to the internet.

  • @easeKItMAn@lemmy.world
    link
    fedilink
    English
    35 months ago

    I’m somewhat paranoid therefore running several isolated servers. And it’s still not bulletproof and will never be!

    • only the isolated server, ie. no internet access, can fetch data from the other servers but not vice versa.
    • SSH access key based only
    • Firewall dropping all but non-standard ports on dedicated subnets
    • Fail2ban drops after 2 attempts
    • Password length min 24 characters, 2FA, password rotation every 6 months
    • Guest network for friends, can’t access any internal subnet
    • Reverse proxy (https;443 port only)
    • Any service is accessed by a non-privileged user
    • Isolated docker services/databases and dedicated docker networks
    • every drive + system Luks-encrypted w/ passphrase only
    • Dedicated server for home automation only
    • Dedicated server for docker services and reverse proxy only
    • Isolated data/backup server sharing data to a tv box and audio system without network access via nfs
    • Offsite data/backup server via SSH tunnel hosted by a friend
    • @MigratingtoLemmy@lemmy.worldOP
      link
      fedilink
      English
      15 months ago

      Would you have to compromise on your security according to your threat model if you ran VMs rather than dedicated devices? I’m no security engineer and I don’t know if KVM/QEMU can fit everyones needs, but AWS uses XCP-ng, and unless they’re using a custom version of it, all changes are pushed upstream. I’d definitely trust AWS’ underlying virtualisation layer for my VMs, but I wonder if I should go with XCP or KVM or bhyve.

      This is my personal opinion, but podman’s networking seems less difficult to understand than Docker. Docker was a pain the first time I was reading about the networking in it.

      Really like your setup. Do you have any plans to make it more private/secure?

      • @easeKItMAn@lemmy.world
        link
        fedilink
        English
        0
        edit-2
        5 months ago

        I used VMs some time ago but never managed to look deeper into separation of bare metal vs VMs. Hence I can’t assess this reasonably.
        Docker got me interested when it started and after discovering its networking capabilities I never looked back.
        Basically I’m trying to minimize the possibility that by intercepting one dockerized service the attacker is able to start interacting with all devices. And I have lots of devices because of a fully automated house. ;) My paranoia will ensure the constant growth of privacy and security :)

  • @chayleaf@lemmy.ml
    link
    fedilink
    English
    4
    edit-2
    5 months ago
    • full disk encryption on everything except the router (no point in encrypting the router)
      • the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
        • obviously, the SSH keys are different, so the server has a different IP in initrd. That said, I still don’t have any protection against malicious modification of initrd or UEFI
    • the server scans all new SSL certificates in realtime using certspotter and notifies me of any new certificates issued for my domains that it doesn’t know about (I use Cloudflare so it triggers relatively often, but I still do checks on who the issuer is)
    • firewall blocks outgoing 25 so nobody can impersonate my mailserver
    • @refreeze@lemmy.world
      link
      fedilink
      English
      15 months ago

      You might be interested in setting up network bound encryption via Clevis and Tang. I use a hidden pi zero in my house acting as a Tang server. It’s great being able to reboot any of my encrypted servers without having to manually unlock disks.

      • @tapdattl@lemmy.world
        link
        fedilink
        English
        25 months ago

        Do you recommend any resources about this? I’d be interested in learning how to implement this.

        • @refreeze@lemmy.world
          link
          fedilink
          English
          25 months ago

          I’m using the recently merged Clevis module for NixOS. There was a recent talk at FOSDEM about it.

      • @chayleaf@lemmy.ml
        link
        fedilink
        English
        15 months ago

        I know about it, but it kinda defeats the purpose (the purpose being police raid protection)

      • @chayleaf@lemmy.ml
        link
        fedilink
        English
        15 months ago

        there’s not much to know about it, I use Cloudflare simply because its routing is better than direct IP connections for many places on Earth. I can’t fully use Cloudflare anyway because I host many non-web services.