3 ms·

install ubuntu server either locally or on a cheap VM read the ubuntu server docs about setting up a firewall and get started setting up a firewall that only

install ubuntu server either locally or on a cheap VM read the ubuntu server docs about setting up a firewall and get started setting up a firewall that only allows inbound ssh and https ( be careful and don't firewall yourself out of your system! :) ) https://ubuntu.com/server/docs/security-firewall https://ubuntu.com/server/docs/security-firewall from there, read the docs on setting up a webserver and create an index.html with just the text "hello world" https://ubuntu.com/server/docs/web-servers-apache https://ubuntu.com/server/docs/web-servers-apache from there, read and learn how to setup letsencrypt as manual as possible https://letsencrypt.org/how-it-works/ https://letsencrypt.org/how-it-works/ buy a domain and learn how to setup A records to point your domain to your external IP. Your domain registrar will allow you to make your own dns records https://www.cloudflare.com/learning/dns/dns-records/dns-a-record/ https://www.cloudflare.com/learning/dns/dns-records/dns-a-re... if you can get https://mycustomdomain.com/index.html https://mycustomdomain.com/index.html to output hello world in your browser with no certificate warnings then you've learned enough to start tackling self-hosting some packaged service out there. You'll at least know enough to know what to search for when looking for answers. if you're installing all this on a computer in your home network then you'll need to login to your home router and port forward 443 to your ubuntu server. This would be a good learning experience too https://en.wikipedia.org/wiki/Port_forwarding https://en.wikipedia.org/wiki/Port_forwarding edit: if you're looking for hardware to buy i've heard mac minis work really well for home servers. you wouldn't be installing ubuntu server in that case, you'd be following mac docs for firewalling and webserver setup.

xz18r 4y ago
I do basically this, plus I add WAF rules in Cloudflare to block access from any other country than my own (I live in a 1X mio country so no USA, Russia, China). Do I need to set up e.g. Tailscale etc to make it more secure?
- chasd00 4y ago
  well security is a very broad and deep problem. Keeping these things in mind will get you pretty far. 1. For firewalling, only allow what you need. For example, if your server is in your home then you don't need to forward port 22 in your router. You'll always be logging in to your server from your local network. 2. For services, see #1. if your using a linux distro that starts up a ton of server services you don't need then turn them off. 3. To secure specific services like sshd read their setup docs. SSHD, Nginx, Apache all have very good documentation on operating a secure server. having said that, i don't think a VPN makes you more secure. Are you saying running a vpn endpoint on your server so that you can connect to it from outside your local network? like at a cafe or something? If you're connecting over SSH then i don't think so because SSH is already encrypted ( that's the "secure" in secure shell) and if you follow the SSH docs on secure connection best practice like disabling password auth and using keys then you're in pretty good shape.
kickaha 4y ago
Super helpful list. Thanks!

xz18r 4y ago

I do basically this, plus I add WAF rules in Cloudflare to block access from any other country than my own (I live in a 1X mio country so no USA, Russia, China). Do I need to set up e.g. Tailscale etc to make it more secure?

chasd00 4y ago
well security is a very broad and deep problem. Keeping these things in mind will get you pretty far. 1. For firewalling, only allow what you need. For example, if your server is in your home then you don't need to forward port 22 in your router. You'll always be logging in to your server from your local network. 2. For services, see #1. if your using a linux distro that starts up a ton of server services you don't need then turn them off. 3. To secure specific services like sshd read their setup docs. SSHD, Nginx, Apache all have very good documentation on operating a secure server. having said that, i don't think a VPN makes you more secure. Are you saying running a vpn endpoint on your server so that you can connect to it from outside your local network? like at a cafe or something? If you're connecting over SSH then i don't think so because SSH is already encrypted ( that's the "secure" in secure shell) and if you follow the SSH docs on secure connection best practice like disabling password auth and using keys then you're in pretty good shape.

kickaha 4y ago

Super helpful list. Thanks!