I've been running self-hosted servers for the last 25+ years without an incident and its less complicated than it might seem if you learn a bit about securing u

I've been running self-hosted servers for the last 25+ years without an incident and its less complicated than it might seem if you learn a bit about securing unix-based systems (ok, I already had 10+ years of server admin knowhow for various systems, but anyway, it's not rocket science ;-). Yes, an hour or so after you connect any machine to the Internet, you'll see attempts to "talk" to your server. So don't wait to set up basic security. But it actually has never been so easy to "just give it a try" (see below), with all the virtual offerings today. So here's a short/raw sketch of basic things you'd need to do: 1. 25+ years ago I used http://easyfwgen.morizot.net/ http://easyfwgen.morizot.net/ to generate an iptables based local firewall. Still works fine (then and now tweaking some things) and allows only certain ports too be accessed at all. I just open email, ssh and a web server. The generator is well documented and still works, although it would be nice to see an updated version to newer firewall software like pf. 2. server configs: edit /etc/hosts.deny --> restrict all by default ALL: ALL edit /etc/hosts.allow --> allow your service providers networks, e.g. sshd: .t-dialin.net sshd: .dip0.t-ipconnect.de So you can connect to your machine for further setup, but not the whole world. 3. set up sshd: edit /etc/ssh/sshd.config # allow key-based access only PasswordAuthentication no Maybe change sshd's port (reduces log file entries) but don't forget to allow this port in your iptables setup and your /etc/hosts.allow People have opinions an key-based access, I know. But my private and public key is stored in various secure locations, including my phone (password safe) and I can access my server even from my Android phone or tables via Termux. 4. set up email (I suggest postfix as an MTA): configure restrictions in /etc/postfix/main.cf, e.g. # restrictions in the context of the RCPT TO command smtpd_recipient_restrictions = reject_invalid_hostname, reject_non_fqdn_hostname, reject_non_fqdn_sender, reject_non_fqdn_recipient, check_sender_access hash:/etc/postfix/sender_access, reject_unknown_sender_domain, reject_unknown_recipient_domain, permit_mynetworks, reject_unauth_destination, [...] # restrictions for clients connecting smtpd_client_restrictions = reject_unauth_destination, check_client_access hash:/etc/postfix/access_client, reject_unknown_client, reject_unauth_pipelining This heavily reduces the amount of spam you'll see. I add greylisting too, as this even nowadays reduces even more unwanted traffic. Combine that with spamassassin if you like. This setup gives me maybe one spam per day reaching my inbox (actually the spam subfolder). 5. Learn by doing (not just reading stuff on the Internets ;-), that is, set up a machine, e.g. If you'd like to experiment a bit, take a look at Hetzner's unexpensive cloud servers, these are easy to set up (incl. a virtual firewall in front of it) and take down after some experiments of a failure. You can do this in Hetzner's web interface, even if you misconfigure your server to be unaccessible. Cf. https://docs.hetzner.com/cloud/servers/overview/ https://docs.hetzner.com/cloud/servers/overview/ Tip: Hetzner's web interface allows you to pre-define an ssh key which they'll install automatically on your new machine (but they leave password login enabled, so change that asap). Disclaimer: I'm just a happy customer, no other relation. And it might be as easy to do this with Digital Ocean, which have some nice tutorials too, for example on the set up of a web server: https://www.digitalocean.com/community/tutorials/how-to-install-the-apache-web-server-on-ubuntu-20-04 https://www.digitalocean.com/community/tutorials/how-to-inst... Last but not least No Starch Press overs some nice books like "How Linux Works" or "The Linux Command Line" (if you're not sure about that) or even "Linux Firewalls: Attack Detection and Response" ... You learn most by trying. I'm now heading for the beach to enjoy some offline adventures and will answer questions later if needed.