4 ms·
The downside is that if you’re on a two-week vacation and your home network/server goes down on day two, there’s probably nothing you can do until you get home.
by rafram 1y ago
The downside is that if you’re on a two-week vacation and your home network/server goes down on day two, there’s probably nothing you can do until you get home. If it’s hosted online, you can count on that 99.99…% uptime and SSH access no matter what.
- jauntywundrkind 1y agoSsh exposed on a non-standard port, with root disabled, using key-based auth should be pretty non-controversial. The security through obscurity (non-standard port, no root) are both kinda silly but why not. That said, with awesome services like TailScale, it's pretty hard to get locked out of your network. TailScale is so so good at "just working".
- accrual 1y agoFail2ban or rate-limiting SSH into a block table are useful layers to have as well.
- batch12 1y ago> The security through obscurity (non-standard port, no root) are both kinda silly but why not I think these are decent controls when layered with others. The effectiveness differs depending on your threat models, of course, but at the very least it helps reduce the noise seen from most automated scans reducing the effort involved in monitoring your assets.
- cyberax 1y agoAnother option is port knocking. Super easy to set up and with 4 knocks it provides 64 bits of randomness.
- radlad 1y agoDisabling root provides more than security-through-obscurity if your sudo config requires a password to elevate: it essentially means you need both your SSH private key and your password to gain root.
- vhanda 1y agoI think what they meant is that if it's hosted online / home-network, only allow access to all services through a VPN. Wireguard is relatively easy to setup, and you can configure all your services to only be available through wireguard. Ever since ssh almost got backdoor-ed, the only thing "exposed" on my servers is Wireguard, which is UDP based and therefore harder to know if it's running. SSH also goes over wireguard.
- blooalien 1y ago> ... Wireguard, which is UDP based and therefore harder to know if it's running. Isn't it basically impossible to know if it's running unless you have an authorize key? I thought it didn't respond at all unless you ping a valid entry key off it.
- vhanda 1y agoWell, there is packet inspection. My ISP / Government will know.
- Zambyte 1y agoThese solutions are composable. Just run it on a VPS over a VPN.
- rafram 1y agoThat’s a good point.
- bloqs 1y agoBut what if your home hypervisor goes down?
- Zambyte 1y agoNothing. You probably though I said "VPN over a VPS", which would just be the same as a VPN, which isn't composing the solutions.
- akerl_ 1y agoYou're suggesting to use a VPS in a thread that's specifically about self-hosting on a home network, and about there being cons to that compared to hosting on a cloud/VPS platform. So you're sort of driving parallel to the existing commentary.
- Zambyte 1y agoThe parent comment to mine did that.
- shellwizard 1y agoIf you trust someone in your neighborhood/family, you can ask them to power cycle your host and water your plants
- accrual 1y agoAlthough not perfect, I added a couple features to help ensure uptime: * LAN components are on a UPS, helps keep continuity between power blips and breaker flips * Dynamic DNS, cron runs a script 4x per day to ensure a DNS name points to my IP, even if issued a new one by the ISP * Rebooting everything occasionally to ensure the network and services come back up on their own and I didn't make a mistake with some config that loads at boot, etc.
- dpkirchner 1y agoI run Tailscale on an Apple TV which is on a UPS. The thing uses very little power so the UPS lasts a long, long time.
- rasen58 1y agoDo you have to hack the Apple TV to run tailscale on it or how does that work?
- dpkirchner 1y agoThere's an official tvOS app and you just have to configure the Apple TV to be an exit node. It doesn't require any special setup otherwise.
- sammyteee 1y agoYou can also enjoy your vacation instead :)