Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)N

nibbs

@ nibbs @lemmy.zip

Posts
1
Comments
10
Joined
3 wk. ago

  • fail2ban behind reverse proxy (nom)

    Jump

  • Thanks for the suggestion, I will take a look at Anubis.

    There are no SSH ports open to external, as everything I run is locally in my LAN, I do not have use for externals SSH access and don't want to open that vector.

    The services that I (want to) offer to the family, are the common selfhosters finest:

    • immich
    • Stirling PDF
    • Jellyfin

    As I do not have a authentication provider yet, the services which require an authentication by user/password are prone to brute force attacks, I want to mitigate that first and foremost.In the mid to long run, I plan to also deploy an authentication provider for those services like Authelia, TinyAuth, PocketID, Authentik or

    <you name it>

    .As there are so many of them and the opinion of which is best differ wildly, I have not yet decided and am in kind of a analysis paralysis. :)

  • fail2ban behind reverse proxy (nom)

    Jump

  • Thank you for bringing that up, I was wondering that too. As in: "This one has something to hide. Let's poke harder."

    Did you try CrowdSec as someone else suggested? Could that be a mitigation as those IPs could be filtered out in the long run, if I understand the concept of CS correct?

  • fail2ban behind reverse proxy (nom)

    Jump

  • Thank you for suggesting the region block on Unifi, that's a good tip.

    I have that previously set in place globally under settings -> security -> protection -> region blocking.So on a less sophisticated level and not as granular as you.Yours seems to be much better and I will take a look at it later. At the moment I have way too many ideas and projects boiling, to add yet another one... ;)

  • fail2ban behind reverse proxy (nom)

    Jump

  • Thanks for bringing it up.

    Before I dove into that project, I was checking logs on npm and the service I am already exposing. It seems to me, both only get http GET requests which on npm all get a 404 response.I don't remember what the service does with those, but I will investigate later. As I didn't panicked, I guess it wasn't that bad.

    There are basically no brute force attacks on the service yet and the admin account is only allowed to login from internal IPs.

    One initial aspect to further harden the exposed systems were the logs in the UDM which show frequent blocked attempts of varying severity.This may be security theater and I am not able to assess whether the UDM is a "good enough" protection of the most common attacks.

    As I see it, at the moment the UDM already blocks most of the (more sophisticated) attacks and leaves only common requests for the services to handle.

    Long story short, as I see it, the UDM has the role of ingress server in my setup.

  • fail2ban behind reverse proxy (nom)

    Jump

  • Thank you very much for your input. I will look into the third option.Thought of it, but did forget it over tinkering the last few days. :)

  • Selfhosted @lemmy.world
    nibbs @lemmy.zip

    fail2ban behind reverse proxy (nom)

  • A researcher bought noreply.net. Companies started sending him secrets.

    Jump

  • As you say, "at the time, a reasonable decision". What I don't understand tho, is, why nobody, for five seconds, maybe thought, how it could be a good idea to just filter this standard address at the SMTP server to be redirected to something sensible inside the org. My best guess is, different departments / sub orgs.

  • Are there any technology-oriented content creators that are still good?

    Jump

  • I enjoy apalrd very much, down to earth, deep dive, no bullshit explanatory videos mostly about networking.

  • Netflix is garbage

    Jump

  • Improve very slow library scans on Jellyfin 10.11 / 12 on spinning media

    Jump

  • Hi, could you tell me why? I mean, I think I understand the basics of the risk of brute force attacks. My mitigation for the admin account is, not to allow login outside the local network. Users are allowed from anywhere, as my family uses the library. Also my service (there are others) are routed through NGINX.

    Do you have tips for external users using, for example, a VPN only for specific addresses / IPs? At least that was an idea I had, but didn't got got around to dig for solutions.

    Thanks in advance.