As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).
Thanks!
I’ve got systems that can detect suspicious activities in the net, which result in a shutdown of the router. And not like “could you please shut down” but a hard power off type of shutdown.
Oh, you have a setup that signals to your power source to shut off internet when it detects an anomaly on the internet? That’s quite specific, and I’m having trouble trying to understand the use-case here, but it’s definitely included in the paranoid-list. Thanks!
Now that’s the kind of paranoid I was hoping to see in here. High five, pal.
- full disk encryption on everything except the router (no point in encrypting the router)
- the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
- obviously, the SSH keys are different, so the server has a different IP in initrd. That said, I still don’t have any protection against malicious modification of initrd or UEFI
- the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
- the server scans all new SSL certificates in realtime using certspotter and notifies me of any new certificates issued for my domains that it doesn’t know about (I use Cloudflare so it triggers relatively often, but I still do checks on who the issuer is)
- firewall blocks outgoing 25 so nobody can impersonate my mailserver
You might be interested in setting up network bound encryption via Clevis and Tang. I use a hidden pi zero in my house acting as a Tang server. It’s great being able to reboot any of my encrypted servers without having to manually unlock disks.
Do you recommend any resources about this? I’d be interested in learning how to implement this.
I’m using the recently merged Clevis module for NixOS. There was a recent talk at FOSDEM about it.
I use a similar setup, but use a USB for my boot drive that has the lvs partition encryption keyfile. I find it much handier since my computer is not near my server. I can boot and then walk upstairs and it is ready, and remove the USB later.
Then there is no way to brute force the decryption or get a password out of me. Also, when the USB is removed and put in a safe place, there is no way to modify the boot partition or UEFI either.
Then I have a password encryption on my data harddrives that I don’t know the password to, but is on my password manager.
The thing about being paranoid about this stuff is that I probably focused on the wrong thing. A smash & grab is completely protected against, but that is like a 0.1% chance anyway and a 0.1% chance on top of that 0.1% chance that it would be targeted enough that they would even try to decrypt it.
Full disk encryption is really only usefully at all for an unpowered system. Network hardening will probably take care of 99.99% of attack attempts where encryption is 0.01%.
Even for a laptop, if it gets stolen in public, it is still running and can have the keys extracted or break into the running system if someone really wants to hack it. They wouldn’t even try to reboot and break the disk encryption probably…
Too much info, but I guess I am just rambling about how dumb my approach probably is 😅
- full disk encryption on everything except the router (no point in encrypting the router)
Logcheck. It took ages to make sure innocent logs are ignored, but now I get an email as soon as anything non-routine happens on my servers. I get emails with logs from every update, every time I log in, etc. This has given me the most confidence that nothing unexpected is happening on my servers. Of course, one needs to make sure that the firewall is configured well, and that you use ssh keys etc., but logcheck is how I know I’m doing enough.
Very nice idea, and it’s quite simple too. Thanks
Really all I do is setup fail2ban on my very few external services, and then put all other access behind wireguard.
Logs are clean, I’m happy.
Standard and well-tested setup. Thanks for your reply!
Using SPA firewall knocking (fwknop) to open ports to ssh in. I suppose if I was really paranoid, the most secure would be an air gap, but there’s only so much convenience I’ll give up for security.
I’m going to save your comment because it has opened up a new technique for network security that I had never thought of before. Thanks a bunch
I understand some of these words.
all buzz :P
I’m not super paranoid about security, but I do try to have a few good practices to make sure that it takes more than a bot scanning for /admin.php to find a way in.
- Anything with SSH access uses key-based auth with password auth disabled. First thing I do when spinning up a new machine
- Almost nothing is exposed directly to the Internet. I have wireguard set up on all my devices for remote access and also for extra security on public networks
- Anyone who comes to visit gets put on the “guest” network, which is a separate subnet that can’t see or talk to anything on the main network
- For any service that supports creating multiple logins, I make sure I have a separate admin user with elevated permissions, and then create a non-privileged user that I sign in on other devices with
- Every web-based service is only accessible with a FQDN which auto-redirects to HTTPS and has an actual certificate signed by a trusted CA. This is probably the most “paranoid” thing I do, because of the aforementioned not being accessible on the Internet, but it makes me happy to see the little lock symbol on my browser without having to fiddle around with trusting a self-signed cert.
Every web-based service is only accessible with a FQDN which auto-redirects to HTTPS and has an actual certificate signed by a trusted CA
I’m assuming this is in your internal network. The problem with this is that communication from the client to the reverse-proxy (unless you’re running a reverse-proxy sandboxed with each application/are directly decrypting traffic at the base of your application) is encrypted, but the traffic from the server to the reverse-proxy is not.
Definitely a consideration. In my case, the vast majority of my services are running in docker on a single host box, including the reverse proxy itself (Traefik). That unencrypted traffic never goes out over a wire, so for now I’m not concerned.
Bonus points for creating lots and lots of networks grouping the databases together with only their respective containers.
ip ais a huge mess.
- Custom Router/Firewall running OPNsense and the Sensei plugin
- Extensive DNS filtering through Pihole
- Redirecting all DNS requests to my Pihole through OPNsense
- My entire network is behind a multi hop VPN
- I don’t let any Windows systems connect to the internet, instead, I have a Linux server which is connected to the internet (through a VPN of course) and runs a browser, and I use X2go to access the browser which is running on the Linux server
Wouldn’t that last bullet mean you’re not updating the windows machines whatsoever? Would this not cause more security issues in the long run, considering “connected tot he internet” isn’t a requirement to spread an infection.
It might sound ridiculous, but I currently also run a WSUS server to get Windows updates. But I will probably replace my entire Windows setup with a better solution. Since I don’t run Windows bare-metal anymore, I’m looking forward to using offline Windows VMs on my Proxmox host and just accessing the internet directly from my Linux machine.
Since you’re running x86 for your router, do you actively prevent ME from trying to connect to the Internet?
I am aware of the ME, but I can’t really do anything about it. Current ARM SBCs are not suitable for a router/firewall (at least in my experience). I’m not that concerned about it though.
OpenWRT isn’t half bad for usual “router stuff”, but advanced usage is a bit hard to do. Of course, that doesn’t eliminate the problem since ARM can have plenty of backdoors too
I know, I tried OpenWRT on a Pi, but the experience wasn’t great (at least not as a home router).
I am clearly not paranoid enough. For a while I was running an open source router inline between the network AP and the fiber to Ethernet box and running nids but the goddamn thing kept crapping out every few days so i took it back out until I can find a more stable solution.
I have plans if I can ever get around to it. I want the smart TV, printer and other shitty things on a separate network from the more trusted devices. I don’t know how yet but I would like to set up 802.1X for the trusted stuff.
You could not connect the TV and printer to the network but instead attach them to raspberry Pi or similar devices. This allows you full control and stops them calling home and spying.
Neat post and great comments. Saved. Thanks. :)
My personal setup includes:
- non web facing homeserver for the juicy stuff
- vps with stuff I‘d barely miss if it was gone
- far too many backups
- automatic cleanup of backups so my hdds dont fill up
- fail2ban listening on every log, even docker containers with permaban enabled
- scripts are root 700 and so on
I‘m aware that stuff might go horribly wrong but so far it hasnt.
I need to start doing backups but storage costs money.
Losing stuff costs a lot more, depending on what it is. Also the stress and health risks accompanied are too much for me.
You can get backups as low as 3$/tb afaik. But I only backup stuff that actually means something to me. Photos and videos, documents and code. No movies which take up a lot of space if you copy them with all the subtitles and languages.
Hey so uhh… I just formated the wrong drive. It’s recoverable but requires terabytes of network transfers so I’m thinking you may be right.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters AP WiFi Access Point CA (SSL) Certificate Authority DNS Domain Name Service/System Git Popular version control system, primarily for code HTTP Hypertext Transfer Protocol, the Web HTTPS HTTP over SSL IP Internet Protocol NAT Network Address Translation PiHole Network-wide ad-blocker (DNS sinkhole) SBC Single-Board Computer SSH Secure Shell for remote terminal access SSL Secure Sockets Layer, for transparent encryption TLS Transport Layer Security, supersedes SSL VPN Virtual Private Network nginx Popular HTTP server
15 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #493 for this sub, first seen 6th Feb 2024, 16:55] [FAQ] [Full list] [Contact] [Source code]
Never used it “in anger” but:
I have my firewall plugged into a metered outlet (plugged into a UPS). I have it set up to send me alerts if power draw increases beyond a certain threshold. I’ve tested it and wireguard is measurable (yay) but so are DDOS attacks. If I get that alert, I can choose to turn off that plug and take my whole network offline until I get home and can sort that out.
Gotten a few false positives over the years but mostly that is just texting my partner to ask what they are doing.
Care to share what outlet you had success with? I’m comfortable with Home Assistant and ZigBee/Z-Wave. Something this critical probably shouldn’t be wireless, but I digress. I’m also interested in what software you’re using for monitoring and alerts (if you’re willing to share). Cheers!
I just use a pretty generic z-wave plug and home assistant. In the past I did more complex setups that actually determine what process is spiking and so forth. But eventually realized that “this is doing a lot of compute…” is a catch all for a LOT of potential issues.
And I guess I don’t understand what you mean by “shouldn’t be wireless”. It is inherently going to be wireless because you will be on your phone on the other side of the planet. If you genuinely suspect you will be vulnerable to attacks of this scale then you… probably have other things to worry about.
But as a safety blanket?
Gotcha. A ZigBee/Z-wave plug was the first thing that came to mind. I’ll probably go the same route. I was merely saying that wireless-anything is less dependable than wired. But I don’t even know if wired smart plugs exist. I use wireless sensors around my home and I’ve never had an issue with dependability. I definitely wasn’t considering Z-wave as a local attack vector. I was just brainstorming some way to avoid a wireless solution for something where dependability is paramount.
Or you could trigger automation that turns it off for hours, then turns it back on. That way you could get around the need to physically turn it on, in case everyone is away.
With my firewall disabled a lot of my internal network (including home assistant) will fall over sooner than later.
But that is also a recipe for mass stress. Because I know “something happened”. And now I know “in six hours, I need to check in and make sure that ‘something’ is still not happening”. Which is extra shitty if I got the notification late evening local time.
I have friends/neighbors that I trust to swing by and push a button in the event I need to bring it back up before I get home. But if I have reached the point of “it is possible my wireguard credentials were compromised?” then I really don’t need to be able to download the next episode of ATLA NOW.
Aren’t you just DoSing yourself at that point?
Nice try, attacker trying to get me to do their reconnaissance work for them. I’m on to you.
Spfff me, never Anyway please tell me more about your IP adress and your private keys.
My private key has a 3 in it
“I’m in”
Hackerman
Hey its me your friend Aaron how are you. Hey i was just wandering, what is your credit card details again? just wandering
Ok my ip address is 192.168.3.200.
Im gonna hack u now
It would be funny if that were the case. I was just hoping to be a little more paranoid from you lot and maybe improve on the things I’ve thought about
Yeah, just having a little fun in the role of a paranoid admin. My setup isn’t worth mentioning since it fits my threat model (i.e. nobody gives a shit about my network, just don’t be the low hanging fruit) but I’m interested in other replies. Hope you get some useful responses here.
I’d love to play paranoid admin over my network. Thanks!
No, honestly I’m not an attacker, but your local bank. We just need your help to update our systems. Please provide us the following credentials to continue using our phish- *ugh* services.
Credit card number: _____________
CVV: ___
Expiration date: ______
I’ve replaced reconnaissance commands (a handful of them found here: https://www.cybrary.it/blog/linux-commands-used-attackers) – whoami, uname, id, uptime, last, etc
With shell scripts which run the command but also send me a notification via pushover. I’m running several internet-facing services, and the moment those get run because someone is doing some sleuthing inside the machine, I get notified.
It doesn’t stop people getting in, I’ve set up other things for that – but on the off chance that there is some zero-day that I don’t know about yet, or they’ve traversed the network laterally somehow, the moment they run one of those commands, I know to kill-switch the entire thing.
The thing is, security is an on-going process. Leave any computer attached to the internet long enough and it’ll be gotten into. I don’t trust being able to know every method that can be used, so I use this as a backup.
That’s a very good idea. Something to think about, especially if you have open ports and are paranoid enough (aren’t we all? Hehe). Thanks
Notifications on system file access
Notifications on root login/sudo
Declarative OS, tmpfs root, disabled sudo
Bastion server, but right now I don’t have a proper router to do it at home
Yubikey, or a separate phone on Graphene OS for otp, keys, etc
Authelia + fascist fail2ban (or some CSF)
Most of these are pretty normal, but usually you don’t do them all at once 😄 also, I don’t really like hiding my services from the open internet, authelia is fine tuned to let people only access what they are supposed to. And regular users of my server usually don’t notice that I even have it
Declarative OS, tmpfs root, disabled sudo
How do you change anything about the OS/do updates? iirc nixos requires elevated privileges for that?
There are many ways to do many things in nixos
For updates you can do automatic updates
Also, there are many deployment tools, like deploy-rs, morph, colmena, bento. They all have different approaches. Some you use ssh to deploy a remote system. Some just fetch the configuration and autodeploy it.
There are many ways how you can play with this. So you can disable sudo, and deploy with ssh only from some or a specified ip. Or you can keep ssh for root disabled and just deploy home-manager. It’s really a lot, you imagination is the only limit
P.s. or you can just generate an image from a trusted machine, and flash it onto the device you want, unlimited number of ways
I’d love to hear more about your Authelia setup. I’m using Authentik, but planning to do the same thing. I haven’t opened my server up to the Internet yet (just built it on Friday), but what I’d like to do is have a webserver that supplies a login page, and you can’t access anything else until you’ve logged in
I’m a Nixos user, I wouldn’t be much help unless you do Nixos. But it’s a whole new rabbit hole which would take you months/years to learn and setup 😅
What I can say, you can do “access from home network”, “access from VPN network”, “1fa/2fa from the internet” OR “access for / and /api, but 1fa/2fa for stuff like /admin, /admin-settings, or just /login or /logged-in”
Fail2ban is fun, also maybe have a look at crowdsec
Ah, yeah, I’m running Proxmox. And I’m definitely seeing I have a lot of research to do before I open up to the internet!
I’m actually not from the “close everything, don’t open ports, always sit behind cloudflare” camp
We selfhost so we can use and share our services
There are other things we can practice instead of just isolationism and keeping everything as simple as possible
