Any guides on how to host at home? I’m always afraid that opening ports in my home router means taking the heavy risk of being hacked. Does using something like CloudFlare help? I am a complete beginner.
Any guides on how to host at home? I’m always afraid that opening ports in my home router means taking the heavy risk of being hacked. Does using something like CloudFlare help? I am a complete beginner.
What’s wrong with exposing port 22? I have password authentication disabled, ssh keys only. Isn’t that secure enough?
I do as well on a non-standard port, although that doesn’t really provide any extra security. I found ssh only login acceptably secure personally, but it’s definitely less secure than tailscale which can operate with 0 open ports. The risk would be from os/sshd vulnerabilities that can be exploited. As long as you keep the router up to date it should be safe enough.
Why would you expose SSH on a home production server?
Hosting several dockerized apps for friends since years. Only 80/443 proxy ports are open. Apps are secured with 2FA and monitored by fail2ban + kept up-to-date. Never had any issue.
It’s for the chance that I need to administer my cluster when I am not on my LAN. I can set up a port forward to the externally accessible port and everything works as normal like I’m on my LAN. Non-default port, password auth disabled, ssh with root disabled (so you have to have my user and ssh key) and limited ssh connection attempts before ban. I can toggle it on or off with a check box on my router. Yes, I understand there are other ways that are even more secure, yes I understand the risks, but for my circumstances this was a good balance of convenience and security. I’ve also never had an issue :).
Add VPN and you made the best out of it :)
Why not? Openssh has proven itself to be reasonable secure. Porbably more research went into its security then most apps you are hosting.
I think it’s not so much “insecure” as that it’s that external SSH access is less secure than no access. And for home-managed systems exposed externally, I would recommend a smaller attack area.