Any guides on how to host at home? I’m always afraid that opening ports in my home router means taking the heavy risk of being hacked. Does using something like CloudFlare help? I am a complete beginner.

Edit: Thanks for all the great response! They are very helpful.

  • easeKItMAn@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    1
    ·
    edit-2
    1 year ago

    Why would you expose SSH on a home production server?
    Hosting several dockerized apps for friends since years. Only 80/443 proxy ports are open. Apps are secured with 2FA and monitored by fail2ban + kept up-to-date. Never had any issue.

    • ShortN0te@lemmy.ml
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Why not? Openssh has proven itself to be reasonable secure. Porbably more research went into its security then most apps you are hosting.

      • easeKItMAn@lemmy.world
        link
        fedilink
        English
        arrow-up
        0
        arrow-down
        1
        ·
        1 year ago

        I think it’s not so much “insecure” as that it’s that external SSH access is less secure than no access. And for home-managed systems exposed externally, I would recommend a smaller attack area.

    • macgregor@lemmy.world
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 year ago

      It’s for the chance that I need to administer my cluster when I am not on my LAN. I can set up a port forward to the externally accessible port and everything works as normal like I’m on my LAN. Non-default port, password auth disabled, ssh with root disabled (so you have to have my user and ssh key) and limited ssh connection attempts before ban. I can toggle it on or off with a check box on my router. Yes, I understand there are other ways that are even more secure, yes I understand the risks, but for my circumstances this was a good balance of convenience and security. I’ve also never had an issue :).

        • macgregor@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          1 year ago

          If I am trying to fix problems with my cluster or the baremetal hosts they are running on, I can’t rely on the VPN access running on those nodes, which means I need dedicated reliable hardware acting as a bastion. Right now all I have for that is my router. Home routers have awkward limitations for installing and configuring software even if you are running better custom firmware like FreshTomato or OpenWRT, making them an edge case for “just” set up a VPN. Yes I played around with making it work. Yes, I could make it work if I sunk enough effort in to it, but again, I found it acceptably secure to simply enable remote ssh access.

          I do suggest talescale all the time for most people though. It’s cool tech, their blog is fantastic. I’m looking forward to having a proper network switch one day and I’ll revisit the issue.