As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).
Thanks!
Nice try, attacker trying to get me to do their reconnaissance work for them. I’m on to you.
It would be funny if that were the case. I was just hoping to be a little more paranoid from you lot and maybe improve on the things I’ve thought about
Yeah, just having a little fun in the role of a paranoid admin. My setup isn’t worth mentioning since it fits my threat model (i.e. nobody gives a shit about my network, just don’t be the low hanging fruit) but I’m interested in other replies. Hope you get some useful responses here.
I’d love to play paranoid admin over my network. Thanks!
No, honestly I’m not an attacker, but your local bank. We just need your help to update our systems. Please provide us the following credentials to continue using our phish- *ugh* services.
Credit card number: _____________
CVV: ___
Expiration date: ______Spfff me, never Anyway please tell me more about your IP adress and your private keys.
My private key has a 3 in it
“I’m in”
Hackerman
Hey its me your friend Aaron how are you. Hey i was just wandering, what is your credit card details again? just wandering
My most paranoid config is disabling Ipv4
That’s it. If someone wants to attack me, they will need to adopt IPv6!
I’ve replaced reconnaissance commands (a handful of them found here: https://www.cybrary.it/blog/linux-commands-used-attackers) – whoami, uname, id, uptime, last, etc
With shell scripts which run the command but also send me a notification via pushover. I’m running several internet-facing services, and the moment those get run because someone is doing some sleuthing inside the machine, I get notified.
It doesn’t stop people getting in, I’ve set up other things for that – but on the off chance that there is some zero-day that I don’t know about yet, or they’ve traversed the network laterally somehow, the moment they run one of those commands, I know to kill-switch the entire thing.
The thing is, security is an on-going process. Leave any computer attached to the internet long enough and it’ll be gotten into. I don’t trust being able to know every method that can be used, so I use this as a backup.
That’s a very good idea. Something to think about, especially if you have open ports and are paranoid enough (aren’t we all? Hehe). Thanks
My security is fairly simplistic but I’m happy with it
-
software protection
- fail2ban with low warning hold
- cert based login for ssh (no password Auth)
- Honeypot on all common port numbers, which if pinged leads to a permanent IP ban
- drop all firewall
- PSAD for intrusion/scanning protection (so many Russian scanners… lol)
- wireguard for VPN to access local virtual machines and resources
- external VPN with nordVPN for secure containers (yes I know nord is questionable I plan to swap when my sub runs out)
-
physical protection
- luksCrypt on the sensitive Data/program Drive ( I know there’s some security concerns with luksCrypt bite me)
- grub and bios locked with password
- UPS set to auto notify on power outage
- router with keep alive warning system that pings my phone if the lab goes offline and provides fallback dns
-
things I’ve thought about:
- a mock recovery partition entry that will nuke the Luks headers on entry (to prevent potential exploit getting through grub)
- removing super user access completely outside of local user access
What honeypot are you using?
deleted by creator
-
Using SPA firewall knocking (fwknop) to open ports to ssh in. I suppose if I was really paranoid, the most secure would be an air gap, but there’s only so much convenience I’ll give up for security.
I’m going to save your comment because it has opened up a new technique for network security that I had never thought of before. Thanks a bunch
Only remote access by wireguard and ssh on non standard port with key based access.
Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns
Logs are encrypted and mailed off site daily
System updates over tor connecting to onion repos.
Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.
Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.
I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.
Linux only on the main network.
I also make sure to backup often.
System updates over tor connecting to onion repos.
How does this help, assuming your DNS isn’t being spoofed?
Please see my reply below with links.
Thanks, never thought of that before. I’ll certainly try it, great way to help the network!
- Custom Router/Firewall running OPNsense and the Sensei plugin
- Extensive DNS filtering through Pihole
- Redirecting all DNS requests to my Pihole through OPNsense
- My entire network is behind a multi hop VPN
- I don’t let any Windows systems connect to the internet, instead, I have a Linux server which is connected to the internet (through a VPN of course) and runs a browser, and I use X2go to access the browser which is running on the Linux server
Since you’re running x86 for your router, do you actively prevent ME from trying to connect to the Internet?
I am aware of the ME, but I can’t really do anything about it. Current ARM SBCs are not suitable for a router/firewall (at least in my experience). I’m not that concerned about it though.
OpenWRT isn’t half bad for usual “router stuff”, but advanced usage is a bit hard to do. Of course, that doesn’t eliminate the problem since ARM can have plenty of backdoors too
I know, I tried OpenWRT on a Pi, but the experience wasn’t great (at least not as a home router).
Wouldn’t that last bullet mean you’re not updating the windows machines whatsoever? Would this not cause more security issues in the long run, considering “connected tot he internet” isn’t a requirement to spread an infection.
It might sound ridiculous, but I currently also run a WSUS server to get Windows updates. But I will probably replace my entire Windows setup with a better solution. Since I don’t run Windows bare-metal anymore, I’m looking forward to using offline Windows VMs on my Proxmox host and just accessing the internet directly from my Linux machine.
I’m not super paranoid about security, but I do try to have a few good practices to make sure that it takes more than a bot scanning for /admin.php to find a way in.
- Anything with SSH access uses key-based auth with password auth disabled. First thing I do when spinning up a new machine
- Almost nothing is exposed directly to the Internet. I have wireguard set up on all my devices for remote access and also for extra security on public networks
- Anyone who comes to visit gets put on the “guest” network, which is a separate subnet that can’t see or talk to anything on the main network
- For any service that supports creating multiple logins, I make sure I have a separate admin user with elevated permissions, and then create a non-privileged user that I sign in on other devices with
- Every web-based service is only accessible with a FQDN which auto-redirects to HTTPS and has an actual certificate signed by a trusted CA. This is probably the most “paranoid” thing I do, because of the aforementioned not being accessible on the Internet, but it makes me happy to see the little lock symbol on my browser without having to fiddle around with trusting a self-signed cert.
Every web-based service is only accessible with a FQDN which auto-redirects to HTTPS and has an actual certificate signed by a trusted CA
I’m assuming this is in your internal network. The problem with this is that communication from the client to the reverse-proxy (unless you’re running a reverse-proxy sandboxed with each application/are directly decrypting traffic at the base of your application) is encrypted, but the traffic from the server to the reverse-proxy is not.
Definitely a consideration. In my case, the vast majority of my services are running in docker on a single host box, including the reverse proxy itself (Traefik). That unencrypted traffic never goes out over a wire, so for now I’m not concerned.
Bonus points for creating lots and lots of networks grouping the databases together with only their respective containers.
ip ais a huge mess.
- full disk encryption on everything except the router (no point in encrypting the router)
- the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
- obviously, the SSH keys are different, so the server has a different IP in initrd. That said, I still don’t have any protection against malicious modification of initrd or UEFI
- the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
- the server scans all new SSL certificates in realtime using certspotter and notifies me of any new certificates issued for my domains that it doesn’t know about (I use Cloudflare so it triggers relatively often, but I still do checks on who the issuer is)
- firewall blocks outgoing 25 so nobody can impersonate my mailserver
Thanks, I’d like to know more about your public-facing setup using cloudflare
there’s not much to know about it, I use Cloudflare simply because its routing is better than direct IP connections for many places on Earth. I can’t fully use Cloudflare anyway because I host many non-web services.
You might be interested in setting up network bound encryption via Clevis and Tang. I use a hidden pi zero in my house acting as a Tang server. It’s great being able to reboot any of my encrypted servers without having to manually unlock disks.
Do you recommend any resources about this? I’d be interested in learning how to implement this.
I’m using the recently merged Clevis module for NixOS. There was a recent talk at FOSDEM about it.
I know about it, but it kinda defeats the purpose (the purpose being police raid protection)
- full disk encryption on everything except the router (no point in encrypting the router)
I’m somewhat paranoid therefore running several isolated servers. And it’s still not bulletproof and will never be!
- only the isolated server, ie. no internet access, can fetch data from the other servers but not vice versa.
- SSH access key based only
- Firewall dropping all but non-standard ports on dedicated subnets
- Fail2ban drops after 2 attempts
- Password length min 24 characters, 2FA, password rotation every 6 months
- Guest network for friends, can’t access any internal subnet
- Reverse proxy (https;443 port only)
- Any service is accessed by a non-privileged user
- Isolated docker services/databases and dedicated docker networks
- every drive + system Luks-encrypted w/ passphrase only
- Dedicated server for home automation only
- Dedicated server for docker services and reverse proxy only
- Isolated data/backup server sharing data to a tv box and audio system without network access via nfs
- Offsite data/backup server via SSH tunnel hosted by a friend
Why would you rotate passsord though?
Rather choose something random and strong than changing it every 6th moon.Rotating passwords only for web services. Vaultwarden does make it easy. Not all services allow 2FA.
Sounds still excessive but that’s what the thread is here for.
Would probably understand it more if I knew more aspects.Cheers to more cybersec :)
Guessing it is more a habit from back in time when ssl certification wasn’t common. Panic of MITM attacks, friends sharing their trusted access to other friends, etc. all contributed to my actual status of paranoia.
Don’t make me reconsider my cybersec approach ;)You could always add another layer ;D
Would you have to compromise on your security according to your threat model if you ran VMs rather than dedicated devices? I’m no security engineer and I don’t know if KVM/QEMU can fit everyones needs, but AWS uses XCP-ng, and unless they’re using a custom version of it, all changes are pushed upstream. I’d definitely trust AWS’ underlying virtualisation layer for my VMs, but I wonder if I should go with XCP or KVM or bhyve.
This is my personal opinion, but podman’s networking seems less difficult to understand than Docker. Docker was a pain the first time I was reading about the networking in it.
Really like your setup. Do you have any plans to make it more private/secure?
I used VMs some time ago but never managed to look deeper into separation of bare metal vs VMs. Hence I can’t assess this reasonably.
Docker got me interested when it started and after discovering its networking capabilities I never looked back.
Basically I’m trying to minimize the possibility that by intercepting one dockerized service the attacker is able to start interacting with all devices. And I have lots of devices because of a fully automated house. ;) My paranoia will ensure the constant growth of privacy and security :)
Notifications on system file access
Notifications on root login/sudo
Declarative OS, tmpfs root, disabled sudo
Bastion server, but right now I don’t have a proper router to do it at home
Yubikey, or a separate phone on Graphene OS for otp, keys, etc
Authelia + fascist fail2ban (or some CSF)
Most of these are pretty normal, but usually you don’t do them all at once 😄 also, I don’t really like hiding my services from the open internet, authelia is fine tuned to let people only access what they are supposed to. And regular users of my server usually don’t notice that I even have it
Following for my own edification!
Hope I get a lot of good answers!
I’ve got systems that can detect suspicious activities in the net, which result in a shutdown of the router. And not like “could you please shut down” but a hard power off type of shutdown.
Oh, you have a setup that signals to your power source to shut off internet when it detects an anomaly on the internet? That’s quite specific, and I’m having trouble trying to understand the use-case here, but it’s definitely included in the paranoid-list. Thanks!
I have Nginx Proxy Manager set up to let me access services running HTTP on other ports on the machine with a local network only access list just so my traffic even in my own network will use TLS. The likelihood that anyone is sniffing traffic on my own network is extremely small, but I’m paranoid. (Can’t let anyone see that I’m running Ubuntu Server. How embarrassing.)
npftables blocks all incoming except a particular set of ips. any connections from those ips hit pubkey authentication.
I’ve never had a problem
