As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).
Thanks!
- Custom Router/Firewall running OPNsense and the Sensei plugin
- Extensive DNS filtering through Pihole
- Redirecting all DNS requests to my Pihole through OPNsense
- My entire network is behind a multi hop VPN
- I don’t let any Windows systems connect to the internet, instead, I have a Linux server which is connected to the internet (through a VPN of course) and runs a browser, and I use X2go to access the browser which is running on the Linux server
Wouldn’t that last bullet mean you’re not updating the windows machines whatsoever? Would this not cause more security issues in the long run, considering “connected tot he internet” isn’t a requirement to spread an infection.
It might sound ridiculous, but I currently also run a WSUS server to get Windows updates. But I will probably replace my entire Windows setup with a better solution. Since I don’t run Windows bare-metal anymore, I’m looking forward to using offline Windows VMs on my Proxmox host and just accessing the internet directly from my Linux machine.
Since you’re running x86 for your router, do you actively prevent ME from trying to connect to the Internet?
I am aware of the ME, but I can’t really do anything about it. Current ARM SBCs are not suitable for a router/firewall (at least in my experience). I’m not that concerned about it though.
OpenWRT isn’t half bad for usual “router stuff”, but advanced usage is a bit hard to do. Of course, that doesn’t eliminate the problem since ARM can have plenty of backdoors too
I know, I tried OpenWRT on a Pi, but the experience wasn’t great (at least not as a home router).
I used to have all VMs in my QEMU/KVM server on their own /30 routed network to prevent spoofing. It essentially guaranteed that a compromised VM couldn’t give itself the IP of say, my web server and start collecting login creds. Managing the IP space got painful quick.
Logcheck. It took ages to make sure innocent logs are ignored, but now I get an email as soon as anything non-routine happens on my servers. I get emails with logs from every update, every time I log in, etc. This has given me the most confidence that nothing unexpected is happening on my servers. Of course, one needs to make sure that the firewall is configured well, and that you use ssh keys etc., but logcheck is how I know I’m doing enough.
Very nice idea, and it’s quite simple too. Thanks
I am clearly not paranoid enough. For a while I was running an open source router inline between the network AP and the fiber to Ethernet box and running nids but the goddamn thing kept crapping out every few days so i took it back out until I can find a more stable solution.
I have plans if I can ever get around to it. I want the smart TV, printer and other shitty things on a separate network from the more trusted devices. I don’t know how yet but I would like to set up 802.1X for the trusted stuff.
You could not connect the TV and printer to the network but instead attach them to raspberry Pi or similar devices. This allows you full control and stops them calling home and spying.
Tinyssh in a ssh user, su from there. I see privilege management in openssh as potential vulneranility.
For about a year I was running a full out of band IPS on my network. My core switch was set up with port mirroring to spit out a copy of all traffic on one port so that my Suricata server could analyze it. Then, this was fed into ElasticSearch and a bunch of big data crap looked for anomalies.
It was cool. Basically useless because all it did was complain about the same IP crawler bots as my nginx logs. But fun to setup and ultimately good for my career lol.
The problem is, you’d expect your switch to mirror all traffic, including what it is generating (switches with web servers, baseband/backdoors like every big manufacturer), but you can never really be sure.
Following for my own edification!
Hope I get a lot of good answers!
Only remote access by wireguard and ssh on non standard port with key based access.
Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns
Logs are encrypted and mailed off site daily
System updates over tor connecting to onion repos.
Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.
Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.
I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.
Linux only on the main network.
I also make sure to backup often.
Linux only on the main network.
Is that a security benefit?
If big corporations hoovering your data should be on everyone’s threat list, then yea, i’d say its a huge benefit.
Well I dont trust closed source software and do what I can to avoid it when I can. At least foss can be audited. Also all the linux devices on the main network are devices I admin.
I guess it cuts the attack surface profile down a bit?
Fail2ban bans after 1 attempt for a year.
Fail2ban yes; one year, however, is IMO a bit excessive.
Most ISP IP assignments do tend to linger - even with DHCP the same IP will be re-assigned to the same gateway router for quite a number of sequential times - but most IPs do eventually change within a few months. I personally use 3 months as a happy medium for any blacklist I run. Most dynamic IPs don’t last this long, almost all attackers will rotate through IPs pretty quickly anyhow, and if you run a public service (website, etc.), blocking for an entire year may inadvertently catch legitimate visitors.
Plus, you also have to consider the load such a large blocklist will have on your system, if most entries no longer represent legitimate threat actors, you’ll only bog down your system by keeping them in there.
Fail2ban can be configured to allow initial issues to cycle back out quicker, while blocking known repeat offenders for a much longer time period. This is useful in keeping block lists shorter and less resource-intensive to parse.
My block list is very small actually due to the non standard ssh port. Everything else goes through wireguard.
If it was open to the public then yes I’d have to reconsider the ban length.
That makes a lot more sense for your setup, then.
System updates over tor connecting to onion repos.
How does this help, assuming your DNS isn’t being spoofed?
Please see my reply below with links.
Thanks, never thought of that before. I’ll certainly try it, great way to help the network!
Can you explain why you use onion repos? I’ve never heard of that, and I’ve heard of kind of a lot of things.
Onion repositories are package repositories hosted on tor hidden services. The connection goes through six hops and is end to end encrypted. In addition to further legitimizing the tor network with normal everyday usage it has the benefit of hiding what packages have been installed on a system.
Here are some notes about them if you want to read more.
https://blog.torproject.org/debian-and-tor-services-available-onion-services/
That’s pretty neat. I might start doing that, just for kicks.
That is very interesting, thanks!
With Debian it’s just the apt-tor package, and the project maintains an official list at… onion.debian.org iirc?
I don’t know if serving onion traffic is more expensive for Debian/mirror maintainers so idk if this is something everybody should use
I’ve got systems that can detect suspicious activities in the net, which result in a shutdown of the router. And not like “could you please shut down” but a hard power off type of shutdown.
Now that’s the kind of paranoid I was hoping to see in here. High five, pal.
Oh, you have a setup that signals to your power source to shut off internet when it detects an anomaly on the internet? That’s quite specific, and I’m having trouble trying to understand the use-case here, but it’s definitely included in the paranoid-list. Thanks!
Nice try, attacker trying to get me to do their reconnaissance work for them. I’m on to you.
Spfff me, never Anyway please tell me more about your IP adress and your private keys.
My private key has a 3 in it
“I’m in”
Hackerman
Ok my ip address is 192.168.3.200.
Im gonna hack u now
Hey its me your friend Aaron how are you. Hey i was just wandering, what is your credit card details again? just wandering
No, honestly I’m not an attacker, but your local bank. We just need your help to update our systems. Please provide us the following credentials to continue using our phish- *ugh* services.
Credit card number: _____________
CVV: ___
Expiration date: ______It would be funny if that were the case. I was just hoping to be a little more paranoid from you lot and maybe improve on the things I’ve thought about
Yeah, just having a little fun in the role of a paranoid admin. My setup isn’t worth mentioning since it fits my threat model (i.e. nobody gives a shit about my network, just don’t be the low hanging fruit) but I’m interested in other replies. Hope you get some useful responses here.
I’d love to play paranoid admin over my network. Thanks!
My most paranoid config is disabling Ipv4
That’s it. If someone wants to attack me, they will need to adopt IPv6!
they will need to adopt IPv6!
And find your IP in a /56 or /64 range (depending on what your ISP gives you). Good luck.
After reading this thread I’m apparently not paranoid enough.
Internet facing services are on their own firewalled vlan (dmz), behind a rev proxy, and I have crowdsec running on the proxy and router.
Anything that can get away with putting up on a vps I have (e.g. this Lemmy server). But some things have storage/compute requirements I’m not willing to shell out for.
Mine’s pretty simple, I have a “don’t open ports until ABSOLUTELY NECESSARY” policy, wireguard works well enough for everything else I need to access remotely. I also keep SSH disabled on any machine that has direct access to the internet.
Do you use a KVM to interact with machines that can access the Internet?
No, as it’s just my main desktop, my laptop and an isolated PiHole VM
NAT 🥴
- full disk encryption on everything except the router (no point in encrypting the router)
- the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
- obviously, the SSH keys are different, so the server has a different IP in initrd. That said, I still don’t have any protection against malicious modification of initrd or UEFI
- the server doesn’t have a display connected for obvious reasons, so I’m manually unlocking it via ssh on each boot
- the server scans all new SSL certificates in realtime using certspotter and notifies me of any new certificates issued for my domains that it doesn’t know about (I use Cloudflare so it triggers relatively often, but I still do checks on who the issuer is)
- firewall blocks outgoing 25 so nobody can impersonate my mailserver
I use a similar setup, but use a USB for my boot drive that has the lvs partition encryption keyfile. I find it much handier since my computer is not near my server. I can boot and then walk upstairs and it is ready, and remove the USB later.
Then there is no way to brute force the decryption or get a password out of me. Also, when the USB is removed and put in a safe place, there is no way to modify the boot partition or UEFI either.
Then I have a password encryption on my data harddrives that I don’t know the password to, but is on my password manager.
The thing about being paranoid about this stuff is that I probably focused on the wrong thing. A smash & grab is completely protected against, but that is like a 0.1% chance anyway and a 0.1% chance on top of that 0.1% chance that it would be targeted enough that they would even try to decrypt it.
Full disk encryption is really only usefully at all for an unpowered system. Network hardening will probably take care of 99.99% of attack attempts where encryption is 0.01%.
Even for a laptop, if it gets stolen in public, it is still running and can have the keys extracted or break into the running system if someone really wants to hack it. They wouldn’t even try to reboot and break the disk encryption probably…
Too much info, but I guess I am just rambling about how dumb my approach probably is 😅
You might be interested in setting up network bound encryption via Clevis and Tang. I use a hidden pi zero in my house acting as a Tang server. It’s great being able to reboot any of my encrypted servers without having to manually unlock disks.
I know about it, but it kinda defeats the purpose (the purpose being police raid protection)
Do you recommend any resources about this? I’d be interested in learning how to implement this.
I’m using the recently merged Clevis module for NixOS. There was a recent talk at FOSDEM about it.
Thanks, I’d like to know more about your public-facing setup using cloudflare
there’s not much to know about it, I use Cloudflare simply because its routing is better than direct IP connections for many places on Earth. I can’t fully use Cloudflare anyway because I host many non-web services.
- full disk encryption on everything except the router (no point in encrypting the router)
