Ask HN: How do you securely self-host a server?

Re:Ask HN: How do you securely self-host a server? by undead_bunny on Wednesday March 09, 2022 @05:49PM (#30621006)

Reading this topic has made me realize I don't even have a very solid image of what a "server" would be in this case. Is it a machine running an OS? A specific program listening on a port?

Does anyone have any recommendations for "Setting up a server 101" that could help shed some light on this?

Thanks!

[ Parent | on HN ]

Re:Ask HN: How do you securely self-host a server? by doublerabbit on Wednesday March 09, 2022 @08:32PM (#30622240)

Yes. A server is a dedicated machine running an service on a specific port.

Choose an OS.

- FreeBSD - Throws you in the deep-end but documented well to learn. Touching FreeBSD you will enable to manage Linux. Guides for BSD tend to be vague

- Linux - "Everything runs on Linux" easy gui installs. Lots of guides "How do I x on y distro" - Available in many different flaours, dog-food friendly.

Now choose a service(s) you wish to serve.

- Basic Web Server?

Easy Setup - Low Security

- Game Server?

Easy/Advance Setup - Low Security

- DNS Server?

Advance Setup - Medium Security

- Email Server?

Advance Setup - Medium-High Security

Then start with the following beginner steps:

- User Accounts and User Groups

SUDO, Disabling root login via SSH et cetera

- Moving SSH to another port other than 22

- Configuring SSH-Keys and password-less authenication

Now the firewall, pick one.

- Linux has IPTables and UFW

- FreeBSD has PF and IPFW

Once you've chosen your firewall, learn the the basic's of TCP / UDP

> TCP - "Hello, Hi, This is me, Cool. this is you, This is my data, Thanks for the data, good bye, bye"

> UDP - "Hi, so like here is all my data, bye"

then learn how to do the following rules:

- Block all inbound

- Block ICMP

- Block the inbound SSH port and only allow specific IP addresses

- Opening the port of your chosen service.

WebServer - 80/443

GameServer - 27960 for Quake3 Arena

DNS Server - 53

Once you've managed all of that your server is good to sit on the public internet.

Then learn about backups.

[ Parent | on HN ]

Re:Ask HN: How do you securely self-host a server? by ratg13 on Thursday March 10, 2022 @02:55AM (#30624324)

You understand perfectly.

OP does not bother to explain what type of server or service they want to run, so this becomes a more difficult question to provide advice for.

Even if it's just a web server they don't say who the audience is or what technologies they will use to run the website.

e.g. - WordPress would be more difficult to secure than static content.

There are many details left out which leaves room for only generic answers.

[ Parent | on HN ]