Each time I’ve read into self-hosting it often sounds like opening stuff up to the internet adds a bunch of complexity and potential headaches, but I’m not sure how much of it is practicality vs being excessively cautious.
Limiting the attack surface is a big part, geo restrictions, reputation lists, brute force mitigation, it all plays a role. Running a vulnerability scanner against your stuff is important to catch things before others do and regular patching is important too. It’s can be a rewarding challenge.
Both Nessus and Nexpose are typically enterprise class systems but they have community licensing available for home labs. Nessus can even be set up in a docker container. OpenVAS is more or less free but can be upgraded with pro-feeds, but last I tried it it was a bit more rough to use.
Do be aware though that throwing a full force scan will use a lot of CPU and can break things depending on the settings, so it’s good to practice their settings on some non-critical systems first to get a feel for them.
Each time I’ve read into self-hosting it often sounds like opening stuff up to the internet adds a bunch of complexity and potential headaches, but I’m not sure how much of it is practicality vs being excessively cautious.
Limiting the attack surface is a big part, geo restrictions, reputation lists, brute force mitigation, it all plays a role. Running a vulnerability scanner against your stuff is important to catch things before others do and regular patching is important too. It’s can be a rewarding challenge.
Can you recommend me a vulnerability scanner?
https://www.tenable.com/products/nessus/nessus-essentials
https://www.rapid7.com/blog/post/2012/09/19/using-nexpose-at-home-scanning-reports/
https://openvas.org/
Both Nessus and Nexpose are typically enterprise class systems but they have community licensing available for home labs. Nessus can even be set up in a docker container. OpenVAS is more or less free but can be upgraded with pro-feeds, but last I tried it it was a bit more rough to use.
Do be aware though that throwing a full force scan will use a lot of CPU and can break things depending on the settings, so it’s good to practice their settings on some non-critical systems first to get a feel for them.
Thanks sounds like a fun weekend project. My 72 cores are bored most of the time anyways. 😃
It’s always a balance between security and convenience. You have to mitigate what risk you are willing to well…risk