Hello folks! I am looking for some guidance or direction on how to make sure my “server” locked down as much as possible. I know there are several websites/guides out there but was hoping I could get someone to recommend some good ones to use that cover all the bases solidly.

There are just so much info out there, wading through looking for a solid guide when you ignorant is hazardous.

Server is running Mint and hosts my Plex/Radarr/Sonarr stack. Using a locally hosted reverse proxy for any outside connections.

This started as a project to learn linux, so things are a bit shaky on linux understanding but getting better. I used GPT assistance to lock it down to the best of my ability, making sure (or I think) that most obvious firewalls rules were setup…ect.

Thanks for your help :)

  • reluctant_squidd@lemmy.caEnglish
    6·
    12 hours ago

    I would learn the following at some point (not in order):

    • nftables - specifically how tables/chains/rules interact and how to use them correctly (this is a learning process)
    • ssh - using non-default port key-only authentication.
    • custom routing - more advanced, but is very handy if you plan to have services talking to each other in non-typical ways.
    • openvpn and WireGuard - pros/cons, what they do and how they can make connecting to things more secure.
    • podman - docker alternative that is imo more secure and open. It can run services in a non-root enabled way (rootless) which is great with you get it working, but can be hard to get there.

    Above are more on personal preference in some cases. There are so many options to do things in the Linux world.

    Be careful relying on AI to do this stuff for you. I’ve reviewed some generated nft configs that left things wide open in some cases, or added needless fluff that worked, but caused bottlenecks. Better to know what it is doing, so you can catch when it is confidently incorrect.

    Ofc, if you want to go back to basics, you should first dive into the file system, data storage, permissions and ownership. Without those, the rest might not be able to protect you no matter how well they are setup.