Post by @douglasvb@m.ai6yr.org

I've got a few little proxmox servers running some VMs and some LXCs. A few of the VMs serve up some websites via Cloudflare Tunnels. Everything is Debian in one way or another.

Everything is setup with auto updates and I regularly manually check to ensure that all of that is working correctly.

Everything backs up to a PBS plus some external drives, and I keep periodic offsite snapshots.

I have Crowdsec setup and running across everything. And I use Prometheus and Grafana to monitor and have email alerts setup.

I'm behind Unifi hardware that's routinely updated and is setup to block access attempts from certain countries which seems to filter out 95% of garden variety port scans and whatnot. I haven't opened any ports open on the router.

I'm using Pulse as well. But only in read-only mode. It doesn't have the ability to do anything on my servers (this is set on the server side).

I know that I need to work on the firewalls on the proxmox servers. I haven't invested the time in making sure everything is sufficiently isolated from everything else.

At the network level on the router, I do have decent isolation setup. The servers and all of the LXCs and VMs live on their own subnet while all IoT devices are on their own subnet and fully isolated from one another and the rest of the network, there is a guest network that is isolated on its own without access to anything else or itself, and there is a trusted device network where our laptops and phones live. And only my devices have access to the servers and whatnot.

What else should I be doing?

Should I be using something like Tetragon?

Should I try out Wazuh?

Should I be setting up some sort of centralized logging pipeline so that all of the VMs and LXCs push their logs somewhere and then use some software to look at it all and flag if there are issues?

I don't want my whole life consumed with keeping a few websites online. And so far in about 15 months of doing this, it's not been that much time invested. I'd like to keep it that way so I figure some additional preventative measures might be useful.

#cybersecurity #homelab

0 Boosts

0 Likes

AI6YR Ben

@ai6yr@m.ai6yr.org 13 hr. ago

@douglasvb If it's all firewalled from the Interwebs, that seems sufficient. If you can, only make all that stuff visible to your remote trusted IPs. (ie home or office or whatever)

Douglas

@douglasvb@m.ai6yr.org 13 hr. ago

@ai6yr Yup that's how it's all setup. The only external access is via Cloudflare Tunnels to the specific VMs where I've got the websites being hosted (and then it's all in containers that also automatically update, and the cloudflare tunnel setup using "Cloudflared" only hooks directly to the appropriate containers and etc etc etc). The clouldflare tunnels are kinda cool actually... they talk out to Cloudflare rather than allowing any random traffic to come in and request things. So cloudflare gets the request, it goes through all of the cloudflare checks, then cloudflare sees that my server is connected to it and asks my server via that connection to please provide what it's being asked for.

Of course then I have to accept cloudflare as the middle man with all of those consequences. But nothing that I'm serving up on the internet on these servers is sensitive. It's all for public consumption anyway.

AI6YR Ben

@ai6yr@m.ai6yr.org 13 hr. ago

@douglasvb Seems reasonable, probably more than sufficient. The one thing I haven't done (because it's a PITA) is to very carefully control OUTBOUND requests from machine, i.e. only allow your machines access to what you want them to have access to. This cuts down dramatically on ability of any compromised software from talking to stuff it should not. (best done with a separate firewall vs. on-board firewall).

Cliff'sEsportCorner

@CliffsEsport@mastodon.social 12 hr. ago

@ai6yr @douglasvb Ben I am very interested in details if you get around to that "carefully control OUTBOUND requests from machine, i.e. only allow your machines access to what you want them to have access to. This cuts down dramatically on ability of any compromised software from talking to stuff it should not. (best done with a separate firewall vs. on-board firewall)."

1+ more replies

Cliff'sEsportCorner

@CliffsEsport@mastodon.social 12 hr. ago

@ai6yr @douglasvb Not really relevant for Doug's public facing stuff, AFAIK Cloudflare is least bad option for that. But on my todo list for Homelab crazy is SPA, with my background in physical security the idea of punching holes in my own Firewall for anything fills me w horror so I've never done that. But looking at using per device cert that triggers VPN from my server to remote device. https://github.com/mrash/fwknop

GitHub

GitHub - mrash/fwknop: Single Packet Authorization > Port Knocking

Single Packet Authorization > Port Knocking. Contribute to mrash/fwknop development by creating an account on GitHub.

Douglas

@douglasvb@m.ai6yr.org 13 hr. ago

@ai6yr I need to do more of that at the ProxMox level. The router and firewall at the Unifi appliance level is doing that for the network but within a ProxMox server, the traffic between different LXCs and VMs seems to not leave the ProxMox server so it needs to be dealt with at that level.

On the individual VMs and LXCs I do restrict with their firewalls what ports are allowed to see traffic and which IPs get to send in or out traffic. But I think I should do more at the ProxMox level.

Of course if the ProxMox server is compromised, then whatever compromises it has the keys to the castle....