this post was submitted on 06 Feb 2024
182 points (99.5% liked)

Selfhosted

40732 readers
391 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud
Loki
CannaVet
devve
HybridSarcasm
[email protected]
182
What are the most paranoid network/OS security measures you've implemented in your homelab? (self.selfhosted)
submitted 10 months ago by MigratingtoLemmy to c/selfhosted
132 comments fedilink hide all child comments
 

As the title says, I want to know the most paranoid security measures you've implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I'm wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 1 points 10 months ago (1 children)
  1. Exchange on prem 😳
  2. Both mdm,.Ms intune, and just installing the root cert manually in trusted store. You don't have to root Android for that. It presents some warnings, appropriate.
  3. My Sophos is self contained. It does radius against active directory. It wants IPS and other updates though.

I guess the firmware is as good as possible. All network devices are just computers and can be exploited. I use a Cisco router as my actual gateway. Sophos is inline after that.

Privacy. πŸ€”

Not much. I have certain traffic go through a VPN to the Internet, but that's split tunneled.

I use incognito? That doesn't really do anything, ha.

I'm slowly killing web browser tracking and cookie stuff that group policy allows.

[–] MigratingtoLemmy 1 points 10 months ago (2 children)

I didn't know MS exchange could be used as a WAF. Will need to read more about that.

Can I host Intune completely on-prem?

What do you mean by "My Sophos is self-contained"?

Does your Cisco router get updates? My problem with these companies is that they build backdoors in their firmware for agencies to use. Are you monitoring the network usage of your Cisco gateway?

Using AD/RADIUS on-prem is an intriguing idea. I didn't consider it because if my AD server goes down I'm essentially locked out of my services. I need to think more on this. Thanks.

[–] [email protected] 2 points 10 months ago (1 children)

Sorry for confusion. I use Sophos utm as a WAF for exchange. Basically reverse proxy that is specifically programmed for exchange attacks. It allows OWA to keep working.

I put the exchange admin URL behind authentication, so you try to go to /ecp, it Sophos intercepts and make you authenticate to Sophos utm first, which is passing to ad with radius.

MS got rid of intune on prem. It's only Azure service now. I think.

My router is my biggest vuln. Oddly the most important. It's an enterprise ISR. It's updated as far as possible. My paranoia ends with the US gov/NSA. I don't care if they want back door oddly. I don't want China using me for attack relay however.

Loads of monitoring. You do a span/mirror port to your IDS like security Onion. Let it analyze all your traffic. Apparently there are some state sponsored exploits that allow them to owe a router at kernel level and hide their activities from you and monitoring, but that's a level I can't deal with.

As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.

[–] MigratingtoLemmy 2 points 10 months ago

As far as lock out, you create a break glass on everything. Emergency account with non rememberable ridiculous password, saved in a safe place.

This is such a great and a simple idea. Thanks.

I think I followed your setup at a high level, but because I don't have hands-on experience with AD I didn't quite catch the scope of it. Thanks for letting me know, I'll get some reading done when I get the time!

[–] [email protected] 1 points 10 months ago (1 children)

I have the older Sophos utm, which doesn't use the Sophos cloud central manager.

I think their new firewall utm can work disconnected, but I don't know.

Sophos has a home use license that's free for non business use.

I love companies that do community edition or free home use.

Sophos, Veeam has nfr, Elastiflow has community edition, which is a netflow.

[–] MigratingtoLemmy 1 points 10 months ago

This is the first time I've come across Elastiflow, thanks for mentioning it. Seems like an intriguing service to add.

I was considering using Suricata/installing Security Onion to do IDS from the certificate from a private CA. Sophos firewall seems pretty good too.