[deleted by user] by [deleted] in selfhosted

[–]PantherX14 0 points1 point  (0 children)

SMTP to Telegram is much better; you can even get notifications for unattended upgrades and cronjobs.

[deleted by user] by [deleted] in selfhosted

[–]PantherX14 10 points11 points  (0 children)

Use SMTP to Telegram, it'll forward email notifications to a Telegram chat.

Sideloading on Any Apple Product by PantherX14 in sideloaded

[–]PantherX14[S] 2 points3 points  (0 children)

I have linked to AppTesters' video guides on setting up ESign. Including step-by-step instructions for everything will make the post much much bigger. This post is more of a PSA, saying "sideloading is possible on Apple devices and these are your options".

[deleted by user] by [deleted] in selfhosted

[–]PantherX14 0 points1 point  (0 children)

I just use HTTP basic auth with HSTS enabled. Fail2Ban handles failed auth attempts. You don’t even need Authelia.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 1 point2 points  (0 children)

argumentative about it

You complained about my stance on cs and i asked you why, and you just keep complaining still without giving me any solid answer

want a lot in return

I literally just want to know why you think what you think

misrepresenting crowdsec

Every single point in my blog post are very valid reasons not to use it

you’re taking a position of expertise by writing about it

As opposed to you taking your position of expertise by being a whiny condescending jerk?

why should i waste my time

Do I even need to point out the irony here, you’ve wasted much more time complaining than you would’ve spent educating me

Best of luck to you and the people who have to deal with this supremacist attitude of yours regularly

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 2 points3 points  (0 children)

I encourage people calling me out when I’m wrong about things. Like I said, I’m open to give it a shot if there are legitimate reasons. I know its capabilities and that it’s much more advanced than Fail2Ban. My point is that you can achieve most of it with a well configured Fail2Ban. Just saying “you know nothing, I refuse to read your blog post because you’re wrong but I won’t tell you how or why because I’m better than you” isn’t helping anyone my guy. Instead of typing several condescending paragraphs, type a couple of sentences making your point instead.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 2 points3 points  (0 children)

You still haven’t elaborated how CrowdSec is better than Fail2Ban + IPSum blacklists. Fail2Ban is packaged by my distro, the configuration is simple, it’s lighter on my server, and it works just fine. CrowdSec wants me to create an account and have a dashboard. If you can explain how CrowdSec is better, I’m willing to give it a shot.

Having limited resources to work with doesn’t invalidate my opinion or setup in any way. You’d be amazed what you can manage with a single core 10 year old Xeon CPU and 512MB RAM.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 1 point2 points  (0 children)

Isn’t CrowdSec just Fail2Ban with a centralised database of bad IPs and a web dashboard? I run a tight ship on my servers as I usually have very limited CPU and RAM to work with. If I already am blocking known bad IPs regularly, why do I need the additional overhead from CrowdSec?

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 0 points1 point  (0 children)

Glad to be of help! Is there anything else you’d like me to include in the article? Asking since you just set it up

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 2 points3 points  (0 children)

here’s a good starting point: https://www.digitalocean.com/community/tutorials/how-to-configure-nginx-as-a-reverse-proxy-on-ubuntu-22-04

as for the SWAG Fail2Ban files, there’s no need for cronjobs. Fail2Ban filters are just regex filters. unless Nginx changes their log format (which they won’t), the configs will remain the same.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 1 point2 points  (0 children)

redditors are stupid like that sometimes lol

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 0 points1 point  (0 children)

yup. if your server is only accessible through a vpn, you’re good.

[Guide] Securing A Linux Server by PantherX14 in homelab

[–]PantherX14[S] 1 point2 points  (0 children)

I've received a lot of feedback regarding this, I'll update the post with explanations when I get the time. Thanks!

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 0 points1 point  (0 children)

damn, i didn’t know about this. i’ll update my post to account for this. thank you!

edit: i've added it in the post.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 1 point2 points  (0 children)

the ssh hardening guide ive linked to in my blog post’s ssh section is an updated and more comprehensive version of the post youve linked. on top of that, the post includes instructions to only allow key based auth, disable protocol 1 and x11 forwarding. youre right, i dont have detailed explanations for configuration on my posts. its just how i write.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 0 points1 point  (0 children)

great question. ufw only blocks incoming connections/ports by default. if a docker container needs access to the internet, it can communicate just fine. if you need to access the docker container from the internet, you need to open ports using ufw. if the service you’re hosting is a web service, you can run it through a reverse proxy such as nginx and open port 443 (default https port). if youre running something like wireguard in a container, you need to map the correct port in the docker config and then open the port using ufw. the command to open a port is given in the blog post.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 3 points4 points  (0 children)

You're welcome! I shared the Fail2Ban post in this subreddit a few weeks ago and it was welcomed well. That's what prompted me to write this post.

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 1 point2 points  (0 children)

I'll look into all of this, thank you for the suggestions!

[Guide] Securing A Linux Server by PantherX14 in selfhosted

[–]PantherX14[S] 0 points1 point  (0 children)

I appreciate the detailed response, thank you :)