Hi there, I am hosting a service for mainly me and also some family members. I want it to become more.

Currently the chain just as follows: interwebz <-> UDM <-> npm <-> services. The services are mostly run in VMs or LXCs, npm runs in docker, accompanied by one Adguard home instance and another AGH instance in an LXC.

I now want to add f2b to this whole chain. I’ve installed f2b in the OS which runs docker (and therefore npm) (VM1) and also in the OS of my existing service (VM2). Both VMs use Ubuntu as their OS.

What I already figured out thru testing and reading is, that f2b in VM2 acts as expected when the jail is triggered, and sets the block. But nftables/ufw don’t block connections coming from external, as they are coming thru npm. f2b sees and uses the public IP for the checks/bans.

So now I am thinking how to solve that.

  1. Keep f2b on VM2 and let it set the bans on VM1 over SSH. That’s what some people do or so I’ve read.
  2. Use f2b on VM1, let it check logs on VM2 and then set the bans. That would also be possible over SSH, I’d guess. But I didn’t read up on it yet.

So, what’s your opinion? How do you fine folks handle that in your environment? Option 2 seems to be more elegant, as it would be “at the entry” and let’s me easily add additional services later. But I don’t know, if that’s a path worth digging in to.

  • tremble5218@programming.devEnglish
    2·
    11 小时前

    Firstly, what’s your threat model - as in what are you trying to block? For SSH access, fail2ban works. For bots and scrapers, I’m not sure how effective it is. What jails have your enabled/configured for fail2ban?

    I don’t have your setup, but like someone else here said, I use Caddy on Docker as a reverse proxy for all my self-hosted services running in Docker containers. One really effective means of blocking AI scrapers and bots is Anubis - https://github.com/TecharoHQ/anubis. It might be worth a shot. It works for me.

    • nibbs@lemmy.zipOPEnglish
      2·
      4 小时前

      Thanks for the suggestion, I will take a look at Anubis.

      There are no SSH ports open to external, as everything I run is locally in my LAN, I do not have use for externals SSH access and don’t want to open that vector.

      The services that I (want to) offer to the family, are the common selfhosters finest:

      • immich
      • Stirling PDF
      • Jellyfin

      As I do not have a authentication provider yet, the services which require an authentication by user/password are prone to brute force attacks, I want to mitigate that first and foremost.
      In the mid to long run, I plan to also deploy an authentication provider for those services like Authelia, TinyAuth, PocketID, Authentik or <you name it>.
      As there are so many of them and the opinion of which is best differ wildly, I have not yet decided and am in kind of a analysis paralysis. :)

      • tremble5218@programming.devEnglish
        2·
        2 小时前

        For auth providers, I’ve tried all the ones you named. Here’s my brief analysis:

        • Authelia - deployment and configuration is moderately complex but documentation is great and it works well with Caddy reverse proxy.
        • Authentik - way too complex to deploy and configure, requires you to understand their concepts very well. I’d stay away from it.
        • PocketID - super easy to deploy and configure. Passkeys are easier and arguably more secure than passwords and it supports a few methods other than passkeys.

        With these services you mentioned you want to or are already hosting, you could use the following in the order they are listed:

        1. Basic auth using Caddy (reverse proxy layer)
        2. Anubis to ward off bots and scrapers (between reverse proxy and hosted service)
        3. PocketID for auth (before service as single sign-on)

        I would recommend 2 and 3 as 1 is pretty useless against a determined attacker. Anything that’s on the public internet is bound to be attacked at some point, so follow best practices and perform server hardening on the host machine. Remember, you classify the sensitivity of the data you host and determine the severity of the risk if that data were to be exposed. So work with that in mind when choosing an option.