</span><span>Mar 29 14:40:11 icefall fail2ban.filter[1097]: INFO [...] Found 176.126.240.158 - 2024-03-29 14:40:11
</span><span>Mar 29 14:40:29 icefall fail2ban.filter[1097]: INFO [...] Found 185.8.165.204 - 2024-03-29 14:40:29
</span><span>Mar 29 14:40:40 icefall fail2ban.filter[1097]: INFO [...] Found 162.212.154.58 - 2024-03-29 14:40:40
</span></code></pre><p>Within the past <em>few minutes</em>, I've already got a few IP addresses from all over the world taking a peak at my services. If I had my SSH port set to the standard <code>22</code>, I could have expected a few rogue login attempts to have been made, too.<p>And, speaking of not having my SSH port set to the standard <code>22</code>, I'll now move on to what you should be done to secure a home server. One thing that I think should be noted, however, is that security doesn't need to be very strong, and you generally don't need to go too far out of your way with security measures (though this definitely depends on invdividual circumstance). Honestly speaking, you <em>probably</em><strong>don't</strong> have competent black hats looking to get in to your server - what you probably <strong>do</strong> have, however, are a bunch of script kiddies and perversive bots.<h1id=the-list>The list<aaria-label="Anchor link for: the-list"class=zola-anchorhref=#the-list>#</a></h1><p>The fairly basic stuff you'd need to do in this case doesn't make much room for detail. So, here it all is in the form of a simple list (I've included the relevant NixOS configuration where I think it'd be useful<supclass=footnote-reference><ahref=#1>1</a></sup>):<ul><li><p>Move your SSH daemon to a non-default port, like <code>3291</code>.</p><preclass=language-nixdata-lang=nixstyle=background:#151515;color:#e8e8d3><codeclass=language-nixdata-lang=nix><spanstyle=color:#ffb964>services</span><span>.</span><spanstyle=color:#ffb964>openssh </span><span>= {
</span><span></span><spanstyle=color:#ffb964>ports </span><span>= [ </span><spanstyle=color:#cf6a4c>3291 </span><span>]; </span><spanstyle=color:#888># whatever you like
</span><span>};
</span></code></pre><li><p>Force public key authentication with SSH and disable root logins.</p><preclass=language-nixdata-lang=nixstyle=background:#151515;color:#e8e8d3><codeclass=language-nixdata-lang=nix><spanstyle=color:#ffb964>services</span><span>.</span><spanstyle=color:#ffb964>openssh</span><span>.</span><spanstyle=color:#ffb964>settings </span><span>= {
</span></code></pre><li><p>Set up a pretty basic firewall - something like <code>ufw</code> would do the trick.</p><preclass=language-nixdata-lang=nixstyle=background:#151515;color:#e8e8d3><codeclass=language-nixdata-lang=nix><spanstyle=color:#ffb964>networking </span><span>= {
</span><span></span><spanstyle=color:#ffb964>nftables</span><span>.</span><spanstyle=color:#ffb964>enable </span><span>= true; </span><spanstyle=color:#888># use the newer nftables
</span><span></span><spanstyle=color:#ffb964>interfaces</span><span>.</span><spanstyle=color:#ffb964>enp1s0 </span><span>= { </span><spanstyle=color:#888># obviously, replace `enp1s0` with your interface
</span><span></span><spanstyle=color:#ffb964>allowedTCPPorts </span><span>= [ ... ]; </span><spanstyle=color:#888># put in the ports you need here
