As the title says, I want to know the most paranoid security measures you’ve implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I’m wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

  • JoeKrogan@lemmy.worldEnglish
    31·
    10 months ago

    Only remote access by wireguard and ssh on non standard port with key based access.

    Fail2ban bans after 1 attempt for a year. Tweaked the logs to ban on more strict patterns

    Logs are encrypted and mailed off site daily

    System updates over tor connecting to onion repos.

    Nginx only has one exposed port 443 that is accessible by wireguard or lan. Certs are signed by letsencrypt. Paths are ip white listed to various lan or wireguard ips.

    Only allow one program with sudo access requiring a password. Every other privelaged action requires switching to root user.

    I dont allow devices I dont admin on the network so they go on their own subnet. This is guests phones and their windows laptops.

    Linux only on the main network.

    I also make sure to backup often.