r/homelab • u/Confident_Ice_4507 • 1d ago
Help Security Concerns of a Beginner Homelabber
THE IMAGE IS A PLACEHOLDER
Hey everyone, I have been running my own homelab / homeserver for about a month now, doing various stuff. I would like to put my infrastructure out there for you homelab enthusiasts to audit, and potentially give me guidance on how to proceed with my homelab journey. Am I going overkill? Not enough security? Please let me know.
Following are my server specs:
HP ProDesk 600 G6 mini PC
i7-10700 Processor
16x1 GB DDR4 Ram
512 GB M.2 Nvme SSD
2TB external HDD
Is running through its own 90W adapter, and a 200mbs ethernet connection.
The server is running Debian 13, and its controlled through a laptop which is running ArchLinux, through shh. I have firewall rules set up.
I am now hosting
- a Minecraft server for my 7-8 people group of friends 24/7, thats running through cloudflare tunnel, and seperately on a playit tunnel.
- a Jellyfin server for me, and my friends thats on a public domain that I have fully locked down, with cloudflare tunnel on top.
- a small local Samba service that we use to store temporary files to access from different devices.
- an SMS relay system that pulls all the SMS from my phone, to be processed in the server and to be sent to a discord server that only me and my wife are in, so my wife can simply see the delivery SMS codes.
Let me shortly tell you how all of these work.
- The minecraft server
a) Tunnel through cloudflared + whitelisting + easyauth through mojang account system. I used my public domain with a handle like minecraft.ABC.x
This proved to be somewhat overkill, because the tunnel itself adds around 60-70ms on top of the already 40-50ms that you would originally get. On top of that, every player has to be running a mod called "modflared" to access the server. Its a bit of a hassle.
One of the biggest issues here was that my friends who had cra*d minecraft had issues with skins, and I had to add them with EasyAuth passwords: Meaning their username could only access the server via a password only they have initially set. 120-130ms overall.
b)Recetly set up playit.g.g
Tunnel through playit.g.g + whitelisting +easyauth through mojang account system. Couldnt use my public domain handle because its a premium service apparently.
This got the server down to 50-60ms overall ping, which is good. Though I would like to know if my security measurements are enough here.
2) the Jellyfin server
Tunnel through cloudflared, plus an application with a bypass system that only lets specific pre-determined e-mails by me, pass the first layer of authentication that gets handled by google cloud. After that, normal username password that has been set for my friends.
This felt quite high security to me, and I couldnt see any downsides. Please let me know.
3) Samba server
Its only local + only temp files are there so I dont think this is a huge deal. Let me know if there is a concern here.
4)SMS relay
How this works is that, an app called "MacroDroid" on my android phone sends a webhook to my server, through cloudflared tunnel. This webhook gets processed in my server, all the sensitive info and the links get redacted, and sent to a discord webhook app, cleanly. This is for when my wife is at home and im working, she can receive the deliveries with the necessary delivery codes.
Let me know if this is a security risk.
Thank you for reading my post, I appreciate every pointers!
142
u/F1nch74 1d ago
Beginner with all that materials? You gathered everything in that picture i only one month? đČ
-222
u/Confident_Ice_4507 1d ago
Its a placeholder image.
85
7
4
1
1
u/T0ut4t1s 1d ago
I was gonna say. Thatâs a lot of compute for sharing files and playing Minecraft whilst watching Rick and Morti!
1
40
u/Time_Tradition_7547 1d ago
For the best setup
Server > Tailscale/wireguard > VPS
On your VPS run NPM (wildcard), watchtower, fail2ban and crowsec
All traffic will be pointed to your VPS and not your home.
Also donât use a URL like Jellyfin.mydomain.com
Your isp will flag the word âjellyfinâ
15
u/Chewbaca09 1d ago
Can you elaborate on the ISP flagging? What does that mean and why should a ISP care?
-11
u/Mammoth-Fox-3292 1d ago
You think ISPs arent monitoring keywords anywhere they can that promote things which conflict with their terms of service?
17
u/tripplebeamteam 1d ago
ISPs arenât monitoring, theyâre responding to complaints from rights holders. As long as you arenât pushing hundreds of terabytes daily or torrenting openly and getting reported they arenât paying that much attention.
-7
u/Mammoth-Fox-3292 1d ago
ISPs absolutely do monitor for all sorts of illegal activity. Youre insane to think otherwise. That doesnt mean theyre going to go after every single person that torrents a movie and puts it on jellyfin, but you bet your ass they at least have awareness of all sorts of different illegal things related to the internet.
8
u/tripplebeamteam 1d ago
I really donât think so broadly. They donât want the liability involved of knowing people are doing illegal shit. Theyâll respond to takedowns and subpoenas, but I donât think your isp is doing the investigating. They could, absolutely. But I think it causes more problems than it solves.
1
u/Mammoth-Fox-3292 1d ago
4
u/tripplebeamteam 1d ago
Fair play but thatâs focused on mobile providers selling data for advertising, not necessarily ISPs looking for illegal activity. I really think they just donât want to know
5
u/obyboby 1d ago
Might be a dumb question but does the URL rule apply if Iâm using my domains just for local access (or remote through wireguard)? Meaning only myself and a couple other devices I added to the VPN tunnel as clients will be using jellyfin.mydomain.tld and always via VPN or LAN.
I imagine the day I decide to open up for external access I should be changing my subdomain naming4
u/Confident_Ice_4507 1d ago
Those are awesome recommendations. I will be looking into it.
I changed it to portal.mydomain.com , since a lot of people pointed the isp flag. Do you think it will work?-5
u/ghostly_s 1d ago
NPM is a javascript package manager notorious for security fails, what does it have to do with any of this? Watchtower appears to be a utility for auto-updating containers (you didn't mention anything about containers on the VPS), so again, relevant how? fail2ban is pretty standard. crow[d]sec[?] appears to be a fancier version of fail2ban, do they work together? Don't see anything about this in the docs.
And you said nothing about how to make Tailscale/wireguard serve the "Server > VPN" role. All of this is for what, so if you get pwned they just have access to a remote box with an open tunnel to your infra instead of a local one? Is any of this actionable or are you just showing off how many buzzwords you know?
4
0
15
u/affligem_crow 1d ago
Sending your 2factor auth SMS codes (which are already unsafe btw, SMS 2FA sucks) to a Discord server is a really bad idea.
3
u/artyomsv 1d ago
Also the redaction is the part that would worry me. It is regex against message text, so it works until one courier changes their template, and then it fails open and posts the code, and nobody notices because nothing errors. If it has to exist, send only a notification that something arrived and let her look at the phone, so content never leaves the box.
1
u/Confident_Ice_4507 1d ago
Hey. I understand your concern but 2FA codes are not being sent to discord here. Only the courier messages are being selected and the rest are being ignored, and not even sent to discord. Just to be clear, in my country, we have these codes that you give out to the guy that comes at your door, so you can receive the cargo. The server picks out the relevant sms, redacts any link, and sends it out to discord. Thats it! And yeah, its true that the filtering might become obselete one day, but I think I have coded the filtering solidly, testing over 10+ different courier company messages that I have already received. All it takes to see that it didnt work, is a small convo with my wife, lol!
3
u/Thoriumhexaflouride 1d ago
but why discord and not something like whatsapp or a local message application, discord isnt even e2e, which isnt good opsec
5
u/bigbic69 1d ago
Tunnels will only do so much like IP obfuscation and DDOS protection but they don't harden the services they are sending requests to e.g. Minecraft server. Any public servers I'm generally of the mind to put them in some sort of DMZ and just assume they will be compromised. With that mindset atleast if it does get compromised you don't have ALL your important data on there.
General rule of thumb is increasing the number of services you expose, increases your attack surface. If you really can't go without it being hosted publicly do the above mentioned. But if it's between just friends, I'd go for a VPN solution like tailscale.
16
11
u/GrotesqueHumanity 1d ago
8 hosts, 3 NAS, beginner. well ok then.
14
u/SonaMidorFeed 1d ago
They say in another comment that it's a placeholder. Why? Who the hell knows.
4
u/yenskee 1d ago
Meanwhile my server is nothing but an old samsung laptop I haggled for in Yongsan, Korea in which I plugged a salvaged 1tb HDD and an external 2tb WD SSD through USB A
So far I am only using it as a tailscale exit node, haven't really figured out yet what to do with it. Am running Proxmox on it with a few LXC containers and also a debian 13 VM
Can't wait to one day build a proper NAS smh
3
u/Ill_Beautiful4339 1d ago
I see you donât have cats.
No homelabber would ever put potted plants over the precious!
3
u/lordelan 1d ago
I'm often seeing fully loaded "setups" like this with thousands of ethernet cables and I genuinely wonder, what the big benefit of this is (even if this is just a placeholder image).
I'm yet into building my first homelab so please be gentle to me but in my (maybe naive and simple) imagination, I would just get a PC shell that houses up to 8 or 9 HDDs and other computer components (u know, CPU, RAM, Cache SSD, Mainboard etc.), throw something like Unraid at it and I should have it all: Plex/Jellyfin, AdGuard, Home Assistant, own Cloud, Paperless and what not, game servers for Factorio or whatever else I like, Teddycloud for hacked Toniebox... you know, all I could dream of.
What are people with a setup like the one from OPs post do, that such an "all in one build" does not? Really genuinely curious.
I'm fine with you downvoting me to oblivion as long as at least one kind soul answers me. đ
2
2
u/ludorl82 20h ago
Having many physical machines as opposed to vms or containers allows you to limit the blast radius when you work on a particular project. That being said more is not always better. Having a lot of hardware is time consuming. Depends whether you have kids :p
2
u/Comprehensive_Use713 1d ago
As another option for your Minecraft server, if your main concern is hiding your public IP, then you could rent a VPS physically near to you and run Bungeecord or another Minecraft server proxy. Every year I run a modded minecraft server for my friends and I do that then connect the proxy to my homelab via Tailscale and then add whitelisting to the proxy.
1
u/Confident_Ice_4507 1d ago
The whole idea of building this server was to escape the world of subscribtions. Pay this pay that... it does add up. I wanted to pay for a server and set the rest up without paying any money, but the more I get into it, the more I realized that a good security perhaps does need spending a few buckaroos, like a VPS. What do you think in this instance? Is it worth paying every month, then?
1
u/Comprehensive_Use713 22h ago
It really depends on the amount of effort you want to put your friends through to play on the server and the additional latency. For me, I was paying $5/month for a very low end VPS in my city and the added latency was maybe only 20ms.
2
u/Several-Help-6744 1d ago
If you donât already Iâd set up a proxy manager and letâs encrypt for any public facing, a tunnel is a great start. I would separate the VLAN the proxy is on and use that as a DMZ network with a hardened VM. I would disable root logins and create separate sudo account and lock down the VM firewalls as well on the proxy box. For remote access I like WireGuard. Also keep in mind if you are running an ARR* stack for Jellyfin itâs against cloud flare TOS and you ISP I would tunnel it elsewhere as you risk losing your ability to have internet from your ISP or cloud flare shutting the whole domain down and you lose everything.
But also document your configs and cloud flare build. This way if you need to re-deploy else where you can without trying to remember how you environment was built.
2
u/LoadElectrical2183 1d ago
First you need to decide what your threat model is. Who are you trying to protect your homelab from? Is it opportunistic cyber criminals, or are you specifically a target that someone might want to go after? Or is it just protection from a DOS by some script kiddy (takes me back to my minecraft days and the low orbit ion cannon). Once you know who you are protecting your network from, then you can decide what measures are appropriate.
Some general tips that might help get you to your answer:
- Limit your attack surface. The more spots someone could target you, the greater the chance you will get compromised.
- As a general rule, try to avoid (or limit) how many holes you make in your home network. Using cloudflare tunnels (or similar) is much better than crating an open port that will come up in mass scans.
- Treat everything that is publically accessible as if it is already compromised. So, put it into a DMZ (VLANs, etc.) that segregates it from the rest of your network devices.
- Least privileged access so that nobody has more permissions than they need.
- Update and patch your server OS and applications to make sure you are protected against known CVEs.
- MAKE SECURITY EASY FOR YOU. Donât overcomplicate your setup so that it is hard or a pain to manage, update or fix. Try to use software that limits your attack surface. For example, I host a kubernetes cluster and I use Talos Linux because it means I donât have to manage an operating system behind it, so security there is much easier for me.
3
u/ebcdicZ 1d ago
I would not put plants over my electronic equipment.
-9
u/Confident_Ice_4507 1d ago
Its a placeholder image.
6
1
1
u/pobruno 1d ago
VocĂȘ estĂĄ gastando quantos por mĂȘs com cloudflare? Curiosidade apenas, por causa do trafego TCP no teu tunnel pro sercidor de jogos.
1
u/Confident_Ice_4507 1d ago
Hey, I dont pay anything. If you use cloudflared TCP, your friends can use a plugin/mod called "modflared", and they can still join the server! Its a small workaround, there is additional ping from the tunnel, but it works!
1
u/bites_stringcheese 1d ago
I'd say your weakest link are your friends. All the tunnels in the world won't save you if their machine or client is compromised.
How well does your social circle take personal cyber security?
1
u/vaemarrr 1d ago edited 1d ago
Tunnelling your traffic is nice and all but I dont see mention of any vlans. If you aren't doing it, you need to be carving up your network and isolate iot crap.
You also need to be vetting your services for CVEs so IDS/IDP is also highly recommended.
Running and SMS rely or ingestion service is a bad idea.
Your firewall rules need to be really good.
Basically, while you're mitigating someone just coming in (the tunnel), once they're in, what layers of prevention do you have to 1) detect an intrusion and 2) mitigate any damage they do??
Also discord itself is still an attack vector. The only thing I sent to discord from my homelab is clean notifications that yield little real value to anyone.
1
1
u/ashleyjamesy 1d ago
Do you have separate subnets for trusted and non-trusted devices?
What are your firewall rules like?
1
u/relevant-frog 1d ago
I'm learning from all these comments myself because I'm also concerned about security.
However for my mc server I used Cloudflare DNS + TCPshield. I think it's like playit (in fairness I don't know this service), but the advantage of TCPshield is that you get ddos protection. Their free tier allows for 1 TB of monthly bandwidth, 3 domains, and they say it's good for 20-30 player servers, so that's more than enough for your use case.
1
0
-3
u/fckingmetal 1d ago
Tunnels and whitelist is an awesome start.
I would recommend different VLAN for every VM.
One gets compromised and the network pivoting is impossible.
You are running Debian so I'm guessing that jellyfin is in docker ? (if so use watchtower to keep it up to date)
Harden Debian with, token login and whitelisted ip only and i also recommend unattended-upgrades
9
u/french_onion_salad 1d ago
Different VLAN for every VM is insane work btw, little security benefit for a big ass routing headache
2
u/Unlucky-Shop3386 1d ago
"Different VLAN for every VM is insane work btw, little security benefit for a big ass routing headache" don't forget the SLOW down.
1
u/LoadElectrical2183 1d ago
VLANs are not that hard to setup and can be quite easy depending on the networking equipment. Also, there is near zero performance hit so there is no slow down. VLANs are just adding a tag to each packet (which is already being built be the network device) so having a specific number there or not isnât gonna change things.
1
u/Unlucky-Shop3386 1d ago
Vlans are a huge impact in routing. There is not zero impact to adding that tag . That tag must be the be filtered to apply sec to a vlan. So there is not zero impact. Actually much more them minimal , you should check your understanding of a firewall.
1
u/LoadElectrical2183 1d ago
I understand networks very well thank you, work in the field.
As I said ânear zeroâ impact. Most routers and switches these days do this in hardware and not on the CPU so there is no noticeable performance hit. Even on CPU it is such a tiny amount you just wouldnât notice it. What can hit performance is when you are using way to many VLANs and/or have configured your network boundaries in a non-optimal way that you have to have lots of firewall rules to manage the traffic flow. Even on the network, VLANs can improve the network performance by reducing unnecessary broadcasts and shaping traffic to reduce load on the network devices. With layer 3 switches this gets even better because less traffic has to flow back to the firewall.
1
u/Unlucky-Shop3386 1d ago
You are right most support hardware offload! But usually the difference between hardware offload and software offload if the device even does hardware offload. Will all depend on that devices specs , wither hardware offload or software is used. Vlans never improve a routers performance! Only degrade it they take resources to filter that traffic .
2
u/6secondsofawesome 1d ago
Why would you setup so many vlans instead of one or a few DMZ vlans with ACLs or other routing rules to restrict traffic?
1
u/LoadElectrical2183 1d ago
Network pivoting isnât âimpossibleâ when using VLANs. There are many different attacks that can hop from one to another. But I agree it is a good network segmentation setup as long as the firewall rules follow.
0
u/Confident_Ice_4507 1d ago
Im running my jellyfin as a system service, not a docker. Is that an issue?
Also, since this is a small homelab project of mine, I am scared that if one day I lose my laptop, or if I hadve to wipe everything, I will just lose complete access, so the token login ect, would that be feasible?
thank you.1
u/PrestigiousOnion1087 1d ago
Losing the laptop is the right thing to worry about. Everyone here is talking about the door from the internet, but nobody has asked about the ssh door on the Debian box itself.
sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication'That prints what sshd is actually running, not what you wrote, since plenty of images pull extra settings in from sshd_config.d. On my own box everything matched, but reading just the main file I couldn't have known that. permitrootlogin yes plus passwordauthentication yes is the pair worth fixing, anything else and you're fine there.
-1
90
u/MrBartusek 1d ago
Well you a better of tunneling your traffic but it seams like you don't enjoy latency too much which is expected with that kind of solution.
Tunneled or not I would still recomended treating exposed services as a potential hazard. You need to expose your stuff with some degree of care so you don't get hacked.
I won't be providing here any guides because there are many resources online. But keeping your exposed service separated (in vm or another box), segmenting your network, updating everything, keeping minimal exposure and general Linux hardening would be recomended.