Home server security: where do I start? [closed]

Question

Closed. This question is off-topic. It is not currently accepting answers.

Want to improve this question? Update the question so it's on-topic for Server Fault.

Closed 13 years ago.

A friend of mine and I are thinking about starting our own business involving code and some fairly advanced IP (at least, we like to think that the IP is advanced). I want to set up a code repository (probably subversion) and a bug tracking server (probably fogbugz) on a home server system that both of us would be able to VPN into from remote locations via laptops. I'd also like this server to be a remote build system running some kind of hudson scripts, maybe via ant, to do automatic testing and build verification.

My question is: what's the most secure way to go about setting this system up? I have a budget of $1k for hardware and software. I have an existing home wireless network using an Apple Wireless base station, a macbook pro running both 10.5 and windows 7, and a home machine running windows 7 that I really just use for games and messing around.

Specificially:

Should I be using Linux? Which distro? How do I lock it down? I realize that this question can start myriad flame wars, but I just want some pointers on how to set up a secure server with those services running (and nothing else, under the assumption that more services = more security holes).
Where can I get good information on setting up a VPN through that router? Should I be going through that apple router, or is there some 'gold standard secure' router I should be looking at?
Static IP (which means changing my ISP) or a dynamic IP? Is it possible to do these sorts of things with a dynamic IP, and if it is, how do I go about setting up the server to be securely, remotely accessible via a dynamic IP?
What kind of hardware should I be looking at? I was thinking about something along the lines of just a core2 duo processor (maybe i7?), regular hard drive, 4 gb RAM, and that's about it, connected to some other backup drive, like a USB-attached hard drive attached to the system with cron jobs to do nightly backups to the second drive. Is that reasonable?

I realize that this is a huge question, and not necessarily straightforward. When I do searches on answers to these questions, I get a lot of information, but none of it is entirely straightforward. So, if anyone knows of a guide or a couple of blog posts that I've missed, I'd really appreciate it.

This sort of goes without saying but I see this mistake made almost every day... 1. PASSWORD PROTECT the physical computer. 2. Don't let other people (friends/family/strangers) touch the computer. Remember, you're only paranoid until it happens... after that you were just well prepared. ;-) — KPWINC, Commented Jun 9, 2009 at 19:09

Evan Anderson · Accepted Answer · 2009-06-09 18:19:28Z

Linux doesn't have magic security pixie dust. Linux installs can be poorly configured, too. Whatever server operating system you use, you need to:

Turn off unnecessary services / daemons.
Check to make sure you really turned off unnecessary services / daemons.
Change any default passwords or disable default accounts.
Understand how to manipulate permissions for files and directories.
Create and use user accounts that have least privilege.
Keep up with security patches for the OS and applications.

Have a look on the Linux Documentation Project site (https://www.tldp.org)-- there are some decent security guides there. You should also look for security docs for each application you're going to be hosting.

Your wireless Ethernet should be treated as an untrusted network, and you should either use a VPN over it, or encrypt everything running on it. Don't use broken encryption algorithms (WEP, WPA) either.

You should use a VPN, as you've stated, to move all traffic over the Internet. There are cheap hardware boxes you can use, though some of them have stability issues. You can run OpenVPN on a host and expose that to the Internet as an "on the cheap" way of doing things with software. You can use SSH tunnels to accomplish this as well. You can go with a standards-based IPec VPN, too. It's a matter of the time / energy you want to spend configuring. You absolutely can use either with dynamic IP addresses. As nik says, dynamic DNS is your friend.

It's good to see you're thinking about backup. I'm dubious of the "backups to the 2nd drive" as a very physical disaster-tolerant scenario, but perhaps that's because I've had a good friend go thru a house fire. I'd definitely recommend using some type of encrypted off-site data replication, or rotating multiple external hard drives (hopefully encrypted) off-site manually. If the data will fit, you might consider using a group of solid state storage devices for off-site rotation, in lieu of hard disk drives (thumb drives, etc).

RAID was mentioned in some comments, so I'll mention it in my edit. I would seriously consider software RAID-1 for this application. You get a lot of benefit without a lot of complexity or potential for issues caused by the RAID system itself. RAID isn't backup, though, so don't consider it as such.

UPS was also mentioned, and is a good idea. You don't have to spend serious amounts of money on it, but I would recommend getting one that has a data connection to allow for graceful shutdown of the server computer in the event of power failure.

I don't particularly see the processor in a server computer as having much to do w/ security. The particular processor your need should be based on the workload.

I don't mean to sound like I'm correcting you, but it's worth mentioning that you don't really want the "most secure way". You've already mentioned a budget, for example. What you really want is configuration that provides a degree of security you're comfortable with, minimizes as many risks as possible, fits within your budget, and is not too cumbersome to use.

Even if you don't use SSH tunnels in this application, since it was mentioned in comments I will throw my support behind it. You should know how to use SSH tunnels because they're just too handy not to know how to use.

dl.aircrack-ng.org/breakingwepandwpa.pdf re: WPA with TKIP being broken. I'd probably use WPA2 in this application with a fairly complex passphrase. (On my home LAN, I treat the wireless as a totally untrusted network and run OpenVPN over it, but I'm a bit of freak). — Evan Anderson, Commented Jun 9, 2009 at 18:27
@MMR WPA2 is good but at the end of the day if your IP is that valuable to you then perhaps you should consider not broadcasting it over radio waves at all? — Rob Moir, Commented Jun 9, 2009 at 18:51
+1 Evan. The "most secure" system is the one you already know how to secure properly. Getting something in that you're not familiar with because you heard it had magic security pixie dust sounds like a really good route to be owned. And to not understanding why. — Rob Moir, Commented Jun 9, 2009 at 18:53
Heh heh... tell the robots that keep banging on my SSH ports that Linux is rarer and less frequently attacked. smile — Evan Anderson, Commented Jun 9, 2009 at 20:06

nik · Accepted Answer · 2009-06-09 18:11:29Z

3

You could go with dynamic IPs and something like DynDNS or maybe EasyDNS.
Linux is good. And, if you are not into getting too deep, you could consider Ubuntu server edition; Book reference: Beginning Ubuntu Server Administration
For the hardware, if you are setting up at home, consider a UPS unless you are located in some place that will never have power outages of any sort.
You might want to consider a RAID configured redundant disk system.
Once you have some stability, consider a kernel hardening patch like grsecurity. There are other hardening patches you can lookup too (no flame wars please).

edited Jun 9, 2009 at 18:11

answered Jun 9, 2009 at 17:37

nik

7,1402 gold badges28 silver badges30 bronze badges

+1. I do not want to start flame war, but IMHO OpenSuse will be better for such a server, because the text mode YaST configuration module can easy a lot of the setup of the apache and other services.
– Sunny
Commented Jun 9, 2009 at 17:54
UPS is a very good call. As for RAID: I've heard from our tech support department that RAID causes more problems than it solves (ie, that it's just one more point of failure). In my own experience, running a RAID5 on an escalade card some four years ago, it really wasn't that helpful because drives kept going out. That may have been due to a wonky card or the drives generating excess heat, but it's really turned me off RAID.
– mmr
Commented Jun 9, 2009 at 18:07
The UPS is a great idea. RAID can be helpful or can be a pain, depending on how well the RAID solution works. For this application, I'd be all over software RAID-1 (disk mirroring).
– Evan Anderson
Commented Jun 9, 2009 at 18:15

Add a comment |

serverhorror · Accepted Answer · 2009-06-09 18:30:37Z

First of since your are talking about a home server and have strong budget constraints (nearly) forget about physical security. Place the box somewhere where your spouse/kid/pets can't reach it to not run into trouble when someone unplugs this thing just to get a place to plug the vacuum cleaner in.

Label that plug so that it is absolutely clear!

Should I be using Linux? Which distro? How do I lock it down? I realize that this question can start myriad flame wars, but I just want some pointers on how to set up a secure server with those services running (and nothing else, under the assumption that more services = more security holes).

Use the OS that you know how to secure. It's no good going with OpenBSD (which has a good security reputation) if you don't know how to keep it secure. The OS I'm most confident with is Debian so I'd use that, your knowledge may be with Windows, Plan9, Solaris. Use the OS you know best!

Define your requirements (you seem to have done so already - that's excellent), and think about wether you absolutely positively need that uber-cool server hardware. I don't think you actually do, rather spend the money on a backup device for offline backups or marketing (or porn).

Where can I get good information on setting up a VPN through that router? Should I be going through that apple router, or is there some 'gold standard secure' router I should be looking at?

I'd go with OpenVPN it is relatively easy to set up and forward that (and only that) port from your router to the box you use. Possibly add in some port knocking (I only know of linux solutions) - the screamers will now come and say security by obscurity and they are right, but given you have a budget I'd consider any cheap layer of security is worth it - hower with that route you'd need additional ports forwarded to the server.

Make the needed services listen only on IPs/interfaces that are not reachable without being connected by a VPN. I'd guess the only services you need will be HTTPS (subversion and a bugtracker).

Configure OpenVPN to use certificates secured with password and passwords for the users (Yes that's possible).

Static IP (which means changing my ISP) or a dynamic IP? Is it possible to do these sorts of things with a dynamic IP, and if it is, how do I go about setting up the server to be securely, remotely accessible via a dynamic IP?

No, don't throw out your money, use free services like dyndns (or whatever that's the only one coming to my mind). As you said you are a startup and paying monthly extra for a static IP won't do any good if you don't really need it - that is unless you want to run Email-Services on your server, then you'll not only need a static IP but make sure you do have control over your reverse DNS also. And also if changin to another ISP that provides static IP cheaper than your current: Go for it!

You may have short outages while the IP service is transitioning to the new IP but that should be doable, if it is too much you can later still switch to a static IP.

What kind of hardware should I be looking at? I was thinking about something along the lines of just a core2 duo processor (maybe i7?), regular hard drive, 4 gb RAM, and that's about it, connected to some other backup drive, like a USB-attached hard drive attached to the system with cron jobs to do nightly backups to the second drive. Is that reasonable?

I'd go with relatively cheap hardware one of Dells Tower Servers (the cheapest one you can find to be exact), the money you saved should be spent on a good support contract in case of a hardware failure and a dedicated backup system and probably a UPS that will at least have enough power to let you server shut down in a sane way.

Given you want to run a source code repo and a bug tracker I conclude you're developing locally and do checkins. Communicate in a formal way over the bugtracker so you and your business partner have something to blame against each other :). 99% percent of the time your server won't do anything.

If you want to get some automated testing add in some RAM, you don't actually care if the build takes 5 minutes or 15 minutes with 2 developers, but you'll be driving nuts if the OpenVPN daemon/service get's killed because of RAM outages everytime your build is runnning.

As others have pointed out: Under all circumstances use a wired connection from the router to the server(s) (live and backup) — serverhorror, Commented Jun 9, 2009 at 18:32
Oh and another thing: your firewall will be configured to deny everything by default right? :) — serverhorror, Commented Jun 9, 2009 at 18:34
Very comprehensive, thanks! The bug tracking is just because I need it to keep track of stuff, not for blaming :) — mmr, Commented Jun 9, 2009 at 18:43

Kevin Kuphal · Accepted Answer · 2009-06-09 17:45:20Z

1

Do yourself a favor and get a hardware router with good VPN support. Even something as inexpensive as the Netgear ProSafe line can be had for $70 or so.

https://www.netgear.com/Products/VPNandSSL/WiredVPNFirewallRouters/FVS114.aspx

These types of units will be very easy to set up and configure. If you end up needing dynamic IP services (which you can just as easily do), use DynDNS as suggested.

answered Jun 9, 2009 at 17:45

Kevin Kuphal

9,1941 gold badge37 silver badges41 bronze badges

So the wireless network hub would connect to this device then, which would then connect to the outside?
– mmr
Commented Jun 9, 2009 at 18:05
Yes, but you can also get versions of the ProSafe equipment that include WiFi if desired, I believe. But since you already have a wireless access point, this would simple replace your router. If your Apple Airport is acting as a router now, you would only have to change it's configuration to be a simple access point instead.
– Kevin Kuphal
Commented Jun 9, 2009 at 18:19

Add a comment |

OtherDevOpsGene · Accepted Answer · 2009-06-09 19:35:38Z

1

Since you are unsure about setting some of the pieces up, why not let someone else do it?

Consider a hosted environment like Assembla, Unfuddle, Origo, XP-Dev, ProjectLocker, CodeSpaces, bitbucket, or github.

Keeps you out of the setup and maintenance of the server and repositories, and most of the hosting sites are inexpensive enough that your $1k will go far.

The downside is that you might have to find a separate continuous integration solution. From the list above, only ProjectLocker mentioned continuous integration tools as a feature.

edited Jun 9, 2009 at 19:35

answered Jun 9, 2009 at 18:17

OtherDevOpsGene

2,5921 gold badge20 silver badges16 bronze badges

What about security? Are they going to be more reliable than rolling my own? A small company really only has its IP and skillz as its assets, and I don't want those going away because someone else messed up. I want the blame entirely on me :)
– mmr
Commented Jun 9, 2009 at 18:29
Outsourcing always has the risk that someone else will screw up your stuff. On the other hand, they do their thing for a living, while you are trying to learn while focusing on something else. Read some reviews, get some feedback from users, and try to do your best due diligence. Ultimately you have to decide if the risk (your companies fate is in someone else's hands) is worth the benefits (someone else takes care of the grunt work and security for you).
– OtherDevOpsGene
Commented Jun 9, 2009 at 19:35

Add a comment |

David Thornley · Accepted Answer · 2009-06-09 20:04:05Z

A few words about backups.

If you don't make sure you can read them, you haven't backed up.

If you don't have off-site backups (your friend's house will do), you don't have good backups.

If your backups are on-line (RAID or hot server), they aren't backups.

Figure what sorts of events could wipe both your system and your backups, and make sure you'll accept the risk. If you have good backups at your friend's house, and the server at yours, then a single event would have to be pretty darn large (and rare) to take out both of them. If the city where I live is nuked, for example, I probably won't worry too much about the business.

None of the lower-cost media for backups are all that durable, so don't just have one backup that you might lose for assorted reasons.

And, if you decide to go with a hosting service, keep your own backups anyway. If your hosting company loses your data, they've hurt a customer, which isn't good, but your business is dead, and that's worse. If your service goes out of business, you may never see your data again.

The person most concerned with your backups is you, and this is something you can normally do for yourself. Do so.

msanford · Accepted Answer · 2009-06-09 20:14:36Z

This is exactly how I got my start, and I still run a home server sandbox.

Use a wired connection for your server, not airport.
After using Slackware, Fedora, SuSE, CentOS and Ubuntu, I would suggest Ubuntu Server https://www.ubuntu.com/products/whatisubuntu/serveredition as it makes management and improving security somewhat easier out-of-the-box, but really, distribution is mostly dependant on personal preference. All the above distributions have big communities behind them (though Slackware's is pretty small in comparison).

As for hardware: my home sandbox runs on a 64-bit server-quality tower with two SATA RAID arrays (system, services) and 2 gigs of RAM, which is plenty for this application. The specs you suggest are possibly overkill, but if you can afford it, definitely go for it. In the long run, you'll only need more, right.

As for backing up, you can save some cash by forgoing the USB hard drive and just putting in a second hard drive that copies in the same cron-based manner. Note, though, that I'm not suggesting a RAID mirroring array, since this is not a backup, but just a second hard disk. You'll save money on the enclosure, and transfer speeds will be somewhat higher than with an external. A superior backup method would be off-site, or to a NAS device.

And security: learn how to tunnel everything. You'll likely only need to open 80 (and maybe 443) and 22 to the outside world. Tunnel the rest over ssh for remote administration. You may even be able to tunnel all the services you need, saving the cost of a VPN router.

EDIT To create an ssh tunnel:

ssh remote.host.com -L local_port:remote_network_address:remote_port

So, from outside my network, if I want access to my router's web interface from my laptop which is outside my LAN, I use

ssh my-home.com -L 8081:192.168.0.1:80

and then open up a browser and hit https://localhost:8081 and voilà--encrypted tunnel from localhost:8081 to 192.168.0.1:80 on the remote host's LAN. If you need to do this from Windows, PuTTY (IMHO, the de facto Windows ssh client) will allow you to configure them before you connect. The above code works on any *nix (including Mac OS X).

Good points, thanks for the tips. I will have to figure out tunneling, I suppose... — mmr, Commented Jun 9, 2009 at 18:12

Stack Exchange Network

Home server security: where do I start? [closed]

7 Answers 7

Hot Network Questions

Home server security: where do I start? [closed]

7 Answers 7

Related

Hot Network Questions