The only things I'm not doing that have been suggested are VLANs (I want all of my systems to be able to connect to eachother on the same subnet, so I don't know if I can do this), tunneling and reverse proxies as well.
I'm not sure if I can do that with non- http services (telnet, ftp, ssh, nntp) as well as if I would need ssl certs for each domain. I'm not a business, so I don't know if I need those. I've got fail2ban through crowdsec and rgtel, geoip blocking, bad actor lists through crowdsec, qfeeds and maltrail and suricata, dns blocking through zen armor and the above and unbound as well as filtering through quad9). I also have clamav checking my traffic. The main thing I'm concerned about though, is the fact that none of my traffic filtering handles https. I'm poor and can't afford the licenses that would support that (hundreds of dollars a month I think).
nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).
Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.
NuSkooler wrote to Shurato <=-
I'm missing context here, I think, but you don't need to a lot of money for good BBS security. I suggest a setup sort of like this:
{internet} -> [*PHYSICAL* firewall] -> [nginx or caddy TLS term] ->
Your services.
Physical FW: An older box will due, especially for BBS traffic. Install pfSense or similar.
nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).
Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.
--|08 þ |12NuSkooler |06// |12Xibalba |08- |07"|06The place of fear|07"
--- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.22.2)
* Origin: Xibalba -+- xibalba.vip:44510 (21:1/121)
This part really needs to be explained to me in greater detail. Can't I use my NoIP certs? Right now I've got a cert set up for shsbbs.net, but not subdomains as I'd need one for each. If I want to use zen armor with TLS, I'd have to pay a great deal for licenses and to use a local cert to re-encrypt would show people that the cert was invalid, wouldn't it?
Shurato around Thursday, September 3rd...
This part really needs to be explained to me in greater detail.Can't I
use my NoIP certs? Right now I've got a cert set up for shsbbs.net,but
not subdomains as I'd need one for each. If I want to use zen armorwith
TLS, I'd have to pay a great deal for licenses and to use a localcert to
re-encrypt would show people that the cert was invalid, wouldn't it?
If your IP address is changing very often, I think this can still work fine.
Your NoIP certs: I'm not sure what you have there, so I can't answer. I don't know anything about Zen Armor, either.
- You can use Let's Encrypt to get your certs, includnig sub domains, 100% free - Find a ACME client you like to achieve the above & keep your
certs up to date automatically - You can use free nginx or caddy
to TLS terminate from the outside (internet) to your internal infra/services. Similar solutions exist for SSH if you want it.
These are "reverse proxies". - Put a firewall in front of it all. Orthogonal to the rest.
- You can use Let's Encrypt to get your certs, includnig sub domains, 100% free - Find a ACME client you like to achieve the above & keep your
certs up to date automatically - You can use free nginx or caddy
to TLS terminate from the outside (internet) to your internal infra/services. Similar solutions exist for SSH if you want it.
These are "reverse proxies". - Put a firewall in front of it all. Orthogonal to the rest.
Ok, I've got reverse proxy on all of my servers except for one radio station so that it's accessible by shoutcast apps. Is there anything I can do to better secure my non-https services like news, telnet, ssh, twgs and sqgs? Having 5 exposed and ports 80 and 443 instead of about 15 ports is a big boost!
- NNTP and Telnet at least are both plain-text - SSH, already secure (assuming your keys are safe)
Twas Saturday, September 5th when Shurato said...
Ok, I've got reverse proxy on all of my servers except for one radio station so that it's accessible by shoutcast apps. Is there anythingI
can do to better secure my non-https services like news, telnet, ssh,
twgs and sqgs? Having 5 exposed and ports 80 and 443 instead of about15
ports is a big boost!
Nice!
- NNTP and Telnet at least are both plain-text - SSH, already secure (assuming your keys are safe)
BUT, depending on your firewall, you can use things like SNORT to monitor for misbehaving connections, exploit attempsts, so on and sort of auto-ban them when detected/etc.
I don't use Keys, it's just a shiv for telnet.
I got stunnel working with NNTP for NNTPS.
I've got suricata set up!
- NNTP and Telnet at least are both plain-text - SSH, already secure (assuming your keys are safe)
Ok, TelnetS is now working with syncterm! It required a bit of finagling with ciphers, but it works.
Anyone actually use that? I may add it to RGTERM.
On Friday, September 11th Exodus muttered...
Anyone actually use that? I may add it to RGTERM.
I'm not sure why you'd ever do this instead of SSH?
| Sysop: | Tetrazocine |
|---|---|
| Location: | Melbourne, VIC, Australia |
| Users: | 9 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 102:29:50 |
| Calls: | 220 |
| Files: | 21,513 |
| Messages: | 82,818 |