Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been using a cloud server to do all my personal server work -- I don't have a linux laptop so I use it with ssh to do all my office work, work in general, programming, development on it (and using dropbox to get completed files to my laptop) as well as hosting a few web apps on it that really are only meant for personal use (like an online journal web app, an interface for running computations), as well as a git server.

I've decided to build my own server at home with much more powerful components that is much cheaper to maintain than my cloud server. However, I have some concerns about opening up port 80, port 22, etc. to the world on my personal network, which is not only used by me but also my family.

What should I watch out for? I have people that warn me about people compromising my server and being able to hack into our PC's and steal data and stuff. I already have fail2ban, but what precautions should I take before opening up ports to the world like this?

the box is an ubuntu one

(edit: i know there are a lot of things I can do to secure a server in general :) i am just wondering about tips specific to hosting a server on my home network)

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Personally, I would segment my home network so that the server is separated from the rest of the network - that way if the server is breached, it won't be easy to attack your other systems (this is easy if you use something like pfSense - not so easy if you just use a consumer router). Might be overkill - but I take security more seriously than some others.

There are many best-practices guides on securing new servers, so I won't restate it here - but take the time to make sure you've got the configuration right. Make sure you install updates frequently, keep an eye on the logs for anything odd. Tools like fail2ban can go a long way to stop attackers before they can make too much progress - but it's just one layer of protection.

Make sure you limit the ports you expose to just what you need, and nothing extra - the less you expose, the lower your risk. If you open up SSH, make sure you don't allow the root user to login via SSH, and consider using some form of two factor auth.

Many people don't realize just how little most hosts do to protect your server - odd's are your home system will be more secure than what you're paying for now.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.