0

I have a small VPS (Ubuntu 16.04) that I use for hosting of a few personal websites, ownCloud, etc. It's fairly slow and doesn't have a lot of storage. I'd like to offload the ownCloud storage and MySQL database, basically anything resource-intensive, onto my home server (Ubuntu 17.10), without opening my home network any more than absolutely necessary.

What's the best way to do this from a security standpoint? There are three options that I can think of:

  1. Expose MySQL and NFS on nonstandard ports, firewall all but the VPS's IP.
  2. Establish an SSH tunnel, route all MySQL and NFS traffic through the tunnel.
  3. Set up a VPN, ditto.

My concern in the case of 2 and 3 is that if my VPS is compromised I may end up exposing more of my home network that I intend – it's the VPS that decides which remote ports/IPs it's going to tunnel to, so once the tunnel is set up, any attacker can add new tunnels.

1 Answer 1

1

Option 3 (and option 2 is a special case of Option 3) is clearly the way to go.

It provides more security then option 1, and you are no more at risk of your home server getting compromised then you would be using option 1, but you can be sure the data is encrypted, unlike option 1 which is a very weak version of security through obscurity.

One way to handle this is to set up appropriate VPS's on my home server, and thus if the off-site VPS was compromised, and they could somehow leverage that to compromise to provide elevated access to your home server - they would still be in a VM.

2
  • Thanks. I ended up going with option 3, and using hosts.allow/hosts.deny to firewall all but the services I wanted to expose to the VM. I don't know of a way to enable ssh tunneling without allowing tunneling to arbitrary ports/IPs on my local network, so that was a non-starter.
    – Mikkel
    Mar 5, 2018 at 15:52
  • 1
    You really should use iptables to firewall your traffic - hosts.allow/deny is useful, but iptables is at a lower level and can deal with all programs.
    – davidgo
    Mar 5, 2018 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .