this post was submitted on 22 Nov 2023
4 points (100.0% liked)
Homelab
371 readers
3 users here now
Rules
- Be Civil.
- Post about your homelab, discussion of your homelab, questions you may have, or general discussion about transition your skill from the homelab to the workplace.
- No memes or potato images.
- We love detailed homelab builds, especially network diagrams!
- Report any posts that you feel should be brought to our attention.
- Please no shitposting or blogspam.
- No Referral Linking.
- Keep piracy discussion off of this community
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I watch networkchuck on occasion, but some of his ideas are... questionable I think. Not necessarily wrong, but not the "YOU MUST DO THIS" that his titles suggest (I get it, get clicks, no hate).
Of the ideas you mentioned, (2), (3), (4), and (5) are somewhere between "reasonable" and "definitely". The rest are either iffy (unattended updates) or security theater (disable ICMP, change ports).
Something to keep in mind for step (2), securing SSH login with a key: this is only as secure as your key. If your own machine, or any machine or service that stores your key, is compromised then your entire network is compromised. Granted, this is kind of obvious, but just making it clear.
As for security theater, specifically step (6). Don't disable ping. It adds nothing to security and makes it harder to troubleshoot. If I am an attacker in a position for ping to get to an internal resource in the first place, then I'm just going to listen for ARP broadcasts (on same subnet) or let an internal router do it for me ("request timed out" == host is there but not responding).