this post was submitted on 17 Oct 2023
2 points (100.0% liked)

Self-Hosted Main

504 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
communick@selfhosted.forum
2
Worst case scenario after an attack (alien.top)
submitted 1 year ago by Suspicious-Iron-5526@alien.top to c/main@selfhosted.forum
14 comments fedilink hide all child comments
 

As title says, i'm curious about the worst case scenario in which an attacker tries to hit my system.

The system configuration is the following: i have some services (important ones) accessible only trough VPN, like SSH (key-based auth only), Pihole...Others are publicly accessible, like Immich, Jellyfin (and so on...).Public ones are accessible via reverse proxy (Caddy) and protected by CrowdSec (which bans IPs outside my country and those failing auth 3 times).

What could happen if an attacker finds out a vulnerability on some public service? Would he be only able to access service's files (like an appropriate login), or delete/encrypt data (as some cases of blackmail) or even pull out and steal my data?
I'm wondering this because i want to know if CrowdSec+Docker (to preserve permissions on the system) is enough to secure a server.

you are viewing a single comment's thread
view the rest of the comments
[–] merizi@alien.top 1 points 1 year ago

In nation state attack at least your government may be on your side.

Probably worst case for an individual is that your network is used to store or transmit illegal content. Even if a law enforcement analyst tracking a person spreading this illegal content (CSAM) knows you are basically innocent, it’s much more likely you get caught up some other way with local law enforcement or similar.

Initially, it may be hard to prove it’s not you because you are dealing with someone who is not an IT person first. This may spiral to losing your job or reputation should you do something like teach or run a club.

Regular attacks against google and the like pivot through 20+ machines. Many compromised machines will never be encrypted because the attacker needs to sit undetected for as long as possible.