• 0 Posts
  • 113 Comments
Joined 2 years ago
cake
Cake day: August 2nd, 2023

help-circle






  • A layered defense is always best. Nothing is 100%, but knowing your threat model will help define how far you have to go and how many layers you want in the way. Defending against State level actors looks different than swatting the constant low effort bot traffic. You’re right, if a bad actor gets root on your machine, all security is forfeit. The goal is to minimize that possibility by keeping applications and packages updated and only allowing necessary connections to the machine. You mentioned wireguard or tail scale. Set that up first. Then set up the host firewall to only allow outbound traffic onto the VPN to the required ports and endpoints on the LAN. If the VPS isn’t hosting any public facing services, disable all traffic except the VPN connection from and to the public Internet both on the cloud provider’s firewall and the host firewall. If it is hosting publicly accessible services then use tools like fail2ban and crowdsec to identify and block problem IPs.














  • Agreed.Also, Windows and OSX, unless you want to have to call your nephew who’s Good With Computers™ every couple of weeks. If you’re just using a browser for everything and never messing around like a good majority of people, Linux is just as good as either of those. Linux has gotten to the point where it’s Grandma proof if you stick to a distribution that prioritizes stability. If you choose a distro that prioritizes bleeding edge software versions, you may come across more bugs and breaking changes.Then you’ll need the troubleshooting skills mentioned here. Most of us are here to learn and mess around; the troubleshooting skills grow from that mindset.