• 0 Posts
  • 125 Comments
Joined 2 years ago
cake
Cake day: April 30th, 2024

help-circle







  • I’m in the process of building a monitoring system with grafana stack.

    Right now I have monitoring panels for some common metrics and logs. I am yet to set up alerts.

    The idea being that if something goes wrong some metric will grow up unexpectedly, for instance network traffic. And I would get a notification.

    What I’m still considering is what would I consider abnormal behavior, so I could set up the thresholds.


  • What do you want to expose, something static or dynamic?

    It would be a service you wrote or some stablish project?

    I would recommend running whichever service you want to expose through a reverse proxy, traefik or caddy. That way you have some sort of “chocking point” where you can control what’s going and it’s already handling some security for you.

    The service should be kept updated.

    Then you need a ips (intrusion prevention system). Most famous are fail2ban or crowdsec. You feed the ips the service logs and the reverse proxy logs, and ban ips that try to do something strange. I use crowdsec with a bunch of scenarios and their block lists.

    At the end you should only have a couple of ports open to the internet. Usually 80 and 443, and whichever port you use for the vpn, i recommend wireguard. So people should only connect to you via 80 or 443 and those ports should be binded to the reverse proxy. Everything else should never be able to enter your network.

    If you have all that and keep everything updated the attack surface becomes really small. You’ll get spam bots trying to probe for vulnerabilities but if you keep everything updated they won’t find anything.

    Depending on how many people you want to access your service you could also do some aggressive geoblocking, to reduce the number of bot attacks.

    The biggest risk here would be a vulnerability on the reverse proxy or the service you use. Keep an eye out for cve and update things regularly. If a vulnerability allows for remote code execution, then mitigation becomes almost impossible besides a good backup plan. If your vpn fails on you you are also fucked. But wireguard is pretty well secured. Bot scans shouldn’t even be able to know you have wg because pings and connections attempts fail silently without proper authentication.











  • I think it is mostly because people feel more free to express those thoughts because the president of the US share those thoughts.

    But they thought like that to begin with, that’s why they voted for him.

    I think it’s an uncomfortable truth, but people genuinely think like that not because they have been brainwashed or because propaganda. The same our political thoughts are based their political thoughts are based too.

    I think it’s important not underestimate the opponent, because then we won’t really understand why it rose to power. I think it’s a mistake thinking that baning hate speech will prevent something like Trump getting elected. I live in Europe where hate speech is mostly banned. Still the turn to the far right is growing even faster and more right than the US. People don’t say nasty things in public, political representatives don’t say those things in public. Because there’s laws against that. But people think nasty things and say them in private all the time. Because they have developed a political thinking around that. And it’s not that simple as “they became radical because a political representative said a bad thing on twitter” they developed those political thoughts the same we all developed our political thoughts.