The only things I'm not doing that have been suggested are VLANs (I want all of my systems to be able to connect to eachother on the same subnet, so I don't know if I can do this), tunneling and reverse proxies as well.
I'm not sure if I can do that with non- http services (telnet, ftp, ssh, nntp) as well as if I would need ssl certs for each domain. I'm not a business, so I don't know if I need those. I've got fail2ban through crowdsec and rgtel, geoip blocking, bad actor lists through crowdsec, qfeeds and maltrail and suricata, dns blocking through zen armor and the above and unbound as well as filtering through quad9). I also have clamav checking my traffic. The main thing I'm concerned about though, is the fact that none of my traffic filtering handles https. I'm poor and can't afford the licenses that would support that (hundreds of dollars a month I think).
nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).
Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.
NuSkooler wrote to Shurato <=-
I'm missing context here, I think, but you don't need to a lot of money for good BBS security. I suggest a setup sort of like this:
{internet} -> [*PHYSICAL* firewall] -> [nginx or caddy TLS term] ->
Your services.
Physical FW: An older box will due, especially for BBS traffic. Install pfSense or similar.
nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).
Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.
--|08 þ |12NuSkooler |06// |12Xibalba |08- |07"|06The place of fear|07"
--- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.22.2)
* Origin: Xibalba -+- xibalba.vip:44510 (21:1/121)
This part really needs to be explained to me in greater detail. Can't I use my NoIP certs? Right now I've got a cert set up for shsbbs.net, but not subdomains as I'd need one for each. If I want to use zen armor with TLS, I'd have to pay a great deal for licenses and to use a local cert to re-encrypt would show people that the cert was invalid, wouldn't it?
Shurato around Thursday, September 3rd...
This part really needs to be explained to me in greater detail.Can't I
use my NoIP certs? Right now I've got a cert set up for shsbbs.net,but
not subdomains as I'd need one for each. If I want to use zen armorwith
TLS, I'd have to pay a great deal for licenses and to use a localcert to
re-encrypt would show people that the cert was invalid, wouldn't it?
If your IP address is changing very often, I think this can still work fine.
Your NoIP certs: I'm not sure what you have there, so I can't answer. I don't know anything about Zen Armor, either.
- You can use Let's Encrypt to get your certs, includnig sub domains, 100% free - Find a ACME client you like to achieve the above & keep your
certs up to date automatically - You can use free nginx or caddy
to TLS terminate from the outside (internet) to your internal infra/services. Similar solutions exist for SSH if you want it.
These are "reverse proxies". - Put a firewall in front of it all. Orthogonal to the rest.
- You can use Let's Encrypt to get your certs, includnig sub domains, 100% free - Find a ACME client you like to achieve the above & keep your
certs up to date automatically - You can use free nginx or caddy
to TLS terminate from the outside (internet) to your internal infra/services. Similar solutions exist for SSH if you want it.
These are "reverse proxies". - Put a firewall in front of it all. Orthogonal to the rest.
| Sysop: | Heisenberg |
|---|---|
| Location: | Kalgoorlie, Western Australia |
| Users: | 12 |
| Nodes: | 4 (0 / 4) |
| Uptime: | 23:05:11 |
| Calls: | 67 |
| Files: | 1 |
| D/L today: |
1 files (527K bytes) |
| Messages: | 21,029 |