• BBS Security...

    From Shurato@21:2/148 to All on Sat Aug 29 11:44:00 2026
    The only things I'm not doing that have been suggested are VLANs (I want all
    of my systems to be able to connect to eachother on the same subnet, so I
    don't know if I can do this), tunneling and reverse proxies as well. I'm not sure if I can do that with non- http services (telnet, ftp, ssh, nntp) as
    well as if I would need ssl certs for each domain. I'm not a business, so I don't know if I need those. I've got fail2ban through crowdsec and rgtel, geoip blocking, bad actor lists through crowdsec, qfeeds and maltrail and suricata, dns blocking through zen armor and the above and unbound as well as filtering through quad9). I also have clamav checking my traffic. The main thing I'm concerned about though, is the fact that none of my traffic
    filtering handles https. I'm poor and can't afford the licenses that would support that (hundreds of dollars a month I think).

    --
    Shurato, Sysop Shurato's Heavenly Sphere (ssh, telnet, pop3, ftp,nntp,
    ,wss, ssh utf-8) (22,23,110,21,119,999,2222) shsbbs.net FREQ FILES !


    *** THE READER V4.50 [freeware]
    ---
    * Origin: Shurato's Heavenly Sphere telnet://shsbbs.net (21:2/148)
  • From NuSkooler@21:1/121 to Shurato on Thu Sep 3 12:17:23 2026
    Twas Saturday, August 29th when Shurato said...
    The only things I'm not doing that have been suggested are VLANs (I want all of my systems to be able to connect to eachother on the same subnet, so I don't know if I can do this), tunneling and reverse proxies as well.
    I'm not sure if I can do that with non- http services (telnet, ftp, ssh, nntp) as well as if I would need ssl certs for each domain. I'm not a business, so I don't know if I need those. I've got fail2ban through crowdsec and rgtel, geoip blocking, bad actor lists through crowdsec, qfeeds and maltrail and suricata, dns blocking through zen armor and the above and unbound as well as filtering through quad9). I also have clamav checking my traffic. The main thing I'm concerned about though, is the fact that none of my traffic filtering handles https. I'm poor and can't afford the licenses that would support that (hundreds of dollars a month I think).

    I'm missing context here, I think, but you don't need to a lot of money for good BBS security. I suggest a setup sort of like this:

    {internet} -> [*PHYSICAL* firewall] -> [nginx or caddy TLS term] -> Your services.

    Physical FW: An older box will due, especially for BBS traffic. Install pfSense or similar.

    nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).

    Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.


    --
    |08 þ |12NuSkooler |06// |12Xibalba |08- |07"|06The place of fear|07"
    |08 þ |03xibalba|08.|03vip |08(|0344510|08/|03telnet|08, |0344511|08/|03ssh|08) |08 þ |03ENiGMA 1/2 WHQ |08| |03Phenom |08| |0367 |08| |03iMPURE |08| |03ACiDic --- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.22.2)
    * Origin: Xibalba -+- xibalba.vip:44510 (21:1/121)
  • From Shurato@21:2/148 to NuSkooler on Thu Sep 3 17:32:00 2026
    nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).

    Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.

    This part really needs to be explained to me in greater detail. Can't I use
    my NoIP certs? Right now I've got a cert set up for shsbbs.net, but not subdomains as I'd need one for each. If I want to use zen armor with TLS,
    I'd have to pay a great deal for licenses and to use a local cert to
    re-encrypt would show people that the cert was invalid, wouldn't it?

    --
    Shurato, Sysop Shurato's Heavenly Sphere (ssh, telnet, pop3, ftp,nntp,
    ,wss, ssh utf-8) (22,23,110,21,119,999,2222) shsbbs.net FREQ FILES !


    *** THE READER V4.50 [freeware]
    ---
    * Origin: Shurato's Heavenly Sphere telnet://shsbbs.net (21:2/148)
  • From poindexter FORTRAN@21:4/122 to NuSkooler on Fri Sep 4 07:50:15 2026
    NuSkooler wrote to Shurato <=-

    I'm missing context here, I think, but you don't need to a lot of money for good BBS security. I suggest a setup sort of like this:

    {internet} -> [*PHYSICAL* firewall] -> [nginx or caddy TLS term] ->
    Your services.

    Physical FW: An older box will due, especially for BBS traffic. Install pfSense or similar.

    nginx or caddy do your TLS termination. For TLS/HTTPS, you use Let's Encrypt and ACME (free).

    Your callers get HTTPS/TLS/security, your infra sits behind a firewall. Your scanning/etc. can look at the traffic between the TLS term and the services themselves as it will be plain text by then.


    Just adding in here, there is a reverse proxy called NGINX Proxy Manager
    that makes a nice graphical front end for NGINX Proxy, and NPM+ includes crowdsec support to make a free web application firewall out of it.




    --
    |08 þ |12NuSkooler |06// |12Xibalba |08- |07"|06The place of fear|07"
    |08 þ |03xibalba|08.|03vip |08(|0344510|08/|03telnet|08,
    0344511|08/|03ssh|08)
    |08 þ |03ENiGMA 1/2 WHQ |08| |03Phenom |08| |0367 |08| |03iMPURE |08|
    03ACiDic
    --- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.22.2)
    * Origin: Xibalba -+- xibalba.vip:44510 (21:1/121)

    ... In England, Baseball is known as American Cricket.
    --- MultiMail/Win v0.52
    * Origin: realitycheckBBS.org -- information is power. (21:4/122)
  • From NuSkooler@21:1/121 to Shurato on Fri Sep 4 11:45:52 2026
    Shurato around Thursday, September 3rd...
    This part really needs to be explained to me in greater detail. Can't I use my NoIP certs? Right now I've got a cert set up for shsbbs.net, but not subdomains as I'd need one for each. If I want to use zen armor with TLS, I'd have to pay a great deal for licenses and to use a local cert to re-encrypt would show people that the cert was invalid, wouldn't it?

    If your IP address is changing very often, I think this can still work fine.

    Your NoIP certs: I'm not sure what you have there, so I can't answer. I don't know anything about Zen Armor, either.

    - You can use Let's Encrypt to get your certs, includnig sub domains, 100% free - Find a ACME client you like to achieve the above & keep your certs up to date automatically
    - You can use free nginx or caddy to TLS terminate from the outside (internet) to your internal infra/services. Similar solutions exist for SSH if you want it. These are "reverse proxies".
    - Put a firewall in front of it all. Orthogonal to the rest.

    --
    |08 þ |12NuSkooler |06// |12Xibalba |08- |07"|06The place of fear|07"
    |08 þ |03xibalba|08.|03vip |08(|0344510|08/|03telnet|08, |0344511|08/|03ssh|08) |08 þ |03ENiGMA 1/2 WHQ |08| |03Phenom |08| |0367 |08| |03iMPURE |08| |03ACiDic --- ENiGMA 1/2 v0.5.1-beta (linux; x64; 22.22.2)
    * Origin: Xibalba -+- xibalba.vip:44510 (21:1/121)
  • From Shurato@21:2/148 to NuSkooler on Sat Sep 5 00:42:00 2026

    Shurato around Thursday, September 3rd...
    This part really needs to be explained to me in greater detail.
    Can't I
    use my NoIP certs? Right now I've got a cert set up for shsbbs.net,
    but
    not subdomains as I'd need one for each. If I want to use zen armor
    with
    TLS, I'd have to pay a great deal for licenses and to use a local
    cert to
    re-encrypt would show people that the cert was invalid, wouldn't it?

    If your IP address is changing very often, I think this can still work fine.

    Your NoIP certs: I'm not sure what you have there, so I can't answer. I don't know anything about Zen Armor, either.

    - You can use Let's Encrypt to get your certs, includnig sub domains, 100% free - Find a ACME client you like to achieve the above & keep your
    certs up to date automatically - You can use free nginx or caddy
    to TLS terminate from the outside (internet) to your internal infra/services. Similar solutions exist for SSH if you want it.
    These are "reverse proxies". - Put a firewall in front of it all. Orthogonal to the rest.

    Ok, I used acme with caddy. Finally got it working and did somethings stupid that totally killed my network... I had to reinstall opnsense. Fortunately once it was reinstalled I was able to restore a backup. I didn't have
    reverse proxy working at that time though... Now I'm rate limited by letsencrypt, so I can't do anything for a week due to 5 ssl certs being issued... I'm not sure what to do other than wait. Fortunately, my main
    domain is safe, so I can still use it with port numbers.

    --
    Shurato, Sysop Shurato's Heavenly Sphere (ssh, telnet, pop3, ftp,nntp,
    ,wss, ssh utf-8) (22,23,110,21,119,999,2222) shsbbs.net FREQ FILES !


    *** THE READER V4.50 [freeware]
    ---
    * Origin: Shurato's Heavenly Sphere telnet://shsbbs.net (21:2/148)
  • From Shurato@21:2/148 to NuSkooler on Sat Sep 5 11:10:00 2026
    - You can use Let's Encrypt to get your certs, includnig sub domains, 100% free - Find a ACME client you like to achieve the above & keep your
    certs up to date automatically - You can use free nginx or caddy
    to TLS terminate from the outside (internet) to your internal infra/services. Similar solutions exist for SSH if you want it.
    These are "reverse proxies". - Put a firewall in front of it all. Orthogonal to the rest.

    Everything is working now, but I still have to port forward the ports for
    those servers, as they're accessed with path names... Othewise, those paths can't be accessed externally (e.g. https://shsbbs.net:8883/stream is https://radio.shsbbs.net, but with /stream after it. The server doesn't know the difference. I could get rid of the port forwarding, if people knew to access https://radio.shsbbs.net/stream instead of just the domain, I guess
    but that's asking a lot of people.

    --
    Shurato, Sysop Shurato's Heavenly Sphere (ssh, telnet, pop3, ftp,nntp,
    ,wss, ssh utf-8) (22,23,110,21,119,999,2222) shsbbs.net FREQ FILES !


    *** THE READER V4.50 [freeware]
    ---
    * Origin: Shurato's Heavenly Sphere telnet://shsbbs.net (21:2/148)
  • From Shurato@21:2/148 to All on Sat Sep 5 11:40:00 2026
    Ok, I've got reverse proxy on all of my servers except for one radio station
    so that it's accessible by shoutcast apps. Is there anything I can do to better secure my non-https services like news, telnet, ssh, twgs and sqgs? Having 5 exposed and ports 80 and 443 instead of about 15 ports is a big
    boost!

    --
    Shurato, Sysop Shurato's Heavenly Sphere (ssh, telnet, pop3, ftp,nntp,
    ,wss, ssh utf-8) (22,23,110,21,119,999,2222) shsbbs.net FREQ FILES !


    *** THE READER V4.50 [freeware]
    ---
    * Origin: Shurato's Heavenly Sphere telnet://shsbbs.net (21:2/148)