Technology

37747 readers

287 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

alyaza@beehaw.org

TheRtRevKaiser@beehaw.org

gyrfalcon@beehaw.org

rs5th@beehaw.org

Los@beehaw.org

coldredlight@beehaw.org

SemioticStandard@beehaw.org

TheRtRevKaiser@kbin.social

remington@beehaw.org

Lemmy server security (lemmy.antemeridiem.xyz)

submitted 1 year ago by Stijn@lemmy.antemeridiem.xyz to c/technology@beehaw.org

23 comments fedilink hide all child comments

I'm almost ready with my lemmy instance server. Now what are some steps that are definitly worth doing after setup?

you are viewing a single comment's thread
view the rest of the comments

[–] Penguincoder@beehaw.org 10 points 1 year ago

Practice standard server security.

Disable all inbound ports in the firewall except for those you absolutely need (like port 80/TCP, port 443/TCP, sshport/TCP, DENY all other inbound)
Use the principle of least privilege. Don't run your docker containers or web server as the root user. Make a new user, give it only the permissions needed in order to run the service definitely not sudo group. Set a strong password for those users, and disable remote/SSH logins for them
For SSH, use public key authentication, disable password login afterward
Instead of fail2ban, I like and would recommend Crowdsec. Needs some fiddling for Lemmy though, due to rate limits and federation