Web Server - Secure way to do it?

[pirateghost]

If you have a weak SSH password and someone brute forces their way in to your NAS they have access to all of your data and all of your jails, if you just expose SSH from the jail that runs the webserver and someone brute forces their way in they're stuck within your jail and only have access to what you have allowed it to have access to.

He didn't say to expose the SSH service from the NAS to the world.....

 

[brando56894]

He didn't say to expose the SSH service from the NAS to the world.....

True, I just assumed remote access to the world.

 

[pirateghost]

True, I just assumed remote access to the world.

never, man. it is assumed that you only admin your NAS from a secure network. @danb35 knows what he is talking about and would never recommend someone open SSH to the internet.

 

[Jailer]

never, man. it is assumed that you only admin your NAS from a secure network. @danb35 knows what he is talking about and would never recommend someone open SSH to the internet.

Unless you're intending to start your own Chinese/Russian/Ukrainian private social network.

 

[pirateghost]

Unless you're intending to start your own Chinese/Russian/Ukrainian private social network.

those are always fun...

 

[danb35]

@danb35 knows what he is talking about and would never recommend someone open SSH to the internet.

Thanks for the vote of confidence, but SSH is fairly safe to open to the Internet. Disable password logins, and disable root logins, and you're going to be pretty darn secure. But that said, you understood my assumptions correctly. @brando56894, if you have a web server in a jail, and you expose that jail to the Internet, there's no corresponding reason to expose the NAS to the Internet, and plenty of good reasons not to.

 

[brando56894]

Thanks for the vote of confidence, but SSH is fairly safe to open to the Internet. Disable password logins, and disable root logins, and you're going to be pretty darn secure. But that said, you understood my assumptions correctly. @brando56894, if you have a web server in a jail, and you expose that jail to the Internet, there's no corresponding reason to expose the NAS to the Internet, and plenty of good reasons not to.

Exactly! And for added security change the port from 22 to something high, security through obscurity. I agree that it's pretty damn secure if you take the right measures, it's called secure shell for a reason haha

 

[Robert Trevellyan]

change the port from 22 to something high

It's amazing how much difference this makes to the number of failed logins on a publicly visible SSH server. For a while I experimented with a backupsy VPS, with SSH on 22, and auth.log showed failed login attempts every few minutes, all day, every day. When I moved SSH to a different port auth.log went completely quiet - literally no activity.

 

[nightshade00013]

It's amazing how much difference this makes to the number of failed logins on a publicly visible SSH server. For a while I experimented with a backupsy VPS, with SSH on 22, and auth.log showed failed login attempts every few minutes, all day, every day. When I moved SSH to a different port auth.log went completely quiet - literally no activity.

Like I said before, moving things to non standard ports when you are the only one using the service helps a ton. Everyone knows what the standard ports are and will try to mess with them, using a different port requires someone to scan EVERYTHING and then try and make a guess which service is on that open port. Does little good to try and connect to a non standard port that is running a ssh server with a mail client they just won't work together.

 

[danb35]

I guess I just don't see the issue. Why does it matter if the whole world is banging on your ssh server? If you're limited to public-key authentication (and there's no reason not to--even the free SSH client on my iPhone supports public key authentication), and you've blocked root logins, they aren't going to get in. I run a public-facing Linux web/mail server, and it does have SSH exposed on port 22, configured as I just stated. It also has Fail2ban running. I do see a number of blocked IPs due to failed logins, but that's to be expected.

 

[nightshade00013]

If the ENTIRE world is banging on your ssh server in your home it's pretty easy to be denied service. If a port is exposed and someone decides they want to be nasty and setup a DOS attack you will be shut down till the attack stops. On top of that if your ISP gets PO'ed they could determine that they are going to say you didn't follow their use rules and discontinue service. And who knows WHAT flaws may have already been found and not reported or will be found in the future in the SSH service.

And just because an IP address is blocked it does not mean that the computer behind the IP can be stopped from causing problems. It is very possible for that person to get the idea that because you banned them they should retaliate in some way, at least till they get bored and what will you do if they decide to let a botnet do the work and then leave it for a week.

 

[asifuz]

I guess what I would do is use a jail for the web server and open the 80 port for this jail only. I don't see any other secure way to do this but I'd love to know more on this subject as I'll maybe need to put a web server on my NAS too.

....................................
I don't understand?????????? why you say many NAS website hosting threads "JAIL"........ is this really a crime???
Please let me know,,,, because I am going to build my public server and put my website into it,,,, and also doing some hosting for it.

 

[danb35]

Once again, please, in English, with some indication that you have at least a passing familiarity with what FreeNAS is and what it's used for.

 

[Ericloewe]

I think he's worried about possible illegalities, because the word "jail" gets thrown around so much? That's a new one, anyway.

For the record, it's a name. A metaphor for the software that is running in there - it's jailed, it can't hurt the rest of the system (ideally).