182
What are the most paranoid network/OS security measures you've implemented in your homelab? (lemmy.world)
submitted 2 years ago by to c/selfhosted@lemmy.world
130 comments fedilink hide all child comments
 

As the title says, I want to know the most paranoid security measures you've implemented in your homelab. I can think of SDN solutions with firewalls covering every interface, ACLs, locked-down/hardened OSes etc but not much beyond that. I'm wondering how deep this paranoia can go (and maybe even go down my own route too!).

Thanks!

you are viewing a single comment's thread
view the rest of the comments
[–] 0 points 2 years ago (1 child)

Declarative OS, tmpfs root, disabled sudo

How do you change anything about the OS/do updates? iirc nixos requires elevated privileges for that?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago* (last edited 2 years ago)

    There are many ways to do many things in nixos

    For updates you can do automatic updates

    Also, there are many deployment tools, like deploy-rs, morph, colmena, bento. They all have different approaches. Some you use ssh to deploy a remote system. Some just fetch the configuration and autodeploy it.

    There are many ways how you can play with this. So you can disable sudo, and deploy with ssh only from some or a specified ip. Or you can keep ssh for root disabled and just deploy home-manager. It's really a lot, you imagination is the only limit

    P.s. or you can just generate an image from a trusted machine, and flash it onto the device you want, unlimited number of ways

  • permalink
  • fedilink
  • source
  • parent