I just spun up a private instance of lemmy on the cheapest Linode. So far so good.

I used the ansible method of installing the instance on the default Debian 11 image from Linode (link below).

I feel a bit worried that there are no firewall instructions in the install documents. And no notes on securing your instance.

Any thoughts on how to set up ufw for a lemmy instance? Or thoughts on other security tips?

https://github.com/LemmyNet/lemmy-ansible

  • exu@feditown.com
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    A firewall won’t help you much beyond making sure no unwanted ports are open. The ansible install of Lemmy makes sure to only expose the ports 80 and 443 to the outside, which is fine for running a webserver. Additionally, Lemmy sets up a containerised environment for itself, so even if Lemmy is compromised, there is an additional hurdle to overcome if somebody wanted to compromise the underlying server itself.

    As a more general security tip, I’d recommend you set up SSH with key based authentication and disable password authentication after you did that. Passwords can be brute forced, completely compromising your server if found.

    • mbirth@lemmy.mbirth.uk
      link
      fedilink
      English
      arrow-up
      5
      ·
      1 year ago

      Also consider changing the port for SSH to some random port >1024 and maybe install fail2ban for good measure.

    • flea@hive.atlanten.seOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Thanks! Good insight. For sure password-ssh is disabled and strong crypto used. I think this I’m at “good enough” for what I’m protecting atm.