-1

Let's say I configure a raspberry as an openvpn server to secure my laptop/smartphone connections at home and foreign networks. If, for some reason, my server gets compromised, are the provided secure connections established with other devices (clients) also compromised? If so,

  1. How hard is to compromise that server in first place?
  2. If compromised, is the encrypted data between server-client at risk?
  3. How can I secure a domestic server? (basic setup)

Thanks in advance.

Improve this question
0

2 Answers 2

Reset to default
1

If ... my server gets compromised, are the provided secure connections established with other devices (clients) also compromised?

Yes. At the VPN endpoint (i.e. your server) the protection offered by VPN ends. If an attacker has compromised the server he is able to sniff and even modify any traffic flowing through the VPN.

How hard is to compromise that server in first place?

The depends how secure you setup the system. If done right compromise is hard, if done badly compromise is easy.

If compromised, is the encrypted data between server-client at risk?

Yes, the attacker can read and modify all data. He can also add a backdoor to the encryption of the VPN so that even if the attacker looses access to the VPN server itself he can still decrypt any sniffed data.

How can I secure a domestic server? (basic setup)

This question is too broad. But in short: reduce attack surface by using a minimal and secure system, start only the essential services and protect these properly. And keep the system up to date.

Improve this answer
4
  • Thank you! Do I need to have any particular network/firewall rules set up, or should I be ok if I follow some tutorial on creating an raspberry based server? And do I get any extra protection if I connect my raspberry server to some free VPN provider?
    – user122024
    Aug 21, 2016 at 17:55
  • @user122024: if you increase (or even decrease) security by adding another VPN provider depends on your security requirements, i.e. which path of the connection you want to protect and which parties you don't trust. But ask yourself how this "free VPN" provider makes money. As for the firewall - block everything which is not needed and what is needed depends on your setup.
    – Steffen Ullrich
    Aug 21, 2016 at 18:36
  • I see your point. Agreed. Last one, hopefully: would you prefer a raspberry "home made" server or would you trust more a cloud server (e.g. digitalOcean)?
    – user122024
    Aug 21, 2016 at 18:39
  • @user122024: the position of the VPN endpoint depends on what you want to protect. If you just want to protect the connection from some external untrusted hotspot to your home then I would go with the rasperry because you have this one full under your control - contrary to some VPS in the cloud.
    – Steffen Ullrich
    Aug 21, 2016 at 18:51
0

Steffens Answer is pretty good but I want to get more in the detail in the part of:

How hard is to compromise that server in first place?

How can I secure a domestic server? (basic setup)

As Steffen mentioned it really dependes on your System but given your question you´re Pi is probably not really configured safely

Of course we can believe you already changed the default Credentials of your PI. Now First of all you should install OFW, an easy to use tool for making iptables-Firewall rules. Block everything except the ports you REALLY need.

Then you should install some IDS/IPS/AV Tools like rkhunter/chkrootkit/ossec. Another neat tool is fail2ban which bans IPs via iptable-rules automaticly after serveral failed login attempts etc.

All of above said tools should use exim4 mail so that threat reports etc. get sent to you via email.

Also you definitely should deactivate password auth for SSH if it´s reachable from the Internet (not blocked by IPtables) and switch to certificate based authentication.

With this setup, a little bit of reading in google and common sense, your Pi should be considered "pretty safe" as "totally safe" just never happens :)

Tutorials on how to setup/configure said tool are widespread if you just search on google

EDIT: Since Raspian is just a Debian-Derivat, most Google Tutrorials on things like "how to setup a secure Debian server" are pretty much straight forward portable to the Pi

Improve this answer
5
  • What ports would I really need? I know very little about iptables and firewall rules in general.
    – user122024
    Aug 21, 2016 at 20:24
  • @user122024: This is too wide a question :). But to stay practical and positive: learn this before trusting than to set a VPN will bring you any form of security.
    – dan
    Aug 21, 2016 at 22:18
  • Any recommended resources?
    – user122024
    Aug 21, 2016 at 22:22
  • Due to my ranking I cannot post enough links, just google the applications I posted i.e "how to setup ofw", "what is iptables", etc. Once you read a bit about those things it´s actually not that hard to understand
    – architekt
    Aug 21, 2016 at 22:29
  • @user122024: Regarding the Ports you´ll need: I personally tend to block all incoming Traffic. In your case the only incoming port that should be open is your OvPN port. Regarding Outgoing ports it depends on your security needs and paranoia level
    – architekt
    Aug 21, 2016 at 22:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .