I want to host a server from my home computer; safe?

Question

I am planning to make public a website I have been working on; it seems to me that the only way I can do this without needing to pay any extra money to external hosts etc. is by hosting the server from my computer at home.

I am worried about this. I trust the site itself is robust and secure — not vulnerable to injection attacks etc., but due to the act of simply serving a site via my router will attackers be able to get at other devices on my local network or access to my own personal computer (from which I intend to host the server)?

---

I have run nmap on my public ip, without my server running:

Nmap scan report for mypublicip
Host is up (0.0023s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
443/tcp  open  https
5000/tcp open  upnp
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 40.89 seconds

Are any of these services vulnerable? They are all managed by my router, and I haven't set any of them up.

---

The above results were from a device on my home network, so apparently they reflect ports my router exposes to devices already on its network.

Here are the nmap results from an external source:

Starting Nmap 6.00 ( http://nmap.org ) at 2016-08-26 15:44 EEST
NSE: Loaded 17 scripts for scanning.
Initiating Ping Scan at 15:44
Scanning mypublicip [4 ports]
Completed Ping Scan at 15:44, 0.06s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 15:44
Scanning mypublicip [100 ports]
Completed SYN Stealth Scan at 15:44, 4.25s elapsed (100 total ports)
Initiating Service scan at 15:44
Initiating OS detection (try #1) against mypublicip
Retrying OS detection (try #2) against mypublicip
Initiating Traceroute at 15:44
Completed Traceroute at 15:44, 0.04s elapsed
NSE: Script scanning mypublicip.

[+] Nmap scan report for mypublicip
Host is up (0.033s latency).
All 100 scanned ports on mypublicip are filtered

Too many fingerprints match this host to give specific OS details
Network Distance: 9 hops

---

What steps should I take to best reduce the chances of an attacker gaining access to my personal computer or other devices on my home network?

Answer 1

You need to run the scan from outside of your network to get a valid result, since routers often have ports open for requests from inside the network but not from the outside.

Before deciding on hosting the website yourself you should also check if your ISP allows it and that you have a static IP-address.

If you configure everything correct and keep the whole stack updated all the time you should be relative safe, but even doing all this companies put their public facing servers in a DMZ to separate it from the inside of the network. So deciding on hosting it yourself depends on how big a target you see yourself as and how much you have to protect.

I did for some school projects have a server running for some days without publishing it any place and got lots of hacking attempts every day. I did also consider hosting some servers myself but ended up deciding to use DigitalOcean and would recommend you to also look for alternatives to hosting it yourself.

Answer 2

Of course, I am extremely scared of doing this; in the design on my site I have followed every security guideline I know of, but I'm scared attackers will still be able to get at other devices on my local network or access to my own personal computer (from which I intend to host the server.)

Well...

in the design on my site I have followed every security guideline I know of,

These guidelines don't mention anything about not having public-facing assets on the same network segment as resources you're concerned about? If you were a shopkeep would you leave your money just sitting in a pile on the same counter you serve customers from?

Personally I'm a strong proponent of not hosting web services from your home connection. Several reasons:

• 99% chance you are violating the terms of your agreement with your ISP.
• If you get compromised and your computer is used to serve spam, your ISP may cut off your internet access altogether.
• If you get compromised and your computer is used to serve Very Bad Things, you're going to have FBI agents serving search warrants to your home and confiscating all your personal gear.
• You violate what little security and privacy you have on your home LAN by opening up an exploitable public-facing entrypoint.

All of these things could be avoided with a $5/10-a-month webhost.

• No EULA violations for hosting a web site (that's what you're paying for!).
• At worst your host sends you an angry letter and stops hosting your site.
• The FBI confiscates your host's equipment instead of yours.
• You get more peace of mind at home.

DigitalOcean is the cheapest I've seen at $5, you can get AWS down to $6-7 a month with a fixed contract, or most other hosts charge $10. Scrape together a wad of cash and buy a disposable credit card if you must.

As a result of not being a cheapskate you will avoid a world of problems.

Answer 3

...and if this is indeed an absolutely terrible idea I'd love pointers in a better direction.

I'm sure that it is an absolutely terrible idea (as I wondered about the same thing 10 years ago), especially if you are not extremely familiar with such hosting (even if you were, it would probably still be a bad idea).

Your alternate solution is simple : get a cheap VPS. Yeah you will probably have to pay, but you can get away with 5$/month no problem, supposing you don't want thousands of concurrent users (doing that from home would probably create an upload bandwidth issue anyways). Once you get your VPS (that is only accessible via SSH + certificates), harden it by following "hardening my VPS" guides and you're miles safer than risking to compromise your whole private network.

Also, you will learn lots of great nerdy Unix tricks !

Alternatively you could use a Shared Server but I would not recommand that if you want your server to be secure (shared servers are cheaper or free and showcase less performance but increase the security risks)