3

I am planning to make public a website I have been working on; it seems to me that (in my very limited experience) the only way I can do this without needing to pay any extra money to external hosts etc. is by hosting the server from my computer at home.

Of course, I am extremely scared of doing this; in the design on my site I have followed every security guideline I know of, but I'm scared attackers will still be able to get at other devices on my local network or access to my own personal computer (from which I intend to host the server.)

I've noticed though that my ip is already exposed to the internet: if I visit my public IP address in the browser, my home router's page pops up, which also worries me – EDIT: actually this only happens for devices already connected to my local network, a remote device seems to be unable to access my router's configuration page this way.


I have run nmap on my public ip, without my server running, as I'd imagine it would be one of the first steps an attacker would take:

Nmap scan report for ***********************
Host is up (0.0023s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
443/tcp  open  https
5000/tcp open  upnp
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 40.89 seconds

Are any of these services vulnerable? They are all managed by my router, and I haven't set any of them up.


Here are the nmap results from an external source:

Starting Nmap 6.00 ( http://nmap.org ) at 2016-08-26 15:44 EEST
NSE: Loaded 17 scripts for scanning.
Initiating Ping Scan at 15:44
Scanning **************** [4 ports]
Completed Ping Scan at 15:44, 0.06s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 15:44
Scanning **************** [100 ports]
Completed SYN Stealth Scan at 15:44, 4.25s elapsed (100 total ports)
Initiating Service scan at 15:44
Initiating OS detection (try #1) against ****************
Retrying OS detection (try #2) against ****************
Initiating Traceroute at 15:44
Completed Traceroute at 15:44, 0.04s elapsed
NSE: Script scanning ****************.

[+] Nmap scan report for ****************
Host is up (0.033s latency).
All 100 scanned ports on **************** are filtered

Too many fingerprints match this host to give specific OS details
Network Distance: 9 hops

Basically, I'd like to know what steps I should take to best reduce the chances of an attacker gaining access to my personal computer or other devices on my home network, and if this is indeed an absolutely terrible idea I'd love pointers in a better direction.

  • 2
    "if I visit my public IP address in the browser, my home router's page pops up, which also worries me." some routers do that. Ask a friend to visit your public IP. – Samuel Shifterovich Aug 26 '16 at 12:38
  • @SamuelShifterovich Ok I've now done this, and yes the results are very different (much less frightening) - I am about to update my question. – theonlygusti Aug 26 '16 at 12:58
  • 1
    That is most probably one of the widest and wildest question you might have fired. "Well, everyone, I swim pretty well. I will try to cross the Channel swimming with my personnal bath suit, is it safe?"••this is a return••May I suggest you to choose a more focused question to win some interesting answers? – dan Aug 26 '16 at 13:48
2

Of course, I am extremely scared of doing this; in the design on my site I have followed every security guideline I know of, but I'm scared attackers will still be able to get at other devices on my local network or access to my own personal computer (from which I intend to host the server.)

Well...

in the design on my site I have followed every security guideline I know of,

These guidelines don't mention anything about not having public-facing assets on the same network segment as resources you're concerned about? If you were a shopkeep would you leave your money just sitting in a pile on the same counter you serve customers from?

Personally I'm a strong proponent of not hosting web services from your home connection. Several reasons:

  • 99% chance you are violating the terms of your agreement with your ISP.
  • If you get compromised and your computer is used to serve spam, your ISP may cut off your internet access altogether.
  • If you get compromised and your computer is used to serve Very Bad Things, you're going to have FBI agents serving search warrants to your home and confiscating all your personal gear.
  • You violate what little security and privacy you have on your home LAN by opening up an exploitable public-facing entrypoint.

All of these things could be avoided with a $5/10-a-month webhost.

  • No EULA violations for hosting a web site (that's what you're paying for!).
  • At worst your host sends you an angry letter and stops hosting your site.
  • The FBI confiscates your host's equipment instead of yours.
  • You get more peace of mind at home.

DigitalOcean is the cheapest I've seen at $5, you can get AWS down to $6-7 a month with a fixed contract, or most other hosts charge $10. Scrape together a wad of cash and buy a disposable credit card if you must.

As a result of not being a cheapskate you will avoid a world of problems.

  • Note: If your cloud server is hacked and used to server "Very Bad Things" you may find your server is shutdown by the FBI contacting your cloud service. This is a very interesting topic in Cyber Security as "where does the file reside" aka "Where is the address for the warrant". Great point though, I never considered being hacked = losing my computer. – FreeSoftwareServers Mar 10 '18 at 13:00
1

You need to run the scan from outside of your network to get a valid result, since routers often have ports open for requests from inside the network but not from the outside.

Before deciding on hosting the website yourself you should also check if your ISP allows it and that you have a static IP-address.

If you configure everything correct and keep the whole stack updated all the time you should be relative safe, but even doing all this companies put their public facing servers in a DMZ to separate it from the inside of the network. So deciding on hosting it yourself depends on how big a target you see yourself as and how much you have to protect.

I did for some school projects have a server running for some days without publishing it any place and got lots of hacking attempts every day. I did also consider hosting some servers myself but ended up deciding to use DigitalOcean and would recommend you to also look for alternatives to hosting it yourself.

  • I don't think the DMZ is as important in a home LAN network vs corporate LAN. – FreeSoftwareServers Mar 10 '18 at 12:03
1

...and if this is indeed an absolutely terrible idea I'd love pointers in a better direction.

I'm sure that it is an absolutely terrible idea (as I wondered about the same thing 10 years ago), especially if you are not extremely familiar with such hosting (even if you were, it would probably still be a bad idea).

Your alternate solution is simple : get a cheap VPS. Yeah you will probably have to pay, but you can get away with 5$/month no problem, supposing you don't want thousands of concurrent users (doing that from home would probably create an upload bandwidth issue anyways). Once you get your VPS (that is only accessible via SSH + certificates), harden it by following "hardening my VPS" guides and you're miles safer than risking to compromise your whole private network.

Also, you will learn lots of great nerdy Unix tricks !

Alternatively you could use a Shared Server but I would not recommand that if you want your server to be secure (shared servers are cheaper or free and showcase less performance but increase the security risks)

  • A shared hosting (not erver, hosting offer) would be far more secure than a VPS, even for a sysadmin knowing what (s)he's doing. A single person will always fail to follow up on security updates on their spare time. (my 2cts) – Tensibai Aug 26 '16 at 13:31
  • 1
    @Tensibai Depends a lot on the provider - lots at the cheap end of the market don't bother patching at all, or have flaws in segregation between users. Moving up to higher levels, shared providers get better for the reasons you've stated, but in the low cost space, at least you know what you're running with a VPS. – Matthew Aug 26 '16 at 13:43
  • @Matthew Most of the VPS run by 'home users' are an ideal target for botnets :p, again that's my 2cts, I've no stats to back that up. – Tensibai Aug 26 '16 at 13:47
  • 1
    @Tensibai If they're set up poorly, yes. But I've never come across a site hosted on a VPS which is itself secure, but has been infected by an attack on another unrelated site - for shared hosting, though, it's common. A poor config is a poor config, whoever sets it up. – Matthew Aug 26 '16 at 13:51
  • @Tensibai your answer is out of context as a "home user" would not use nmap and ask such questions. On top of that, not patching kernel exploits would not necessarily make you vulnerable, since by following a simple guide you would just open 3 ports (ssh, http, https), and only a specific remote code execution exploit in your app or in ssh would leverage a kernel flaw for example. Also, root login would be disabled etc, which is what all guides demand. In that situation you can still patch your server. On the shared server however, there is nothing you can do.OP is a person that – niilzon Aug 26 '16 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.