Up to now I'm using a raspberry pi as a local server for trying out things or hosting my own little projects (beginner level), but I want to make it publicly available (most likely only for people I know, e.g. using self signed certificates).
I know that you can never be 100% secure. All I ask is a fair chance.
I wonder why the opinions on self hosted webservers are that controversial. There are endless amounts of tutorials which claim to set up the server relatively safe, but on the other hand, especially in forums like this (obviously specialized in security), all you read is that it's extremely risky and disadvised.
I followed all of the obvious safety-mechanisms:
- deactivating all unnecessary services
- choosing secure passwords for multiple users (and deleting the default ones)
- running apache on a non-sudo user with almost zero privileges
- using SSH Keys
- adjusting the read/write privileges on all relevant files
- using iptables to block everything except 3 non-default ports for ssh, http and https
- keeping everything up-to-date
- fail2ban
Planned, if I don't discard the whole idea after this post:
- preemtively blocking all IPs not from my country
- using a separate wireless network, like a guestnetwork, for the pi
My questions boil down to:
What else would you recommend to secure the server?
and (disregarding DoS,evading access-control and using the compromised pi for illegal activity)
How would an attack look like, especially on the other devices in the local network if the only differences are the forwarded ports for http and https to the pi?
