My passwords for OS and all admin dashboards are extremely long, unique, random strings managed by Bitwarden.

If you are paying for Bitwarden, or using their free tier, stop and and start hosting vaultwarden. You can still use the Bitwarden app, with vaultwarden but with all the premium features.

Get a firewall you can either install OpenWRT or opnSense on, when making my decision I went with OpenWRT because opnSense has a webpage that tries to upsell you. vLAN the heck out of your place, and set up a VPN to access your services like vaultwarden out side of your home. On a vLAN that cannot access your WAN or anything else put your IoT things, on a vLAN that cannot access anything else setup crowdsec. On the topic of crowdsec it should be your only device that port 22 is ssh!

For your IoT things set up home assistant, which should be on a different vLAN that can reach out to the WAN and into the IoT vLAN to control stuff. I wish I could say I have completly degoogled and deappled, but I am waiting for a year for my iPhone to stop getting updates and whenever for my iPad to stop getting updates. I should probably replace my homepod minis sooner rather than later with the Naebu things for HA. The only thing I still have a Google account for is youtube but once I get a hand me down Mac mini I will install Debian and get a youtube replacement with sponsor block.

One of the things that finally got me off of cPanel was the host I was using decided to rape me over the coals without letting me have a wildcard email address so I got a business plan that I could have unlimited email addresses so if one got spammy I could just turn it off and if I still used the service I just changed the email, or if I wanted to extend a free trial I could just spin up a new address. So I recently moved to a new host that offers wild card addresses.

Get a whole LAN adblocker, let it be pihole or adguard home, there was recently that spyware ad pixel so expect more of those in the future. Me personally use pihole and have it very finally tuned to block a lot. I tried adguard once but liked pihole better, this was years ago even before I had pihole finaly tuned so don’t ask me why I liked pihole more.

Use authelia for 2fa

Disable root ssh

Disable password authentication for ssh. Keys only.

Set up Fail2ban

That’s about all that’s left; 2fa and brute force protection. Good job.

Timely updates do a lot of the heavy-lifting.

And I hope you picked a better admin dashboard this time or that’s properly locked behind some tunnel. I myself try not to run admin dashboards. SSH with keys is more convenient and secure anyway.

A few tips off the top of my head, in no particular order:

• do not allow public access to any of this. It’s not trivial to set up a wireguard tunnel so that you can reach your home network from e.g. your phone or laptop when you’re away, but it’s also not highly complicated. Usually your home Internet router can already get you half way there.

• if you must have some service available from the public net, it’s better to e.g. host it on a cheap VPS. That way if your things get hacked again (via no fault of your own), your home network is safe.

• set up automatics updates, at least for minor updates. If you’re fine with waiting for a few days in case an update crashes one of your services, it’s a good idea to just make it all auto update. Crash recovery from a backup is a simpler problem then setting up from scratch because your outdated service got hacked and now attackers own your home server, home router, TV, fridge, LEDs and whatever else is Internet capable at your home.

• use 2fa for any service you expose to public internet. Minor inconvenience, mitigates or avoids a whole series of errors.

• document what you’re doing in a simple doc. Can be a simple doc on your next cloud instance, just at a little note/log entry every time you do something. “added robo vacuum cleaner integration to my home assistant. Had to use version 1.2.3 because my robot is an older gen. Password’s on my phone.” helps a lot when something goes wrong later and you forgot what you did.

• test backup recovery. Just delete everything and see if and how you can get it back. If you’re afraid to do that, you don’t have a backup.

• simple monitori

Grab OpenBao (Opensource Hashicorp Vault) and begin using key management. You can do things like app roles, TOTP, single use wrapped tokens, key rotation and more to make sure that long lived access doesn’t exist.

Don’t put it on the internet

Instead, use a VPN solution. I’m also not sure why you setup ClamAV. It doesn’t really do much and is probably a complete waste of time. If anything you should setup and properly configure SElinux but it isn’t trivial to do and is overkill. Simply keeping your stuff of the internet will do far more for your security than anything else.

I’m looking for advice to maximize security.

The most important answers to this all live outside your server. What is your home network like? Do you control the gateway? Do you have a dedicated firewall? Do you have devices segregated into VLANs so they can’t observe each other (especially IoT devices)? Do you have SNMP disabled?

1. Containers are not a security barrier. They cannot be, they never will be.
2. If you are defending against intrusion at your local file server, it is already too late. The call is coming from inside the house.

If you want security, you block all inbound and outbound traffic by default at your network firewall (not the server OS firewall), and then you open only the ports that you actually need, one by one. You set all the closed external ports to do not respond (“stealth” mode), so that anybody trying to reach your network from outside just gets nothing back except on the ports you specifically need to use. You segregate your internal network into logical areas, and you put things that need to talk to each other on their own VLAN, which may or may not have access to the upstream WLAN trunk depending on what they’re doing. You don’t allow crosstalk between VLANs except in very specific cases. You set static IPs and document them, so that you never have to ping or traceroute internally to find something, so you don’t need SNMP. Anybody trying to use SNMP is conducting surveillance on your network and should stick out from other traffic (some “smart”/IoT devices do this automatically - they are bad and should be treated as malicious and should not be allowed to phone home). And then you monitor your traffic at the firewall, and you deal with anything unexpected as it comes up (like once a week review the logs until you have a sense of what normal looks like on different days at various times, then maybe set a few automatic alerts for things that exceed normal-ish boundaries, then go to reviewing like once a month or so - you don’t need to be checking your logs hourly unless you have some reason to be actively paranoid).

If you handle everything correctly at the router/firewall level, you’re way way beyond the security of most residential and small business networks. You’re not, you know, impenetrable, but you’re at the point where somebody with experience and resources will have to be trying to break into your network specifically on purpose. If you’re that kind of target then nothing short of an actual SOC is going to help you, and running self-managed servers on your home network is a bad idea.

Get a FIDO2 security key for SSH keys.

Have you read the TOS of your ISP, are you allowed to run a home server exposed to the internet?

It might be a good idea to at least read what the TOS says just so you are aware of potential consequences.

Removed by mod