If I were to create a new instance of lemmy do I set up my own server in my house, or am I just creating an instance on one of the lemmy servers?

  • DandroidEnglish
    3•1 year ago

    How can I tell if my instance is being probed for security issues?

    • @[email protected]English
      5•1 year ago

      There is no need to check. Everything exposed to the internet is being scanned. (The only exception is maybe IPv6 with no specific TLS cert.)

    • scytaleEnglish
      3•1 year ago

      You’ll need to have some kind of monitoring in place. Firewall logs, packet capture (i.e. wireshark), security onion, and a bunch of other security logging/monitoring tools. If you’re hosting on the cloud, your provider may have some free tools you can use (i.e. CASB).

      • DandroidEnglish
        2•1 year ago

        I’m currently hosting on a spare computer that I had lying around that I installed Linux on. So I’ll probably need to do some research and set this up.

        My dad had a web page recently get attacked, and they ended up injecting a program into his server and it started executing itself. He didn’t look into what it was actually running, but I can’t imagine it was doing anything good. Like, if it were just crypto mining, that would be a best case scenario. I’m sure it got in because he never updates anything. He was running his web page on a very, very old version of php, with a very old version of apache2 as the webserver.

        I just want to make sure that I’m aware of if someone is trying to do something similar to me.

        • @[email protected]English
          3•1 year ago

          its the internet, they are. Putting it behind cloudflare and locking down the firewall to only allow their ips has filtered out pretty much everything. its free and pretty straight forward if you own your own domain.

          check your nginx access logs, I’m sure they’re full of people poking it.

          134.122.30.157 - - [22/Jul/2023:07:45:28 -0500] "\x00\x00\x00\xB2\x9A\xD6\x8E\xCF.\x22\x83\xA9\xBF2\xBA|ro\xAE_\x95\xEC\x80\xE4\xE9n\x82q\x9E\xC6\xA9\x8F\xF5" 400 157 "-" "-"

          and all kinds of other obvious incorrect stuff when a normal request looks like

          2001:19f0:5c01:dd3:5400:2ff:feba:75b - - [27/Jul/2023:07:21:25 -0500] "GET /comment/165203 HTTP/2.0" 200 953 "-" "Lemmy/unknown version; +https://lemmy.xcoolgroup.com"

          GET/POST/WHATEVER /url …