Do you want to prevent brute forcing or do you want to prevent the attack getting in?

If you want to prevent brute forcing then software like fail2ban helps a little, but this is only a IP based block, so with IPv6 this is not really helpfull against a real attack, since rotating IP addresses is trivial. But still can slow down the attacker. Also limiting the amount of sessions and auth tries does significantly slow down the attacker.

If you just want to not worry about it set strong passwords, and when it is a multi user system where other ppl might access it, configure Public Key Auth so you can be sure the other users have strong passwords (or keys in this case) to authenticate.

With strong passwords or keys it is basically impossible to brute force your way in with ssh.

You do not even need a port based firewall when the server is open on the internet.

When you configure the software to not have unnecessary open ports over the internet connected interface then a port based firewall is providing zero additional security.

A port based firewall has the benefit that you can lock everything down to the few ports you actually need, and do not have to worry about misconfigured software.

For example, something like docker circumvents ufw anyway. And i know ppl that had open ports even tho they had ufw running.

I can see where they are comming from, but i do not understand it. Remote streaming was free and is now only available via a subscription or the lifetime pass. So it is locked behind a subscription. Ofc it is more nuanced, but the title expresses really cleanly what the topic is.

Clickbait (also known as link bait or linkbait) is a text or a thumbnail link that is designed to attract attention and to entice users to follow (“click”) that link and view, read, stream or listen to the linked piece of online content, being typically deceptive, sensationalized, or otherwise misleading.

https://en.wikipedia.org/wiki/Clickbait

Title is not really deceptive or misleading.

That is not really covering the topic for everyone, this only covers the article for ppl who are paying already for the pass.

Not seeing how this is clickbait. The title sums it up on point.

At the same time crowdsec heavily benefits of the big free userbase since they ‘crowdsource’ their thread detection.

Just a simple hole renders them useless. The only method to reconstruct them from there would be any kind of SEM or AFM which would still take weeks to months to years depending on the size/density of the drives.

Even just opening them up and smacking the disks would be sufficient

Next time just encrypt them.

Just because there is no update does not mean there are security vulnerabilities to worry about, or do you have a specific one that is not fixed?

The attack vector seems very narrow to me. It checks the container registry downloads the containers and runs some docker commands.

It has no interface, so in order to attack it you either have to compromise the container registry (but then it would be easier to compromise the containers you download) the secure connection used to download the containers (https is quite stable) or something on the server side.

Also the project does not really look that abundant to me.

EDIT: So i have not checked this, but watchtower is probably using docker for most steps anyway? So basically the only thing that could be attacked is via the notifications watchtower is sending?

Years out of date

What problems does it have? Never ran into an issue for my usecase.

Automatic updates. Works like a dream. Depending on what you are running it can obviously cause issues, either server side breaking or server,client communication issues

Most critical infrastructure like my mail i subscribe to the release and blog rss feed. My OSs send me Update notifications via Mail (apticron), those i handle manual. Everything else auto updates daily.

You still need to check if the software you use is still maintained and receives security updates. This is mostly done by choosing popular and community drive options, since those are less likely to get abandoned.

Is adding a URL too much? Jellyfin is also just login in addition to enter the server URL.

You have basically two options.

1. Symmetric Encryption. That means you use the same password/key for writing the Backup and for reading the backup. Here you have to write the password somewhere, depending on the OS there are options like keychains or similar that can hold the password so that the password is only available once you are loged in or have unlocked the keychain.

2. Asymmetric Encryption. That means you have different passwords/keys to read and write the backup. PGP is an example here. Here you can just simply use one key to write the backup, this key can become public and you do not have to worry about your backup since it will only be readable with the 2. key.

I personally use Restic with a password that is only readable by the system root user stored on the filesystem. Since I use Full Disk Encryption i do not have to worry too much about when the secret is available in clear text at runtime.

Yes thats why i said in theory. I doubt that many residential IPs are blacklisted, but still not optimal.

IPv6 only works but there are probably many Mail Servers that are IPv4 only, so you will not receive mails from them.

If you are serious about it, rent a VPS or get a static IP on your residential connection.

It would be more reliable to use a ‘clean’ not blacklisted static IP.

But in theory you could just use ddns and update the IP. But I actually never tried it.

Mailcow comes ready out of the box. Just change the DNS entries according to Mailcow and you are good to go.

This has been said over and over again. I have been hosting Mail now for over 2 years and have yet to encounter any problems. Although, i would not recommend to set it up manually and rather advise to use one of the ‘all in one’ suggested solutions here in the thread.

A project ending as abandonware is always a possibility. One reason projects get abandoned is losing funding, which can be secured by using dual licensing and selling some features to businesses.

That is not my point.

Having a CE or OS version and an Enterprise Version can lead to conflict of interest. Do you add a feature to the OS Version or do you spend time on the Enterprise feature? There are a lot of examples, Emby is one, others are escaping me right now.

There are other models that work well like paid support etc. Nonetheless i will stay away.

Looks amazing. But the dual licensing scares me. The open variant could be artificially limited in functionality or could end up basic abandon ware.

Mailcow is amazing.

Importing exporting i would just use any mailclient and drag-drop them over. Depending on how many Mailboxes you have to transfer.

I am not understanding the issue you have with DNS?

Just have a script that updates the DNS entry to your current public IP. If you do not like Cloudflare there are plenty of other services that offer a free API with their DNS service.

I think you are misunderstanding something here.