this post was submitted on 03 Oct 2025
58 points (98.3% liked)

Selfhosted

51947 readers
1108 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
58
What's the real danger of opening ports? (feddit.it)
submitted 13 hours ago by dontblink@feddit.it to c/selfhosted@lemmy.world
36 comments fedilink hide all child comments
 

Some services run really good behind a reverse proxy on 443, but some others can really become an hassle.. And sometimes just opening other ports would be easier than to try configuring everything to work through 443.

An example that comes to my mind is SSH, yeah you can use SSLH to forward requests coming from 443 to 22, but it's so much easier to just leave 22 open..

Now, for SSH, if you have certificate authentication or a strong password, I think you can feel quite safe, but what about other random ports? What risks I'm exposing my server to if I open some of them when needed for a service? Is the effort of trying to pass everything through 443/80 worth it?

you are viewing a single comment's thread
view the rest of the comments
[–] abs_mess@lemmy.blahaj.zone 4 points 12 hours ago (1 children)

Not a sysadmin, just a casual IT.

If it is open, it is going to get hit by scanners, scrapers, everything and the sun, even if it is secure. Generally, 443 for your websites via reverse proxy with an IP whitelist + password is okay. Not special, lets you add subdomains, very convenient.

Now, there isn't anything special about any given port, but you still need to have some form of access control that you need to set up. If it is an API have some sort of API key in place. Implement 2FA. Try to isolate the service from the machine. Isolate the machine from bare metal. Keep the bare metal machine isolated from your home network. Take up farming. Change the default port and add some form of access alerts/logs. Have some sort of fail2ban service in place because you will be firehosed with scripts and bad traffic.

Maybe some of the stuff I recommend is paranoid overkill, but I don't know enough to cut corners. Security is a hassle, a breach is a nightmare.

[–] possiblylinux127@lemmy.zip 3 points 10 hours ago (1 children)

IP whitelists are not terribly secure and are quite a hassle.

Instead use a overlay VPN or some sort of extra security layer like mTLS or Authelia

[–] 0x0@lemmy.zip 1 points 6 hours ago

Authelia

Seems interesting...