If I were to create a new instance of lemmy do I set up my own server in my house, or am I just creating an instance on one of the lemmy servers?
If I were to create a new instance of lemmy do I set up my own server in my house, or am I just creating an instance on one of the lemmy servers?
You’ll need to have some kind of monitoring in place. Firewall logs, packet capture (i.e. wireshark), security onion, and a bunch of other security logging/monitoring tools. If you’re hosting on the cloud, your provider may have some free tools you can use (i.e. CASB).
I’m currently hosting on a spare computer that I had lying around that I installed Linux on. So I’ll probably need to do some research and set this up.
My dad had a web page recently get attacked, and they ended up injecting a program into his server and it started executing itself. He didn’t look into what it was actually running, but I can’t imagine it was doing anything good. Like, if it were just crypto mining, that would be a best case scenario. I’m sure it got in because he never updates anything. He was running his web page on a very, very old version of php, with a very old version of apache2 as the webserver.
I just want to make sure that I’m aware of if someone is trying to do something similar to me.
its the internet, they are. Putting it behind cloudflare and locking down the firewall to only allow their ips has filtered out pretty much everything. its free and pretty straight forward if you own your own domain.
check your nginx access logs, I’m sure they’re full of people poking it.
134.122.30.157 - - [22/Jul/2023:07:45:28 -0500] "\x00\x00\x00\xB2\x9A\xD6\x8E\xCF.\x22\x83\xA9\xBF2\xBA|ro\xAE_\x95\xEC\x80\xE4\xE9n\x82q\x9E\xC6\xA9\x8F\xF5" 400 157 "-" "-"and all kinds of other obvious incorrect stuff when a normal request looks like
2001:19f0:5c01:dd3:5400:2ff:feba:75b - - [27/Jul/2023:07:21:25 -0500] "GET /comment/165203 HTTP/2.0" 200 953 "-" "Lemmy/unknown version; +https://lemmy.xcoolgroup.com"GET/POST/WHATEVER /url …