Neal Spangler

Work Security & network

This site's home server, reviewed and hardened

I host this site on an Ubuntu server assembled from spare parts. I checked its configuration, fixed the SSH and monitoring setup, and added web-server and DNS protections.

Home server
Home server Photo: TheJosh, public domain
ASSL Labs grade
53,175Suricata rules loaded
8security headers on every HTTPS page

The problem

SSH accepted passwords, fail2ban watched the wrong port and Suricata had no rules. PHP and Apache were still installed, and unknown hostnames or bare-IP requests got the site without security headers. DNS had no DNSSEC, CAA or DMARC policies.

What I did

  • Key-only SSH for a single admin account, reachable only from the home network, with an unused older account locked.
  • Security headers in nginx with a strict content policy, a catch-all that drops unknown hosts and bare-IP requests, per-client rate limits and short timeouts.
  • Fixed fail2ban so it watches the real SSH port and web bot probes, and loaded Suricata's ruleset with a weekly refresh.
  • Removed PHP and Apache, which a static site never needed, and archived the previous site before removing it.
  • DNSSEC, a CAA record limiting which authority can issue certificates, and a DMARC policy against spoofed mail from the domain.
Server and domain protections Configuration overview: the site uses DNSSEC, a CAA certificate policy and a DMARC mail policy. The router forwards web traffic to an Ubuntu host with ufw, fail2ban and Suricata. nginx serves static files over TLS with security headers, rate limits and a catch-all for unknown hosts. SSH is limited to the home network. Internet visitors, bots and scanners DNS DNSSEC · CAA for certificates · DMARC for mail Home router forwards TCP 80 and 443 only Firewall ufw · fail2ban · Suricata IDS · SSH from home only nginx TLS · security headers · rate limits · drops unknown hosts Static site plain files: no PHP, no database
Domain policies, firewall rules and nginx settings for the home server.

What I took from it

A login test showed that SSH still accepted passwords even though the file I had checked said key-only. A cloud-init file loaded first. I corrected the effective configuration and tested the login again.

Software & web

Documented an inherited cluster and added deploy checks

Documented an inherited Kubernetes cluster and added staging defaults, deploy checks and production confirmation.

Home lab & side projects

This website runs on a server built from spares

This portfolio, built from scratch and hosted at home on a server made from spare repair parts.
Privacy