How to protect Linux from Hackers // My server security strategy!

[@CRK1918]

Another of the most important thing is network security, and your home network design. Using pfSense at network level. You talked about some of the DMZ setup. Using VLAN to separate networks, home networks, IoT networks, server network and so on.

[@hjsop1]

Thanks for bringing this topic up! This is what I needed so much.

[@christianlempa]

Sure! Glad it helped you 😁

[@unknowntechio]

One of the best posts on security, open source server security i've watched. Simply great!

[@g-net7646]

Another great video thanks! It would be great if you could go into more detail on how to address the firewall security issue using UFW of the docker containers and how you address them for cloud hosted servers.

[@christianlempa]

Thanks mate! Yeah I thought about making a more in-depth video about UFW and IPTables, I'll put that on the backlog list ;)

[@Asdasdas1337]

If im not wrong docker doesnt play nice with UFW and tends to write its own rules in a way which supersedes ufw rules. I switched to firewalld because of this and I highly recommend it.

[@LtdJorge]

@@Asdasdas1337 yep, UFW writes iptables rules, and docker too. That's why they have conflicts.

[@mithubopensourcelab482]

Great video. What we do for security ? The best way is to install every server as a vm on a separate isolated vlan, apply all your suggestions. Hopefully nothing will infect your server, and even if it does, the infection will remain isolated and easily taken care of using snapshots or backups. We have applied this strategy and so far, so good, we are in safe heavens since 2 years. Not to forget, your virtualiser needs to be well protected as well.

[@christianlempa]

Thanks mate! Great ideas

[@minscj]

Please can you tell me how to do this for my servers

[@carloslaguera8025]

@@minscj Unfortunately, this is all a bit more complicated and inconvenient. On my Proxmox host I have looped each VM through to the firewall with its own vlan. All have their own IP range and are secured with all firewall rules to each other. So to say I have an independent DMZ for each VM. Any communication between the VMs has to go through the firewall by force and is allowed with filigree rules. As I said. Everything a „bit“ more complicated :)

[@nichdiekuh]

This video is super interesting. Especially the part about Docker and iptables couldn't be stated enough. However I think that you could have also mentioned how to prevent docker from opening ports, that seem to be closed in the UFW rules. I had this issue a couple of days ago with a production system which unfortuantely wasn't protected by an external firewall. I was able to fix this in a couple of minutes, but for the novice admins, who are probably the target audience of this video, it certainly isn't that trivial to fix. btw: I only discovered your channel a few days ago and even for me as a professional linux admin, it's interesting content. I'm looking forward to seeing more from you 🙂

[@Pharaon2502]

Any more info how you have done this?

[@mrmotomoto]

Thanks for the quality content! You're such a wealth of information and we appreciate you sharing it

[@christianlempa]

Thank you so much! :)

[@wildflowers465]

Great video! Running ss or netstat as root (with sudo) will show the PID/Program name in the final column, which is helpful if you don't already know what ports services commonly use, for well known ports or registered ports, as well as for ephemeral ports

[@christianlempa]

Thanks for sharing! :)

[@NickBouwhuis]

In 2021, I would recommend creating a Ed25519 key instead of a RSA key. Ed25519 offers stronger encryption and shorter keys. Only downside is that it is incompatible with older systems (older then say, 5 or 6 years?)

[@christianlempa]

Yeah it's a good idea, the incompatiblity is the the major reason why I still don't include it, when RSA 4096 should be still fine. Second reason is I can't remember that stupid number 25519... who choose this name?!

[@coolcax99]

@@christianlempa Its the prime number field used in the eliptical curve. 2^255 - 19.

[@danilodistefanis5990]

Karthik Sriram oh, that makes it way easier.

[@comic-typ5919]

@@danilodistefanis5990 xD

[@l_shaun_bunds_l]

thanks for the information. the elliptical curve of erectile dysfunction is nothing to sublimate your libidinal acronyms by! That it is stupid is an easieer way to feel...

[@SimarMannSingh]

I honestly want to see your channel grow exponentially... May you get a few million subscribers real soon. Just keep maintaining your video's quality and pace...

[@christianlempa]

Thank you so much :)

[@Berkto00]

Subject: How to protect Linux from Hackers // My server security strategy! Rule1: don't tell hackers about your server security strategy Just joking :D great content Christian, keep on going! Regards from Czechia :)

[@cookasaurus_rex]

I think you're awesome, man. Keep on keeping on!

[@christianlempa]

Thank you mate!

[@HosselBossel]

Thanks!

[@christianlempa]

Thank you so much bro for your support ❤️

[@BlackBot1986]

Great summary! Just something to mention here, to add a user to the docker group is considered as security risk. Somebody who has claimed the user rights but not the pw could just run anything on the server... For a dev environment that is imho absolutely fine but please not for the prod system😉

[@christianlempa]

Thank you :) Thanks for sharing, that's a good tip

[@JoseFerreira-xm3zy]

Once again, another great video. Thank you for your service ! :)

[@christianlempa]

Thank you so much :)

[@alfredoramos1450]

I hit the "subscribe" button and clicked "all" on the bell 🔔 great video sir!

[@christianlempa]

Thank you 🥰

[@andrewgraham6994]

broski explains things perfectly.. RESPECT AND LUV

[@christianlempa]

thx lol :D

[@LawrenceSingha]

Hi from London, I have subscribed and new to your channel. Thank you so much for tips and what I needed so much & very useful.

[@christianlempa]

Awesome! Thank you!

[@cybersecurehacks]

Excellent Videos mate.... And thank you for sharing stuff like this..

[@christianlempa]

Thank you so much :)

[@wamiedabdel-rahman5389]

Nice and very useful video as usual. I liked your command prompt. How can I implement it on my Ubuntu system?

[@popquizzz]

I found your channel today and I am thrilled that you are so willing to share such pertinent information. One request I do have to ask is if you would just reduce your background music a bit. This should be a nuance addition to any video especially one's like yours with so much good info shared. The music is a bit too much at times and the mundane aspect of it distracts from your lessons and not in a good way. We want to hear what you have to say, not fight the music to hear you. Thanks Christian!

[@christianlempa]

Thanks mate! Awesome feedback :) Well, I need to admit that in this video the background music is louder than usual, don't know what was going on :D But you're right! I'll reduce it in next videos even more.

[@miraldoramos]

Hi, you can use Ssh-copy-id for copying SSH keys to servers. nice video, thx

[@christianlempa]

Thanks mate! Yeah I'm still so used to the old way :D

[@moeinmhzg7827]

Awsome and on point as always Thank you

[@christianlempa]

Thank you :)

[@michelangelop3923]

For 2FA in the shell I use DUO Security, with a free account you can do pretty much everything, I employ the least privilege access so I have a non sudo account for docker management and access with a pub key, for sudo I login with su to a local admin account, and for the actual sudo to execute a duo push is needed.

[@Reiner030]

looks also interesting like Teleport does. But why relying on external services which can have connection/service problems while you need to login (independent they costs if not community edition is used) when you can do it with "Yubikey and SSH via PAM" by installing and configuring a package yourself and having only a Yubikey, Nitrokey or similar key buyed once for each user? Maybe only interesting solution could be to protect a suite of hard- and software by same 2FA service.

[@gregm.6945]

great video, thanks !.....don't forget, you could've used _ssh-copy-id_ @ 11:08

[@christianlempa]

Thanks! Oh yeah, I'm still so used to the old way 🙈

[@kuhluhOG]

5:55 I run my containers via podman in systemd units and create the descriptions via quadlet. That way I can just regularly let the system call "podman auto-update" and I am done (it also rolls it back in case the update doesn't work, but it relies on support from the containers here which may not necessarily be available).

[@ivandrofly]

16:23 - ss -ltpn command to list all app on network ports 19:50 - docker issue with ufw

[@Musician_Robert]

Great video Christian

[@burstfireno1617]

Good video. dunno if its only me thinking the music in the background is a bit loud

[@HoshPak]

Another good addition to reducing the attack surface is using non-standard ports i.e. anything above port 2048. Most scripts only poke around those ports and skip the rest as it significantly increases scanning time. A practical way of doing that is running a honey pot on port 22 while moving your actual SSH service somewhere else.

[@christianlempa]

Yeah you can think about that. I didn't include it as I generally avoid to expose this port directly, but still a good option to get rid of annoying logs ;)

[@---GOD---]

It takes half a second to scan all of your ports. Maybe you'll stop a few basic script kiddies who only target known ports like 22... but this literally does almost nothing to protect you.

[@vahidmoradi9696]

man this video was great and informative, I do have one small suggestion though. Pleeeeaaase remove the background music on these kind of videos! These are tech videos, they require concentration ...

[@christianlempa]

Thank you man! I like background music in my videos, but I agree it's way too loud here 🙈

[@vahidmoradi9696]

@@christianlempa I dunno, i looked at the comments, and apparently i am the only one bothered with it :)))) so, i guess my vote does not vount. but i really do believe that tech videos and tutorials should not have background music. nonetheless, thank you for the great content.

[@esra_erimez]

Security is a journey, not a destination

[@christianlempa]

💯 agreed

[@wanessasilva4541]

I learned so much on a single command line! 7:21

[@christianlempa]

Awesome! 😀

[@knightride9635]

Great video, I will have to watch it at least 10 times to implement all this.

[@christianlempa]

Thanks mate 😁

[@sbrodriguez1980]

very very very good and interesting video. Congrats!!!

[@christianlempa]

Thanks bro 💯

[@kcyeohmy]

Yes. Some security feature will be always better than none. Of course not all secure server are unhackable but to at least leave less port open. Use longer time to get stolen or own. Similar to your car if you don't have car alarm or steering lock. Car theft can happen within 1 to 5 minutes but if you have the security wheel lock gear lock brake lock will at least waste some of the car theft time. Even pentagon or military still get hack this is most secure but still got hacked. Good share. Thank you.

[@christianlempa]

💯 agree!

[@BrandonCallifornia]

Hey Christian! Why don’t ya use ssh-copy-id -I keyfile hostnamelikeinssh???

[@christianlempa]

Good question, I guess I'm still used to the old way :D

[@SvenTimmermann]

Good video. But take a look at ed255... Ssh keys :)

[@christianlempa]

Yeah, maybe if I remember next time :P

[@manaberry]

Hi! How should I use the DMZ? I have 2 server. One host all my services in docker (nginx proxy manager, website, cloud services, apps, etc...) and I have a Raspberry with Adguard (and my TLS DNS) and a plex server. Should I move plex to the big one, and nginx to the small one and make the raspberry as dmz landzone to manage all traffic? Would it isolate the main server correctly? Thanks for helping!

[@jojohnes5863]

Hallo Christian, tolle Videos! Du hast ja viele Videos zu Docker etc. Den Aspekt, dass Docker Container die Firewall aber umgehen, reißt Du aber nur hier kurz an. Ich denke das ist sehr wichtig. Viele installieren jetzt fleißig Docker Container und wiegen sich in Sicherheit, die so gar nciht gegeben ist. Kannst Du nicht mal ein Video dazu machen, wie man auch Docker mit der Firewall sicher absichern kann?

[@christianlempa]

Hey danke für dein feedback! Ich werde wahrscheinlich kein eigenes video dazu machen, weil ich im Prinzip alles wichtige gesagt habe. Allerdings glaube ich dass ich es öfter in meinen Videos sagen muss, wenn auch immer es um firewalls und linux Sicherheit geht. Vielen Dank!

[@jojohnes5863]

@@christianlempa Danke für die Antwort. Ich glaube allerdings nicht, dass Otto Normal user "ich schau das youtube video und schmeiß mir die Docker Container drauf" damit damit docker sicher absichern kann. Viele führen nur die Schritte im Video aus, und die reichen nicht..,.. Wenn kein eigenes Video, dann vll in Deine Anleitungen zu Docker im Blog, oder in den Artiel zum wireguard mit docker. Versteht mich nicht falsch, die Videos sind klasse, aber wenn Du zb Docker ausführlich vorstellst, solltest Du auch sagen, wie man es absichert. Sonst rennen die Leute ins Verderben:)

[@rscmcl]

I added 2FA to my home ssh server when I want to log from somewhere else, works amazing... uses the key and fallback to password/2FA

[@christianlempa]

Very nice!

[@GrindAlchemyTech]

Thank you

[@christianlempa]

You’re welcome

[@kjakobsen]

Docker is a rabbithole, but such an interesting one. :)

[@christianlempa]

It really is!

[@manjunathreddy5966]

Wow. The quality.

[@ahmadmobaraki7371]

you are awesome man!! thank you.

[@christianlempa]

You, too! Thanks ❤

[@Taragurung]

Recently following you, great content. what have you used for the terminal, looks different?

[@christianlempa]

Thanks mate! I recently made a video about my development setup, how that is what you're searching for: kzbin.info/www/bejne/pXeZmH-vnbZ3mtk

[@anarchoN3rd]

For any other noob who got lost when they got to the intro to the 'ss' command, you need to use sudo to display the process IDs (what the p flag in -ltnp displays)

[@christianlempa]

thanks mate! Yeah I was a bit confused until realizing it in the editing :D

[@anarchoN3rd]

@@christianlempa no problem. As someone who's only knowledge of ports is that 22 is for ssh, having those descriptors was very helpful. I even tried removing the -n tag, but it seems like ss has some trouble resolving those names.

[@andreydoichinov1683]

Hi Chris, at 8:24 you forgot to tell us what is the string you used.

[@christianlempa]

hoho

[@Becoming-Human]

Future video series idea... assessing the security benefits of NixOS and Guix OS as they compare to {insert mainstream Linux OS here}. To be fair, though, please note the considerable learning curves associated with each of the aforementioned OS'es... you have been warned. :-)

[@christianlempa]

Well, I haven't looked at these distros, yet.

[@itasev]

Hi Christian, I cant find a decent how to setup a XMPP server on AWS or Hetzner from scratch. In the era of self-relying on privacy you might find it interesting to make such a video or post on your website. Cheers!

[@christianlempa]

Well that would be far down my priority list, to be honest :/

[@themadtux]

Great Video! Curious what shell prompt are you using in your SSH tutorial? Really like that look...

[@christianlempa]

Thanks mate! I'm now using a new prompt which is called starship, you can take a look here: kzbin.info/www/bejne/d3yVe3hojth-qtE

[@bryanmontgomery610]

For the SSH key gen part, are you creating the key on a separate Linux server? Looks like he is using WSL on a windows machine. So this would need to be the dedicated place the SSH keys? This was not explained well os just looking for clarification.

[@salim444]

5:26 there is a command that copy your ssh keys conveniently called ssh-copy-id

[@Whylde-Tech]

Thank you Christian.

[@christianlempa]

You're welcome

[@scottamolinari]

Something else you can do is move the ssh port. Port 22 is well known and thus hackers hit it all the time basically automatically. You can move ssh traffic to a different port and close 22. It's only security via obscurity I know, but it avoids those automated hacking attempts.

[@E57det7I]

Yeah, this didn't used to really do much. But I can see this actually becoming more and more helpful the more and more automated bots just hit 22

[@leopard3131]

Another suggestion is to learn iptables. It takes a minute but iptables will do everything you are doing with multiple servers such as fail2ban and VPN. Iptables will also do your routing if you are not running a custom router already.

[@ultravioletiris6241]

You can get a VPN-like effect from using iptables? How ?

[@leopard3131]

@@ultravioletiris6241 What is a "VPN" effect? I believe I can certainly replace fail2ban with iptables rules as well as what he is doing in his use case of VPN.

[@ultravioletiris6241]

@@leopard3131 You said that iptables can do everything he is doing with a VPN. Did you literally mean everything, including the VPN tunnel itself? Or did you mean that only some things can be replicated by iptables?

[@leopard3131]

@ultraviolet iris What is "everything " ? What are you wanting to do with a VPN? Hide your ip? Adblock? But yes, you can restrict traffic with iptables.

[@leopard3131]

@ultraviolet iris I guess when I watched this video and commented yes I felt the tools I mentioned including iptables would accomplish the same goal as the use of VPN although obviously it is a different tool. I am not going to rewatch the video to answer your vague questions but if you have a specific question and the answer is brief I am willing to clarify.

[@kjakobsen]

First step is to protect the server against compromise. Next step is to have a reliable backup and disaster recovery plan in place,, for when it eventually happens despite everything you did right. ;)

[@christianlempa]

Absolutely! Great points :)

[@ctheroux]

Hi, thanks for the video. Very good. Btw, what model of keyboard you are using? Regards

[@christianlempa]

You're welcome, thanks! Currently the logitect G413 ;)

[@inlophe]

Any reason for still using RSA for SSH key on modern server?

[@christianlempa]

What would you suggest?

[@inlophe]

@@christianlempa Using ed25519 if your server update is not older than 5 years old. Sure, RSA 4096 is still good, but it's slow compared to elliptic curves. There is an option to use ed25519 in ssh-keygen, so you don't need to configure anything

[@christianlempa]

@@inlophe last time I checked it wasn't supported on all devices, that’s why I still haven't used it. It might become relevant at some point, but I guess that would be worth a separate video in an unknown future 😊

[@johnnytank979]

Great video! I think you could speak a little bit slower, I feel slightly rushed when I try to comprehend what you are executing exactly. ;)

[@christianlempa]

Thanks' :D Yeah, I try to slow it down a little bit. But it's hard to find that perfect balance that everybody enjoys. Most stuff on YT is fast, otherwise people are just leaving :/

[@typingcat]

What the, so SSH doesn't block that tries too make wrong passwords out-of-the-box and I have install a third-party utility?

[@GorkemYildirim]

Great video, Thanks a lot.

[@christianlempa]

Thanks!

[@nolmirk2267]

you the man, thank you.

[@raughboy188]

There are few other things you should add to your strategy of protectiong your servers and network in general. First and foremost youn need to learn OSI layers of network and set up your security on each of the layers. I did mentioned layers didn't I? that's actualy second thing, set up your security as layers because it will help you keep track of attacker as he moves across layers to egt to destination. More layers of protection you have better it is for you because you can catch attacker sooner and respond faster, it will help you with revealing possible vunerabilty because you can see at which layer it happened. most of the time you'll connect to everything within your network for maintenance via ssh right? Yeah in that case change port you're gonna be using for ssh in your network because using default port for it is agains best practices. Now onto vlans. Fragment you network with vlans how ever one of the vlans should be designated as native vlan where everything untagged goes but that can't and shouldn't be vlan 0, also if you have unused prort assign them to unused vlan as security measure, doing what i said with vlans prevents attacker from using vlan hoping attack to get to your data. There are many more attacks but if i keep writing my comment will get too long so i will mention one that can result with DOS across your network and it's dhcp exaustion which happens as a result of dhcp receiving bunch of fake requests for ip to the point where dhcp server runs out of ip's and without ip devices cannot connect to network. There's a lot more you can do.

[@christianlempa]

There’s always something more you can do, but in the end all of these strategies provide a strong foundation to cover 99% of the attacks you’re facing as a homelab dude :)

[@raughboy188]

@@christianlempa what i said about ssh,vlan and dhcp exhaustion comes from best practices recommended ny cisco systems.

[@ronm6585]

Thank you.

[@christianlempa]

You're welcome!

[@VulcanOnWheels]

18:48 I thought that enabling a service would only make it active after the next startup of your computer and that you have to add --now to make it work immediately. 28:12 You speak so fluently(!), but the way you say "determine"...?

[@hx4791]

need a video on geo blocking

[@mebeingme947]

As always good video again. Just a little adder....change the port number for ssh from 22 into a non-standard like 24 e.g.. In many cases port 22 is looked for by server hackers. Another thing to check is on your IPS side. Which ports are visible by using a tool like shieldsup! This way you can also determine whether you still have port forwardings open which are no longer needed. If you need portforwardings, where possible use non-linear forwards....e.g. port 65 to port 22...this confuses exploids in many cases. Unfortunately the last one is not always possible. Personally I closed off all ports except for wireguard....second level on the server configured by ufw and 3rd level by fail2ban. I'm not running a webserver other than to accomodate nextcloud instance. I'm fine by doing that over wireguard first to connect.

[@christianlempa]

Thanks mate! Great additions ;)

[@patricknelson]

FWIW, if you just use key-based login and disable user/pass logins, you’re fine. It’s ok for you to change whatever port you want, but for people reading this that think it adds security, it doesn’t (really). It just reduces the likelihood that an automated bot might find your server, but an automated bot isn’t going to brute force your server if there are *zero* possible combinations that could ever possibly work anyway.

[@fbifido2]

@26:48 - how do you make fail2ban work on all running service or all open ports ? @26:58 - what will it show if you removed the sshd

[@SamSam-ic7qm]

Can I have opinions on some of strategy I use: 1. SSH Access only by key, no password 2. Use fail2ban, block 24 hours on 1st bad attempt 3. Optional (Only allow ssh from specific IP) Thanks

[@christianlempa]

Sounds like a good solution!

[@mattplaygamez]

Tailscale has also added tailscale ssh it Also is like An acces Proxy

[@shuangliu2204]

what time do you do a live streaming ? here from china, has a different timezone

[@christianlempa]

Hey bro, Usually Thursday 5pm CET, but recently I wasn't live a lot, unfortunately :( Btw, you see the scheduled ones in the subscription feed as well!

[@abstractumx]

how can i set the terminal with your same graphic theme. seems very cool!

[@masoudamiri7941]

hello sir , can you please make a video about installing windows server on digital ocean vps ?

[@christianlempa]

Hm that's probably not what I'm focussing on right now, I'm sorry.

[@str0g]

could you do a yubi key authentication integration on linux?

[@swipekonme]

is there something called very very excellent video

[@christianlempa]

Thanks mate!

[@sysdrum]

Great stuff

[@christianlempa]

thanks :)

[@Voigt_Analytics]

Is there any web-based control panel for all of these mentioned security rules and concepts? I've heard, Portainer is able to some security tasks. But not all of my services are docker based containers. I need an overview, better than ss -ltpn

[@christianlempa]

I'm not aware of any UI for this, sorry

[@jwbonnett]

Can I ask why you are using "scp" to copy the key rather than "ssh-copy-id"?

[@christianlempa]

I'm still used to it ;)

[@Watsitsname08]

Hi Christian, this video really helped me in my research prior to deploying my first home server. I do, however, have a few questions about securing my server and my data. Assuming I am running ubuntu: what would be the best way to share folders across my home network (to other Windows devices) and ensure that I'm protected from attacks outside my server. I will have a total of 3 users accessing these shared folders, including myself. Any help here would be greatly appreciated, or if you can provide a resource that would be helpful too. Thanks.

[@christianlempa]

Depends a lot on how you're securing your home network and who has access. I personally would not let anything unauthorized and unencrypted into my home network, I can just recommend use a firewall solution, VPNs or Access Proxies. From inside the network it's a bit more difficult, there it might be a good idea to isolate the server in a separate network (DMZ), I'm doing this right now in my Homelab, check out in the next 2 weeks there is a firewall video coming out, that will explain this.

[@Watsitsname08]

@@christianlempa Awesome. Thanks for the response. There is still so much to learn about this and I'm loving it. All of your videos are so helpful.

[@marcello4258]

thanks again christian. perhaps if you allow I'd like to add that limit instead of allow might be better on port 22 otherwise no one is held back from brut forcing although it might be hard anyway since you permit keys only but it is not reply more work

[@christianlempa]

good suggestions! thanks ;)

[@hpsfresh]

ssh-copy-id, not scp. it will create remote files and permissions

[@KratomSyndicate]

what do you think about ufw-docker?

[@pj6206]

Is there any git repository for this tutorial? 🙂

[@marcus3d]

The 5 second loop supposed to mimic "background music" is insufferably annoying

[@transflux-us]

I don't undertand the the docker chain, Port 9000 Problem. Why does ufw allow 9000?

[@christianlempa]

That’s coming from the container engine

[@transflux-us]

@@christianlempa yeah, but ufw shouldn't care where it's coming from...

[@JohnyDev]

Can you please share what you have in the ".bashrc" PS1 how you have the ubuntu logo and the directory upwards the terminal text, thank you

[@christianlempa]

It's in my dotfiles on github

[@JohnyDev]

@@christianlempa Thank you so much 😊

[@HahaHihi11111]

You are One Punch man with 1 hit K.O.? :O

[@UnixDaemonKiller]

Do you set up TPM for Linux?

[@stephaneislistening6103]

What if we loose the SSH keys file ? We cannot log in any longer if we had disabled password login ?

[@Exotelis-skydive]

Just use ssh-copy-id to copy your ssh key. Maybe someone else mentioned this already :)

[@tonydaytrades]

How can I organize what needs to be updated like an apk file. Where should I save it to auto update?

[@michaelgoehringer]

Hi, did my previous question get deleted? Wanted to know if it works to install fail2ban via ecex console direcly in the container of bitwarden and nextcloud to protect them from brude force attacks or doesn't it work this way? But what would be the alternative?

[@christianlempa]

Don't know why YT sometimes deletes comments.. well you can configure fail2ban to look at the logfiles from the containers. Usually docker stores the logfiles in the /var/lib/docker/containers//.json.log file.

[@michaelgoehringer]

@The Digital Life I meant something else. Where do I have to install fail2ban so that I can protect Bitwarden and nextcloud (in containers and in the public network via NGINX Proxy Manager) against brute force attacks. Directly on my raspberry pi? In the respective containers etc.?

[@peterlemmington6585]

Heftiger Typ!

[@typingcat]

What do the seemingly random numbers at the beginning of the files mean? I saw similar numbers in polkit configuration files.

[@Halomaster4ever]

When dealing with newer programs that have multiple configuration files, you can use the numbers at the beginning to determine in which order they're read. One common example is the messages you get when you log into modern Ubuntu servers. It gives you information about your server, but actually they're made up of different scripts ran from a specified folder. You can then insert your own scripts before/after the existing scripts depending on the number you set the file to. Lowest number wins in this case. I'm not 100% sure, but in theory you probably don't NEED to use numbers, it's just a human way of ordering things.

[@ricerob]

How do you lock down the back door built into system d

[@BobDschingisKhan]

tell more about it. 🙂🙃

[@Dahlah.FightMe]

Nice SIr :D

[@HonoraryBreathTaker]

Is it possible to make a ssh connection available only when VPN is connected to the server?

[@christianlempa]

Yeah, in that case you'd need to change the listening IP address of the SSH server to the internal network, or you could enable the UFW and only allow traffic from the internal network.

[@HonoraryBreathTaker]

@@christianlempa Thank you

[@Mauricio.Herrera]

Hi, which terminal client are you using?

[@christianlempa]

I'm using Windows Terminal

[@michalroesler]

He says that Docker Containers are mutable or immutable ??? Because I can't clearly hear the man.

[@christianlempa]

it was wrong anyway, so just ignore this sentence :D

[@davidrichard1811]

Vielen Dank Christian Grüsse von Arizona

[@christianlempa]

Hey! Vielen Dank und Grüße zurück :D