I have a Jellyfin server, NextCloud instance, etc that I share with friends and family. Currently, I serve them over the open-internet using Cloudflare tunnels. Obviously this has some security implications that I don’t love. Also recently one of my domains got flagged as malicious by google and now Chrome browsers won’t go to the site - annoying.
I use Tailscale already to access my server infra remotely, but honestly I don’t see this as a viable option for my non-technical friends and family. Plus, I need to support all kinds of devices like smart tvs. How do you fine folks deal with this issue?
Honestly, I would just take this as an indicator of something fishy going on. Either google crawled your ip and found things it didn’t like or stuff came out of it to google. Either a scripted action (which looks malicious from the outside) or advertising emails. Your logs should at least tell you if there have been any suspicious logins on any of the exposed services.
That’s the thing, the only thing I have open to the Internet is a port forwarded SSH with non-root key authentication, into an up-to-date Debian stable. The logs show no attempts. The odds of someone breaking into public key OpenSSH and getting root, with daily security updates, are rather slim IMHO. The router is also an attack surface but it runs up to date OpenWRT.
In any case, my main beef was that relying solely on IP is a pretty shitty way to deal with this on Google’s part. They make you jump through hoops and establish over half a dozen ways of proving who you are (user & password, secret question & answer, secondary emails, OTP codes, secondary auth codes, phone SMS, phone confirmation – which are behind phone unlock) and none of that matters when they don’t like your current IP? Then what are they for?
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
I would entertain the possibility if there was any sign, or if I knew how Google takes these decisions.
Honestly, I would just take this as an indicator of something fishy going on. Either google crawled your ip and found things it didn’t like or stuff came out of it to google. Either a scripted action (which looks malicious from the outside) or advertising emails. Your logs should at least tell you if there have been any suspicious logins on any of the exposed services.
That’s the thing, the only thing I have open to the Internet is a port forwarded SSH with non-root key authentication, into an up-to-date Debian stable. The logs show no attempts. The odds of someone breaking into public key OpenSSH and getting root, with daily security updates, are rather slim IMHO. The router is also an attack surface but it runs up to date OpenWRT.
In this case I‘m out of ideas. :) but thanks for elaborating. I appreciate it.
No problem, you made a good point.
In any case, my main beef was that relying solely on IP is a pretty shitty way to deal with this on Google’s part. They make you jump through hoops and establish over half a dozen ways of proving who you are (user & password, secret question & answer, secondary emails, OTP codes, secondary auth codes, phone SMS, phone confirmation – which are behind phone unlock) and none of that matters when they don’t like your current IP? Then what are they for?
Makes total sense. Good luck figuring it out. :)