Hello fellow lemmings!
As mentioned in the title, I’m barely just getting started with the self hosting thing and such.
I have a small personal project for which I’d like to self host my own “ugly-90’s-HTML” blog (I just love the look and feel you know).
I’ve got a desktop machine that I could use as a server, and I also just purchased my own domain from cloudflare (for commitment), but I’m a bit stuck on the actual “putting-my-stuff-online” thing and I don’t want to do anything stupid.
I know there’s a lot of learning I still need to do, but that’s the reason I’m starting this project. Any help would be welcomed.
I have 3 cents of basic networking knowledge (I made my own Ethernet cable conection to my gateway :D); I’m using a linux distro as my main desktop; I have created an ssh tunnel with cloudflare so far, and I’m following a little html+css tutorial. The thing is, I’ve found so many different ways of putting things online, I’m a bit dizzy. I would like something that will teach me the fundamentals without holding my hand too much (a la “next, next, next, confirm, finish”), you know?
I mean, I’m learning by essentially making a 90’s website… So, yeah.
It sounds like you’re on the right track. As long as you aren’t hosting anything too important, just go for it. The only thing to keep in mind is security, which in your case should be fairly simple.
Use common sense: if you never have to enter a password or have a security key to access something, neither does a hacker. You would be amazed how many people host their openhab instances to the internet with no passwords.
Use ssh keys and disable passwords. Ssh keys are sort of like giant passwords that sit in a file and you never have to type in. It is counter intuitive, but it is more secure. A giant key is harder to guess than a password. You can also encrypt your key so you need the key and a password, this is useful for laptops which could be stolen.
For how to learn simple html and css, w3schools is your friend. You can learn all the random stuff people become extremely opinionated on eventually, but don’t get overwhelmed by all of it and just do what works for you.
Thanks!!
I feel a bit more confident about this project now. To know that I’m on the right track is very validating to me. I will do my best to do my proper research and not go balls to the wall on this one.
I also really appreciate your advice on security, as I think this is the leg from which I limp the most. I’m still very new to all SSH and HTTPS things, so yeah…
I also didn’t quite understand your first point; what does openhab mean? And how is it possible that the people you mention aren’t getting hacked? Is it related to the second point about using ssh keys? I read in another comment that hackers could compromise my home network if I’m not careful enough, so I want to be extra cautious with that. (I hope I’m not lacking in common sense… perhaps it’s my reading comprehension that’s lacking… Yeah, that must be it!)
Openhab is a project like HomeAssistant. Both are basically websites that offer pre made smart home functionaility and can run on your own server. Openhab doesn’t set a password by default (iirc), and when people expose it to the internet they end up with random bored people in another country somewhere flipping their lights on and off or adjusting their thermostat, though they could also get hacked. The openhab example was one of what not to do. I could have been more clear about that.
Security is an issue that people in this community are fairly opinionated on. Try to build up a practical knowledge of every tool you use (like tools for remotely managing your server). Think about how much access that tool gives you, and how easy it is to get. Ssh gets you basically full access to the system, except for bios level settings and things, but it is generally quite secure, and you can use keys instead of passwords. Cockpit, a remote management tool you can access from your browser, offers you a full terminal, so functionally the same access as ssh. However, hackers nearly got a back door into openssh (ssh is the protocol, openssh is the software on linux that implements that protocol), and cockpit is much less thoroughly looked at. Also cockpit doesn’t let you use keys.
Edit: This one is good too. I recommend at least skimming it before the one above this. It will help you figure out which of the points in the link above are worth paying much attention to.
https://owasp.org/www-community/Threat_Modeling
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
It sounds like you’re on the right track. As long as you aren’t hosting anything too important, just go for it. The only thing to keep in mind is security, which in your case should be fairly simple.
For how to learn simple html and css, w3schools is your friend. You can learn all the random stuff people become extremely opinionated on eventually, but don’t get overwhelmed by all of it and just do what works for you.
Thanks!! I feel a bit more confident about this project now. To know that I’m on the right track is very validating to me. I will do my best to do my proper research and not go balls to the wall on this one.
I also really appreciate your advice on security, as I think this is the leg from which I limp the most. I’m still very new to all SSH and HTTPS things, so yeah…
I also didn’t quite understand your first point; what does openhab mean? And how is it possible that the people you mention aren’t getting hacked? Is it related to the second point about using ssh keys? I read in another comment that hackers could compromise my home network if I’m not careful enough, so I want to be extra cautious with that. (I hope I’m not lacking in common sense… perhaps it’s my reading comprehension that’s lacking… Yeah, that must be it!)
Openhab is a project like HomeAssistant. Both are basically websites that offer pre made smart home functionaility and can run on your own server. Openhab doesn’t set a password by default (iirc), and when people expose it to the internet they end up with random bored people in another country somewhere flipping their lights on and off or adjusting their thermostat, though they could also get hacked. The openhab example was one of what not to do. I could have been more clear about that.
Security is an issue that people in this community are fairly opinionated on. Try to build up a practical knowledge of every tool you use (like tools for remotely managing your server). Think about how much access that tool gives you, and how easy it is to get. Ssh gets you basically full access to the system, except for bios level settings and things, but it is generally quite secure, and you can use keys instead of passwords. Cockpit, a remote management tool you can access from your browser, offers you a full terminal, so functionally the same access as ssh. However, hackers nearly got a back door into openssh (ssh is the protocol, openssh is the software on linux that implements that protocol), and cockpit is much less thoroughly looked at. Also cockpit doesn’t let you use keys.
You’re website will be static, which decreases the complexity and makes it easier to make it secure, so don’t worry too much. Here are some links that might be useful: https://www.digitalocean.com/community/tutorials/how-to-configure-ssh-key-based-authentication-on-a-linux-server
https://www.cyberciti.biz/tips/linux-security.html (this one seems to be geared more towards enterprise stuff, so not all of it is relevant, but a decent amount is.)
Edit: This one is good too. I recommend at least skimming it before the one above this. It will help you figure out which of the points in the link above are worth paying much attention to. https://owasp.org/www-community/Threat_Modeling