0
I have a small VPS (Ubuntu 16.04) that I use for hosting of a few personal websites, ownCloud, etc. It's fairly slow and doesn't have a lot of storage. I'd like to offload the ownCloud storage and MySQL database, basically anything resource-intensive, onto my home server (Ubuntu 17.10), without opening my home network any more than absolutely necessary.
What's the best way to do this from a security standpoint? There are three options that I can think of:
- Expose MySQL and NFS on nonstandard ports, firewall all but the VPS's IP.
- Establish an SSH tunnel, route all MySQL and NFS traffic through the tunnel.
- Set up a VPN, ditto.
My concern in the case of 2 and 3 is that if my VPS is compromised I may end up exposing more of my home network that I intend – it's the VPS that decides which remote ports/IPs it's going to tunnel to, so once the tunnel is set up, any attacker can add new tunnels.
Thanks. I ended up going with option 3, and using
hosts.allow
/hosts.deny
to firewall all but the services I wanted to expose to the VM. I don't know of a way to enable ssh tunneling without allowing tunneling to arbitrary ports/IPs on my local network, so that was a non-starter. – Mikkel – 2018-03-05T15:52:08.5571You really should use iptables to firewall your traffic - hosts.allow/deny is useful, but iptables is at a lower level and can deal with all programs. – davidgo – 2018-03-05T18:24:28.677