adrianlee_dev

@adrianlee_dev@lemmy.world

• ⁨Comment⁩ on ⁨It's self hosting Sunday! What's up?⁩ ⁨⁨7⁩ ⁨hours⁩ ago⁩:

  This week, I’ve mainly been handling the fallout from the PHP vulnerability that occurred in late October. Following that incident, I made a few changes: I’ve opened only the necessary ports to the outside world, and the admin panel is now accessible only via VPN. I’ve created an inventory list for each server, clearly detailing which services are running and their versions, so that the next time a CVE is released, I’ll know immediately which servers are affected. In addition to running daily automatic backups, I periodically restore them to a clean machine to verify they work.

  Remember: Always treat your servers as if they might be lost tomorrow, and make sure to have a thorough recovery plan in place.

• ⁨Comment⁩ on ⁨For users with public facing services: How does the current explosion of AI-discovered vulnerabilities affect your threat model and willingness to be public facing?⁩ ⁨⁨1⁩ ⁨week⁩ ago⁩:

  My server was recently compromised via the latest vulnerability. Fortunately, the damage wasn’t too severe. Since my server must remain publicly accessible, it can’t be hidden behind a VPN—I can only minimize its exposure as much as possible while ensuring my backup and recovery processes are rock-solid. I’ve configured the firewall to allow only essential ports, restricted SSH access to key-based authentication, enabled automatic installation of security updates, and set up daily backups, one of which is synchronized to an off-site location. Some have suggested treating public-facing machines as if they’ve already been compromised by default. I agree with this approach, and it’s exactly what I plan to do next.