1

I'm a long time Linux desktop user but a total newbie in servers and security. Now I want to set up a Raspi (running Raspbian) to act as a CUPS print server, an NFS file server and backup storage, an Owncloud server and maybe even a small web or mail server in the long run.

Since I have no experience with servers, I'm a bit unsure if it is a good idea to have private backup data on the same machine that is accessible from the internet for e.g. Owncloud usage. Is there something that can or needs to be done to protect this data?

Currently I'm at the very beginning, just set up Raspbian, CUPS and set up the printer in the local network. Everything through the standard user "pi" preconfigured in Raspbian. How should I proceed when configuring NFS and Owncloud?

Thanks for any help, Photon.

Note: I posted the same question on superuser.com but got the advice to try it here since here people might be more familiar with setting up a raspi properly.

  • Generally, when it comes to security, the rule should be that if you don't know what you are doing, then don't. That is of course a matter of what the consequences of leaking your data might be. You would be safer with two pies, I'd say. – Bex Feb 26 '15 at 10:48
  • Thanks for your comment, that's of course very true! But everybody started at some point and I want to learn how to do the setup properly. Of course the backup data will be placed in password protected archives so it won't be completely unsafe, on the other hand professionals will be able to break even encrypted partitions if they are interested in it. So I think that the risk is limited. – Photon Feb 26 '15 at 13:06
1

Security is in no way rpi spesific. There are a few things you can do;

  1. Assume you are a small fish and no one will care to cause you trouble.
  2. Use a proxy/vpn to access the server so baddies would have to hack ssh/vpn before exploiting any services you chose to run (this is all you need if only trusted people use the server)
  3. jail each service with an open port (except ssh)
  4. iptables if you are not NATed
  5. Set up rights for anything shared by the jails
  6. use encrypted file systems for data you want private
  7. log and monitor network and app activity for suspect behavior and email or auto act on it (fail2ban, etc)
  8. Use selinix, hidepid, Rootkit Hunter, logwatch.
  9. disable unused app features
  10. subscribe to security email bulletins
  11. have (encrypted) backups at a different address
  12. use old-stable BSD (why there was on heart bleed on OS X)
  13. test your RAM for hardware exploit.
  14. keep ultra sensitive information in your head like your decryption pass-paragraph (because a word is not enough).

Non security related config of your services just need to keep in mind the cpu and ram limitations of the rpi, like use nice, and don't expect live video transcoding, etc.

  • Thanks for the answer (unfortunately, I messed up linking my account here to my other stackexchange accounts, so I don't even have enough reputation for an upvote...). I'm a bit busy with other things now, but I will come back to the list in your answer, try things out and give feedback later! – Photon Mar 17 '15 at 14:17
  • Trying to implement point 5. from the list, but failing to: raspberrypi.stackexchange.com/questions/29333/… – Photon Apr 4 '15 at 12:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.