How much wrong can things go? reddit / selfhosted ---------------------------------------------------------------------- vothvovo · 2023-09-26 21:16 I plan on self hosting a bunch of things like nextcloud, bitwarden, and so on. I am really afraid of leaking all my passwords for example. What are the chances of me leaking my stuff if I keep things local + maybe a vpn for bitwarden on a laptop. What are the chances compared to bitwarden getting hacked for example? Will I need to do a lot of active maintenance once everything is setup? Pretty new, sry if the question is stupid ---------------------------------------------------------------------- mistersinicide · 2023-09-26 21:35 The risk should be minimal if you're not exposing anything to the internet. VPN is a good option to minimal risk when connecting back to your home network, but make sure you're practice good security practices with VPNs as well. ---------------------------------------------------------------------- CodenameJackal · 2023-09-26 21:36 Just my 2 cents. If you aren't sure about how to properly secure your self-hosted apps, don't host anything sensitive. Your apps will be as secure as you make them. With that said, look into the following: VPNs, Cloudflare tunnels, non-standard ports, reverse proxies, Crowdsec, restrict IPs to your country/region, etc. ---------------------------------------------------------------------- nebajoth · 2023-09-26 21:53 I use vaultwarden as a docker container over tailscale VPN with no public-facing attack surfaces whatsoever. Do recommend. ---------------------------------------------------------------------- vothvovo · 2023-09-26 22:00 It just occurred to me that if it would get hacked somehow, it wouldn't really matter because its all encrypted, right? ---------------------------------------------------------------------- nebajoth · 2023-09-26 22:10 Bitwarden encrypts/decrypts on the client side, and all data stored in the vault is encrypted all the time on the server. So gaining access to it on the server will do nothing. Since the encryption/decryption is via password, the real vector is someone brute forcing the password through the client. Picking a strong password as your master is definitely necessary, but if you only serve the database over tailscale (or other VPN) then noone will ever even have the chance to brute force. ---------------------------------------------------------------------- adamshand · 2023-09-26 22:15 If you know what you are doing, the risks are pretty small and manageable. If you are very new, then the challenge is that you don't yet know enough to understand when you are doing something risky. My advice would be to start small. Learn to build Linux systems and how to do all the basic things (edit files, start/stop services etc). Then learn how to setup a service from scratch. Then learn how to setup the same service with Docker. Then setup a second service and learn how to put a reverse proxy in front of it. Learn how to setup SSL. IMHO the way to make learning all this manageable is to keep it fun. Build things that you are excited to use (setting up something like AdGuardHome to block ads for the whole network is a reasonable early project). Once you've built them, try and break them. See what you can make them do. Try and use all their features. Then rip them down and build a similar thing (if you setup AdGuardHome now try it with PiHole). See how they are different and see how they are the same. Everytime you do build something you'll learn something new and get a bit more experience. I've been doing this since the 90s and there's still more to learn. :-) ---------------------------------------------------------------------- adamshand · 2023-09-26 22:17 With Vaultwarden all your passwords are kept encrypted within the database. There is very little risk of your passwords getting exposed to the public. But as with all software, make sure you use good passwords and make sure you stay on top of updates. All software has bugs. ---------------------------------------------------------------------- EndlessHiway · 2023-09-26 22:34 Much more likely a service or company you do bushiness with will leak your password. ---------------------------------------------------------------------- lvlint67 · 2023-09-27 00:14 > How much wrong can things go? Someone could steal your identity, blackmail you, lead you to financial ruin, and ruin almost every relationship you have.... generally speaking.. the "worst" that ever happens in reality is that someone steals some of your info and steals a bunch of money/opens a bunch of credit and you spend years fighting it..... Or... the feds come asking questions about the child porn being hosted in your basement. every step you take to secure your environment lowers the likelihood of bad things happening. > Will I need to do a lot of active maintenance once everything is setup? Probably.. at least until you are sufficiently experienced to have automated your routine maintenance and monitoring. ---------------------------------------------------------------------- beesuptomyknees · 2023-09-27 00:39 Don’t forget to never assume your local network is uncompromised. Just because you have no open ports from the internet doesn’t mean that dumbass refrigerator you added to your Wi-Fi isn’t scanning your LAN for exploits. Encrypt in transit and at rest and make sure everything is patched and secured. ---------------------------------------------------------------------- StrykerSigma · 2023-09-27 03:21 You would trust a company like lastpass with your password, and they end up compromising it. If you go for selfhosted think about using cloudflare tunnels and put geo restrictions on from where your bitwarden instance can be accessible. ---------------------------------------------------------------------- danclaysp · 2023-09-27 06:36 Don’t open it to the public, don’t install malicious software, and honestly you should be good as an individual. That applies to other devices on your network. Separate the network if you have people who install malware.exe on their stuff on your network. The effort to compromise you after that is likely too high for your value to attackers. You’re not a corporation but just some random dude (sorry). That said you’re likely the weakest point so take precautions yourself akin to the required IT trainings you may have at work. And you’re probably way more likely to have all that stuff stolen like your physical social security and credit cards vs. some elaborate hack of some random home network, so always lock your doors when you leave and get a security cam. ---------------------------------------------------------------------- kmaid · 2023-09-27 07:13 Keep the containers up to date is the most important thing ---------------------------------------------------------------------- not_f0und · 2023-09-27 09:01 I self-host these apps on a server using [Yunohost](https://yunohost.org/#/index_en) to manage apps. I use wireguard (installed via yunohost) to access to my services through the VPN connection. Access from internet is blocked. That means I trust my provider + Yunohost ---------------------------------------------------------------------- StarSyth · 2023-09-27 12:13 Ask yourself, what is the worse case scenario? What are you saving to the nextcloud, bitwarden and so on? How sensitive is that data and what damage can someone do with said data? For most self-hosters, someone gaining access to your personal videos and photos might be an invasion of privacy but the ramifications are negligible. Setup 2FA, follow basic practices and you should be fine. However the best way to keep something safe from the net is to not have it linked to the net in the first place. ---------------------------------------------------------------------- dal8moc · 2023-09-27 14:51 Start small and secure your front door! While a standard router might do I recommend a somewhat more advanced solution like pfsense, opnsense or ipfire. Ipfire unfortunately is restricted to ipv4 only and has not the prettiest gui. But it comes with very good defaults and fantastic documentation that is linked to from the help buttons on every screen. Deploying certificate based vpn (openvpn or IPsec) is straightforward. That said choose one you’re comfortable with. Don’t expose anything at start. Accessing services via vpn gives you access and you can monitor for a while. If you really want to open your services to the net setup a reverse proxy (nginx/traefik/caddy) to access them. Never ever expose a service directly. With the aforementioned ipfire you could separate it into a DMZ too. ---------------------------------------------------------------------- ManiacMog · 2023-09-27 16:13 For all my publicly facing services I use strong passwords and MFA (for the services that implement them, which is most). I have everything go through a tightly configured reverse proxy to limit the ports that I expose, and I have a firewall only expose the ports that are needed for public access. I think if you apply the same type of hardening to your public facing services you should be okay.