LDAP over internet reddit / selfhosted ---------------------------------------------------------------------- trexxeon · 2023-10-06 15:45 Hey, Is LDAPS secure enough to host over internet to some of my other servers so I can have the same user database on multiple hosts? ---------------------------------------------------------------------- Butthurtz23 · 2023-10-06 15:58 With SSL certificates, yes, and you can also add another layer of security using VPN or whitelisting other server IP addresses. ---------------------------------------------------------------------- Butthurtz23 · 2023-10-06 15:58 With SSL certificates, yes, and you can also add another layer of security using VPN or whitelisting other server IP addresses. ---------------------------------------------------------------------- ex800 · 2023-10-06 17:13 Presuming that you are using TLS 1.2, the traffic is "secure", however it would be foolish to not have an ACL to limit traffic from only the required hosts static addresses. ---------------------------------------------------------------------- SolFlorus · 2023-10-06 18:22 Yes, JumpCloud does that. I would probably recommend setting up a LDAP mirror at the each site though, and have the data replicate to each one. The big advantage is that an LDAP outage would only impact one data center, instead of taking everything down. ---------------------------------------------------------------------- trexxeon · 2023-10-06 19:02 The mirror thing sounds pretty nice, I am running lldap so not a full fledged ldap setup.. do you by any chance have any resources on how to set up mirrors? ---------------------------------------------------------------------- trexxeon · 2023-10-06 19:03 Thank you for the reply, I don’t think lldap have any acl built in . ---------------------------------------------------------------------- trexxeon · 2023-10-06 19:04 Thanks for the answer, I guess vpn would be a way since I don’t think lldap has any white listing built in ---------------------------------------------------------------------- NobodyRulesPenguins · 2023-10-06 19:04 Yeah that's "common", but usually the iptables setup is tight enough to only let a known list of static IPs connect to itself ---------------------------------------------------------------------- BraianP · 2023-10-06 19:09 Just use your firewall, you don't need anything built it, it would be actually more secure to not do so and just block it at the firewall level with something like "ufw" ---------------------------------------------------------------------- BraianP · 2023-10-06 19:10 Just use ufw in explicit deny mode and allow all your necessary IPs to communicate through the ports you are using ---------------------------------------------------------------------- ex800 · 2023-10-06 19:11 on the firewall ---------------------------------------------------------------------- stobbsm · 2023-10-06 19:32 Could run it through wireguard or another vpn to limit the connection options. ---------------------------------------------------------------------- justinhunt1223 · 2023-10-07 03:42 I run an active directory setup at my house with a couple laptops connected to the domain. I've experimented with ldaps but found a VPN much easier and safer to handle. I ended up writing a simple script to modify the hosts file on the laptops to change the IP of the domain controller over to the VPN IP when they are at from the house. This way you get the benefit of speed when home and then when away you still can access everything security (including mounted share drives). I found it handy to setup file history on the kid's computers so they sync to the domain controller no matter where they are. Definitely go the VPN route. ---------------------------------------------------------------------- SolFlorus · 2023-10-07 03:54 Last time I did it, I used OpenLDAP. I’m not sure what capabilities lldap has. https://ubuntu.com/server/docs/service-ldap-replication ---------------------------------------------------------------------- trexxeon · 2023-10-07 05:06 Thank you for your input, much appreciated ---------------------------------------------------------------------- DynamicResolution · 2023-10-07 07:58 The traffic will be secure but the port will be exposed to internet, which poses a risk. you dont know when the next 0-day comes, and you certainly dont want to get pwned when it does. So, VPN is the way in such scerarios. ---------------------------------------------------------------------- xupetas · 2023-10-07 08:23 And binded querys ---------------------------------------------------------------------- PuzzleheadedFuture85 · 2023-10-07 09:13 Agree, probably IPsec would be a good choice. ---------------------------------------------------------------------- fuken33 · 2023-10-07 11:44 Yeah it can be secure but you should use a reverse proxy anyways. Having a reverse proxy in front of your services will grant you the most protection. I'd recommend to use Caddy but traefik or nginx are good alternatives also. ---------------------------------------------------------------------- lilolalu · 2023-10-07 14:07 I am running LDAPs over the internet but in the long run I want to change this to an OIDC auth setup using authentik, probably keeping LDAP as a backend. ---------------------------------------------------------------------- lilolalu · 2023-10-07 14:10 A proxy in front of your LDAP does not give you any extra security at all. ---------------------------------------------------------------------- trexxeon · 2023-10-07 14:30 I have been looking at this as well, I’m not really sure how the best practice is with the ldaps, running ldaps and authelia on the same machine is no problem, but if you run authelia on one machine and LDAPs on another, are you supposed to copy the certificates from the server running ldap to the authelia machine just to establish a connection? ---------------------------------------------------------------------- lilolalu · 2023-10-07 14:33 I think the question of security using LDAP over internet remains, but the LDAP has to accept connections only from a single IP, from a single software, authentik (or authelia if you prefer that). And those tools can add an extra security layer by additionally doing MFA. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-10-07 15:42 To add to the others i would use mTLS (Client certs) for better security.