Remote access...but with a twist? reddit / selfhosted ---------------------------------------------------------------------- mxpxillini35 · 2023-10-07 13:17 Is there a remote access client out there that will give certain people/accounts only access to do specific things on the remote server? For example, if I wanted to give a friend access to ONLY use the chrome browser (for sonarr and radarr), or even a docker container, but I want to have full access to the server, is that possible? ---------------------------------------------------------------------- d4nm3d · 2023-10-07 13:28 i'd say this is less to do with the app you use to connect to your system, and a lot more to do with user permissions / some sort of group policy settings to lock things down for specific users. ---------------------------------------------------------------------- mxpxillini35 · 2023-10-07 13:30 Ohhhh, so I can setup a user with their own login for windows, and they can use that? That might work...but wondering what would happen if that user left themselves logged in, or if I left myself logged in when they connected. ---------------------------------------------------------------------- d4nm3d · 2023-10-07 13:34 If you're using a server OS then you can have more connections than a home or pro OS. ---------------------------------------------------------------------- mxpxillini35 · 2023-10-07 13:37 Ahhh...not using a windows server OS....using Pro. ---------------------------------------------------------------------- d4nm3d · 2023-10-07 13:47 so i believe Pro is limited to 2 connections over RDP.. so a better solution would be a docker environment that provides just the app you want to give them access to : there's a few but i believe KASM is pretty popular. https://kasmweb.com/ ---------------------------------------------------------------------- mxpxillini35 · 2023-10-07 13:48 This is helpful! Thank you very much! ---------------------------------------------------------------------- d4nm3d · 2023-10-07 14:06 This actually pushed me to spin it up and it's actually pretty good.. i think it's likely exactly what you want. ---------------------------------------------------------------------- azukaar · 2023-10-07 14:14 I am the developer [github.com/azukaar/cosmos- Server/](https://github.com/azukaar/cosmos-Server/) It has a reverse proxy with authentication and the ability to restrict a service to certain level of clearance (ex. User, or admin only). Per user permission is not implemented (yet) thought ---------------------------------------------------------------------- mxpxillini35 · 2023-10-07 14:16 Amazing! I've bookmarked it so I can reference it when I need it. I recently was gifted a ml 350 g9 server that I'm basically wiping and starting from scratch. I think this server will give me the clean slate I need to do some of the stuff I've been trying to do with friends and family. Thanks again! ---------------------------------------------------------------------- mxpxillini35 · 2023-10-07 14:16 Thank you! ---------------------------------------------------------------------- Scaredy14 · 2023-10-07 15:00 Have you tried Parsec? I'm not sure if this would fit your ask, but Parsec will allow you to limit user logins to only have access to a specific program (or the whole computer for yourself). Hopefully I'm remembering all the correctly, so sorry in advance if I get some things wrong: Have your friend(s) make an account, then you give them an access code, and then you should see a login request when they connect. Then, you should be able to specify what program(s) they can access or even access the whole computer (but you'll only want to give your account full desktop control). I think you can even set it to auto allow them to log in (still only with limited access) or to require your approval for each log in. Hopefully that's helpful! I encourage anyone reading this to look up the details. I'm no expert and I set it up just for myself years ago and haven't needed to change any settings since, so I don't remember exactly how it all works. ---------------------------------------------------------------------- mxpxillini35 · 2023-10-07 15:35 Sounds like a decent fit. I'll check that out too! ---------------------------------------------------------------------- HearthCore · 2023-10-07 16:02 Cloudflared + authentication groups + straight up email OTP to go further than cloudflare to the service, on that service then - per user settings. One of those services can be Jellyfin, nas but also something like guacamole, which serves applications or whole desktop sessions, can also trigger commands on specific gateways, to- let’s say- start the Minecraft server. ---------------------------------------------------------------------- SelectCase · 2023-10-07 16:07 There's several ways to do this. You can set up an LDAP server like LLDAP, OpenLDAP, or FreeIPA, and then create user groups to control permissions. But your apps themselves have to support LDAP search. Alternatively, use Oauth/OpenID provider for controlling permissions Or use a single sign on solution like authentik or authelia to control permissions for apps through a reverse proxy. I use a combination of direct LDAP and SSO. Friends can access the media library, but they can't access RDP ---------------------------------------------------------------------- xupetas · 2023-10-07 16:27 Well you could fire an kasm deployment and create specific containers and network rules specific for those containers that can do just that. I have a few friends that use my homelab specifically for some very specific type of workload and they are contained system and network wise to the role I provision them. They can’t escape the role and best of all, when they exist as in logout the container self destructs and the system reclaims the resources used ---------------------------------------------------------------------- isThisRight-- · 2023-10-07 17:52 KASM? ---------------------------------------------------------------------- No-Feature7877 · 2023-10-07 18:55 Jumpcloud can handle your computer logins/mdm for phones/act as an ldap server/ and you can create an SSO application for Cloudflare. And it’s free for up to 10 devices(computers/phones) and 10 users Cloudflare access can use your SSO application on Jumpcloud as an authentication method. Use Cloudflare tunnel to route your domain name/subdomains to your containers In Cloudflare access applications add your hosted apps individually (and select authentication method and define rules) You can set rules per application like: -Include country United States -Require email domain: my personal email domain (This will give access to anybody who’s accounts have an email on my personal domain) (Includes act as “or”, and requires act like “ands”. You have to have at least one “include” defined”) You also get a neat dashboard that gives you one click access to the applications you’re authorized to use(once logged in) ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-10-07 19:12 Agreed. This isn't really about what rights the remote access software gives them -- it's about what rights their user accounts on the system itself have. ---------------------------------------------------------------------- blaine07 · 2023-10-07 19:16 Somehow this could be done with Apache Guacamole. I had it only allow one app to open at one point and I don’t remember how. ---------------------------------------------------------------------- blaine07 · 2023-10-07 19:18 “RemoteApp” https://guacamole.apache.org/releases/0.9.0/ ---------------------------------------------------------------------- Symnet · 2023-10-07 19:58 are you experienced with GPO? this sounds like something you could implement via GPO similar to how schools do it, but you might need some additional software to actually lock things down - there's a few ways to circumvent stuff like that ---------------------------------------------------------------------- LDerJim · 2023-10-07 20:45 If your example is your only use-case I would recommend using overseerr and saving yourself the headache. ---------------------------------------------------------------------- unisasquatch · 2023-10-07 20:45 Or you could bypass the rdp limitation https://github.com/stascorp/rdpwrap ---------------------------------------------------------------------- d4nm3d · 2023-10-07 20:54 that's interesting and I will definitely check that out.. thank you ---------------------------------------------------------------------- HoustonBOFH · 2023-10-07 21:23 Citrix Published Apps was developed for this exact purpose. It is a commercial product, however. Kasm does something similar. It is also commercial, but has a community edition. ---------------------------------------------------------------------- ithakaa · 2023-10-07 23:08 Easily Use tailscale and create ACLs for your friend to only have access to the Sonarr/Radarr server IPs at the Sonarr/Radarr ports. Done ---------------------------------------------------------------------- MothGirlMusic · 2023-10-07 23:30 so as i understand your issue, you have a VM you wanna let people sign into and use the web browser so its kinda like a vpn. yeah? if you don't mind getting creative, you could host a docker of the firefox browser so its litterally just a browser-only. then disallow it to connect to the internet and only allow internal site access so people can't do anything weird on it... could even make a nice starting page, which THEN begs the question of why not just use a dashboard proxy? apps like authentik and keycloak that do authentication ALSO have the ability to act as a proxy portal if you don't already have your page being served by a reverse proxy. and even if you do, you can get all of your internal sites on that reverse proxy like nginx proxy manager... and then protect them with authentik. can even set up an apache guacamole docker and connect that with OIDC to serve as your personal web-VNC client to any of your servers while allowing people to access your other webapps.. and then you'd also have RBAC and so much else. ​ but, an old school way to stick more closely to what you're asking is to set permissions in linux or if you have windows, host a windows server and set up Group Policies. Admin group can do anything, User group has limited access to do anythign but still get a cool desktop. this is actually a lot easier in windows than linux, but in linux its still not that difficult, however you wont be benefitting from the same native GPO capabilities as windows server edition has. though, i'm sure there are linux tools to emulate the same. ​ i actually had a windows server with GPOs running for staff but then chose to do the first option i listed which is just put all my internal servers up on a big reverse proxy and use authentik to secure them so you can access them if you have an authentik account but if you don't, all you see is an authentik login... so even apps without passwords are pretty secure under authentik or keycloak's protection. and if you have a bunch of subdomains like we do, authentik also provides a little dashboard for users to see what services they are able to use right there when they sign in! i dont think keycloak offers this, but you can just as easily find a dashboard webapp that supports OIDC with RBAC or something. ---------------------------------------------------------------------- esturniolo · 2023-10-07 23:59 This ---------------------------------------------------------------------- Trainmaster2 · 2023-10-08 01:12 This would only be for browser access, but N.eko and N.eko Rooms work really well. ---------------------------------------------------------------------- cneilmon · 2023-10-08 02:20 it think Kasm would work on this scenario ---------------------------------------------------------------------- ayoungblood84 · 2023-10-08 04:31 Look at what they need access to. Sonarr/radar to do what? Request media? Look at ombi. I wouldn't hang out creds for anyone to do anything on my network outside of dedicated apps with a purpose and that are secured. ---------------------------------------------------------------------- ExpertPath · 2023-10-08 05:41 Twingate should do the trick ---------------------------------------------------------------------- RegeneratorRE4 · 2023-10-08 07:33 Tailscale with ACLs, but this sounds like an xy problem - if you want to give access to the arrs so your friend can request content then look into overseerr which can even be integrated to plex to auto add from watchlist ---------------------------------------------------------------------- michaelpaoli · 2023-10-08 08:43 Sure, e.g. ssh, configure access via keys only, and use forced commands. ---------------------------------------------------------------------- HellDuke · 2023-10-08 17:12 Wrong approach. You want to give web access to the services in that case and not give remote access to the device itself. In general you will need to be on the same network, VPN connected or have opened ports for the remote connection to work. If you have that setup then from the same mechanism they would be remoting in (connect to the WiFi or use VPN) they can just open their own browser and type in either the IP or host name (if your DNS is setup to handle it properly) to get to the service in question. If it's public access (generally not recommended) then you'd need to forward the ports of Sonarr and Radarr instead of the remote connection port. ---------------------------------------------------------------------- BackedUpBooty · 2023-10-09 04:49 there's a couple ways you could do this, and they're both essentially the same, though one is on your server and the other isn't: 1. Authentik - this can act as your remote proxy too, or just as an auth in front of services. It can act as SSO for multiple endpoints with configurable user permissions, meaning you can control who has access to what at a granular level 2. Cloudflare Zero Trust - if you use cloudflare, you can create a gateway which acts as a redirected landing page for users to sign into. You can set this in front of some or all of your subdomains, then set up groups as well as users if it makes sense for you