Advice on the security of my self-hosted setup reddit / selfhosted ---------------------------------------------------------------------- Cloudssj43 · 2023-10-09 19:16 So some background I'm a software engineer so I'm kinda privy to a lot of the inner workings of the internet. I started dabbling into the world of self-hosting after I got myself an SBC (Orange Pi4 LTS), but while I'm not a novice, I also know enough to know how little I know so would like some advice regarding security. After the Last Pass breach that happened last year that prompted me to change ALL my passwords, I decided to try self-hosting my own Vaultwarden server that isn't port forwarded so only accessible from home. (I know leaving it to a company like Bitwarden SHOULD be more secure, but I argued myself into self-hosting, reasons I can elaborate below in a reply). Anyways, after self-hosting Vaultwarden, I found out that having a super low-powered server running 24/7 was actually both fun and useful so I then added a Jellyfin server on it as well. I was happy with the setup and now I put Sonarr on it as well. The question about security is that to get the full usage of Sonarr, I would LIKE to have a download client on it and I really like qbittorrent. Is having a bittorrent client a potential danger if it's running on the same machine as my Vaultwarden docker container? I ran nmap from outside the network and the only 2 ports that are open are used by my dad and are forwarded to a machine that he manages. I have no plans right now to access it while outside the network but I'm still concerned because I don't know if having bittorrent client exposes me somehow. ---------------------------------------------------------------------- Cloudssj43 · 2023-10-09 19:22 The reason I argued myself into self-hosting is that I agree a company like Bitwarden probably DOES have better security in place than I could have. They have IT staff that are more skilled than me and also know more about security practices than me. However, by being a company they have a much higher attack surface and also more staff that AREN'T engineers that could also be compromised. Not only that, but by being a known password-holding company attackers are far more incentivized to attack the company. I don't believe any company can hold on forever. I argued that if I self-host my passwords on Vaultwarden, and don't allow outside access, the chances of a breach might even be lower, just because there's less incentive for attackers to go after a random ip address. (One that an attacker doesn't even know that there's a password manager behind it) ---------------------------------------------------------------------- nikimere · 2023-10-09 19:41 I’ve been on a very similar journey, so I’m interested to see what others say. I installed VaultWarden on my Pi4, and exposed it to the “outside world” via Cloudflare tunnels. Seems like a nice solution, with a little bit of added security from Cloudflare. I just installed NextCloud and added a 2TB external HDD, which seems to be working well so far. I’ll need to put some redundancy in place, but if it works well I’d ditch Dropbox. ---------------------------------------------------------------------- geo38 · 2023-10-09 20:39 Security is hard because in the extreme, no system is secure enough. Your local Vaultwarden server is likely already at risk just because it's on the same network as the computer you posted from, and lord knows what malware is on your computer you don't know about that's probing your home network. Do you have family that isn't as security aware as you and will click on executable enclosures? Worse, you have other things on your home network besides your computer and the vaultwarden sever. For example, I bought an Amazon Echo. A few months later, Amazon sent me an email telling me the Ink was low in my Epson InkJet printer along with 'click here' to buy more ink. We can hope that Amazon's probing of my internal network was not malicious. How about the other devices on your network? If you're concerned about Vaultwarden (and I would be!), my suggestion is to spend $20 plus an SD card and cheapo 5watt USB power plug and install Vaultwarden on this. Ensure the only open ports on the machine are SSH (and you only allow logins with certificates) plus the Vaultwarden ports, and that's pretty close to as good as you can get. A little less paranoid installation would be to use virtual machines for each set of applications, but that might be a bit much for a Orange Pi4. Almost as good are docker containers. Install docker and move applications into docker containers, properly set up volume mounts, and rouge software in one container is less likely to do harm to your host machine or applications in other containers. There are many docker examples for Sonarr, Jellyfin, Vaultwarden. Regardless of security, once you find docker, you'll discover how easy it is to try out new applications on your system without worrying about what crap they might install or what other dependencies they might have. If you don't like the app, delete its docker image, container, and volume(s), and it's gone with no trace left on your system. Docker rules /r/docker ---------------------------------------------------------------------- Cloudssj43 · 2023-10-09 21:05 Good points! I thought about moving Vaultwarden onto an even less powerful SBC to secure it even more and I guess you're of the same mind. I'll consider that as a super secure option in the future since I have a RPi 1 B+ from 2014. Other than that, both my Vaultwarden and Jellyfin are running in docker containers, seems like I should move Sonarr into its own docker container as well then. I'll just have to figure out how to get sonarr in 1 container talk to qbittorrent in the other container but I'm sure there's some way I can get that to work. THANKS! ---------------------------------------------------------------------- sk1nT7 · 2023-10-09 22:09 1. Do not expose it to the Internet. Use a second channel like VPN or SSH port forwarding. 2. Keep the instance up2date. Patch regularly. Use official docker images and validate new updates. 3. Separate applications from each other. Network wise and if possible also hardware wise. If you use Docker, you already got some good options for separation. Run your docker containers in different docker networks and only join them if necessary. 4. Keep your host OS up2date. Patch regularly. 5. If you expose SSH, harden it. Only provide pubkey auth and use a strong passphrase. 6. Regarding bitwarden/vaultwarden, use a strong master password. Disable registration. Enable 2FA. Harden the encryption algorithm used. For PBKDF use 600.000 Iterations. Alternatively switch to Argon2. Disable password hints. Securely store your 2FA backup codes. May use a hardware 2fa device like yubikey. Enable email notifications to obtain information about new device logins etc. 7. Implement IDS and proper logging. May use fail2ban to monitor your vaultwarden logs for suspicious activities such as forceful browsing (many 404 errors) or login bruteforcing (many 401 or 403 errors). Ban threat actors accordingly. 8. Implement proper backups of your container and vault data. 9. Always use TLS and proper certificates to ensure C-I-A of your data and services. In the end, the risk of being hacked can be reduced a lot. If you know what you are doing and do not fuck up, it is going to be hard to compromise your vaultwarden instance. However, as others have pointed out, there are various attack vectors, which are not directly mapped to your misbehaviour or fuckups. A container breakout from qbittorrent and lateral movement into the vaultwarden container or even host system itself is quite challenging and not feasible for a regular attacker. Also bypassing vaultwardens security measures or exploiting a 0-day vuln is very unlikely. Typically, a normal attacker would not drop those million dollar exploits to gain access to your personal vault. ---------------------------------------------------------------------- emprahsFury · 2023-10-09 22:13 You could probably increase the value of your responses by defining what you're afraid of more. The biggest threat from torrents from sonarr is that the MPAA will have the police seize your server, which will certainly be bad for your vaultwarden instance. ---------------------------------------------------------------------- Cloudssj43 · 2023-10-09 22:37 Man is it nice to know that I'm actually not that bad at thinking about security. I have done basically everything from 1-6 & 9 (although i don't know how to set up email notifications in vaultwarden. I actually don't know that many logging software, so I'll look into fail2ban, but any other suggestions would be great. And I was already looking for an automated way to backup my settings (I don't actually care too much about my container, because I sync regularly, I can export the passwords to an encrypted json to import to a new setup easily) ---------------------------------------------------------------------- Cloudssj43 · 2023-10-09 22:39 The main thing I care about is an attacker using any method to compromise my passwords needing me to reset ALL my passwords. I basically want to avoid needing to change a hundred different account worth of passwords as much as possible ---------------------------------------------------------------------- sk1nT7 · 2023-10-09 22:43 Email notifications are quite easy to implement. If you have enabled the /admin interface, you can login there via Web browser and configure your SMTP credentials. Otherwise, you would directly paste them into the vaultwarden config.json. Regarding logging software, you have multiple choices. Usually, regarding vaultwarden, you would only care about successful logins. However, imo, it cannot be wrong to also get notified about attackers trying to get in and banning them very early. Last year I wrote about vaultwarden and fail2ban on my blog. Might be an interesting read: https://blog.lrvt.de/securing-vaultwarden-with-fail2ban/ An alternative would be crowdsec, which gains popularity. But honestly, as your instance is available on local LAN only; I would prioritize the email notification setup first. ---------------------------------------------------------------------- Cloudssj43 · 2023-10-09 23:12 Thanks a lot for your insight and recommendations, this has been a great help! ---------------------------------------------------------------------- schklom · 2023-10-10 01:45 > being a known password-holding company Except they cannot read the passwords. At most, an attacker could gain a copy of your encrypted password database, which is useless without your master password. ---------------------------------------------------------------------- focusednewb · 2023-10-10 03:52 Assuming your two containers are on the same docker network, they can communicate using container names. So if your qBittorent container is named "qBittorent" just point Sonarr to "qBittorent" on port 8080. If you go the Docker route, I'd recommend Portainer and Watchtower. Portainer gives you a nice gui for managing containers and whatnot, and Watchtower pulls updated images so your containers are always up to date. ---------------------------------------------------------------------- CrappyTan69 · 2023-10-10 06:47 I'd argue it's not useless. If the target is rich enough, they now have a physical copy with no more brute force protection. Hammer away. Your other points are valid. OP - I run similar setup. Monthly cron to backup database to a usb disk inside my safe. Fire, water damage and physical theft mitigation. Search for usb pass through safe. I don't have external access but do use a vpn from all devices so attack surface is only that of the vpn server. If you're heading down this route, please also ditch the isp provided router. Look into pfsense or opnsense. Isp and general cheap cots routers are terrible (and actually inviting) Enjoy the journey ---------------------------------------------------------------------- jkirkcaldy · 2023-10-10 08:19 Most of the breaches these days are not someone “hacking” a server over the internet, it’s social engineering and fishing attacks. Or they come from somewhere else. The last pass hack was done because an employee was using an out of date Plex server which had a vulnerability that was exploited. As you said, whilst you take security into your own hands when you self host, unless you are a high value target (celebrity, politician, ceo, head of state, etc) it’s unlikely that you are going to be targeted specifically. It would be a much better use of time to target Bitwarden where they could get the data for many users, and potentially other things like credit card information vs targeting a single person. I also disagree with the argument that the only valid form of security for self hosting is to stick everything behind a vpn. But I will concede that this is *more* secure. I think putting a password manager behind a vpn only is stupid. There will be a time where you can’t install a vpn on a device but you need access to a password. It may not be often, but it will happen and you will be SOL. It happened to me when I upgraded my phone and I’d messed with the subdomain vaultwarden was accessed by, I couldn’t enter my iCloud password because I didn’t know it. So I couldn’t download Tailscale, even if I could I couldn’t log into GitHub because I don’t know that password and I don’t have access to the two factor auth. I was stuck without access to any of my contacts and I needed to call my other half. I had to physically go home to log in and download everything. Now that was my own fault, i prematurely erased my old phone but it illustrates my point, if you lose access to your vpn you may be locked out of everything at a moment where getting access could be vital. The same can be true for other self hosted apps. ---------------------------------------------------------------------- cspotme2 · 2023-10-10 12:54 If you're using cloudflare tunnels, why not install the warp client and not publicly expose it. One less thing to worry about. ---------------------------------------------------------------------- nikimere · 2023-10-25 09:41 But with the 2FA on CF Tunnels, does it matter? Unless i'm missing something, nobody can SSH into my server without solving the 2FA? Are there other attack vectors i'm missing?