Security of sites behind Reverse Proxy reddit / selfhosted ---------------------------------------------------------------------- carlinhush · 2023-10-13 14:11 Like many of us I have several services hosted at home. Most of my services run off Unraid in Docker these days and a select few are exposed to the Internet behind nginx Proxy Manager running on my Opnsense router. I have been thinking a lot about security lately, especially with the services that are accessible from the outside. I understand that using a proxy manager like nginx increases security by being a solid, well maintained service that accepts requests and forwards them to the inside server. But how exactly does it increase security? An attacker would access the service just the same. Accessing a URL opens the path to the upstream service. How does nginx come into play even though it's not visible and does not require any additional login (apart from things like geoblocking etc)? My router exposes ports 80 and 443 for nginx. All sites are https only, redirect 80 to 443 and have valid Let's Encrypt certificates ---------------------------------------------------------------------- thekrautboy · 2023-10-13 14:20 > How does nginx come into play even though it's not visible Of course its "visible". Its the service that sits directly in front and answers the request. The user from the outside connects directly to nginx (or whatever reverse proxy you chose). If that proxy software has a security flaw, it could be exploited. Im a bit sceptical about running a proxy directly on something like OPNsense. For the simple reason of having a up-to-date version, lots of OPNsense plugins lag behind a few versions compared to their "stand alones". So in the case of a security flaw in a proxy, that could be a issue. Assuming the versions are identical, then sure why not run on the OPNsense. Maybe it would be ideal tho to run it in a seperate "device", maybe a dedicated VM, or atleast a rootless container, something like that. Ask /r/CyberSecurity /r/CyberSecurityAdvice and /r/HomeNetworking i guess. ---------------------------------------------------------------------- autisticit · 2023-10-13 14:20 > How does nginx come into play It does not ---------------------------------------------------------------------- thekrautboy · 2023-10-13 14:21 How does that work then? ... ---------------------------------------------------------------------- azukaar · 2023-10-13 14:28 The main use of a reverse proxy in this scenario is for the reverse proxy to impose restriction on how the service can be accessed. For example rate-limiting, or filtering clients. As you rightfully pointed out, it requires more than just starting the reverse proxy and pointing to a service, otherwise you would almost access it the same way (although by default NGINX does do a little bit of that already) ---------------------------------------------------------------------- ElevenNotes · 2023-10-13 14:38 Don't listen to him. A reverse proxy can for instance allow only access to the main app component but deny the /admin URL or similar. You can also deny by IP, by access URL and much more. Yes the app behind the proxy can have security issues. That's why that app should be isolated from the rest of your network and have no internet access. ---------------------------------------------------------------------- thekrautboy · 2023-10-13 14:39 Oh i am aware thanks :) I am wondering what they think as to "how does a reverse proxy **not** come in to play when a reverse proxy is used"... ---------------------------------------------------------------------- Your-Neighbor · 2023-10-13 14:43 The reverse proxy should be the thing handling SSL encryption and you should be more confident the implementation in any mainstream reverse proxy is at least as secure if not more secure than the implementation in each individual server the proxy is in front of. Its also more convenient for an admin as all the SSL stuff is in one place instead of on every individual server ---------------------------------------------------------------------- autisticit · 2023-10-13 14:43 Don't listen to Stevie. When I say that it does not, I mean that if OP is asking then he probably configured nothing particular on nginx side for security. OP is asking about how the reverse proxy comes into play regarding security, hence my answer. ---------------------------------------------------------------------- thekrautboy · 2023-10-13 14:50 > OP is asking about how the reverse proxy comes into play regarding security, hence my answer. Hence youre wrong tho? ---------------------------------------------------------------------- AcrobaticLab9 · 2023-10-13 14:51 Nginx is a well-developed, well-documented, consistently updated piece of sofware. There might be unnoticed security holes in your random software #5812 and if you use open ports to access to that app, that's a recipe for disaster. Meanwhile, reverse proxies are audited more strictly so that zero days won't go unnoticed for long. ---------------------------------------------------------------------- autisticit · 2023-10-13 14:53 Did you even read what I wrote right before what you quoted? ---------------------------------------------------------------------- ElevenNotes · 2023-10-13 14:57 Stevie? ---------------------------------------------------------------------- thekrautboy · 2023-10-13 15:00 Yes i did, Johnny. ---------------------------------------------------------------------- thekrautboy · 2023-10-13 15:00 Pauly? ---------------------------------------------------------------------- timothyclaypole · 2023-10-13 15:15 The theory is that your proxy has a smaller attack surface than your app server. The codebase can be more easily secured as it has less complexity because it only has a single relatively simple task. There’s also expected to be less risk of lateral movement within your network if your proxy does get compromised because the proxy is supposed to have much less exposure to the rest of your network than your app server (proxy should only need https access to your app servers, your app server is likely to need access to database and/or other services). But that all assumes that you are deploying your proxy in a secure manner and with best practices for network segmentation (which a home network is likely to miss) ---------------------------------------------------------------------- sk1nT7 · 2023-10-13 15:15 A reverse proxy streamlines your approach of exposing web services. The services are then, usually, only accessible by knowing a hostname or subdomain, not directly by visiting the IP address. The reverse proxy also manages your SSL certificates and ensures that HTTPS is provided. Regarding this, it also terminates SSL. Means, your end users accessing the services are always using TLS encrypted communication channels. However, the reverse proxy itself can talk without encryption in plaintext with the proxy services. This increases speed and reduces load. If you do not use any advanced configuration, then a reverse proxy won't provide any special security features. However, you can add various things into the mix, such as a WAF like Mod Security or some log monitoring solutions. As everything goes over the reverse proxy, you have a single point of entry and can easily manage access. You can combine it with other stuff easily too like Cloudflare in front or an IdP like Authelia/Keycloak/Authentik for Single Sign On. Or crowdsec/fail2ban, which inspect the logs and ban misbehaving threat actors. The logs are normalized and strictly formatted and do not vary for different services. So analyzing logs or applying security solution based on those logs is easier by using a reverse proxy than having various individual web servers doing and logging their own way (Apache, Nginx, IIS and all the others). ---------------------------------------------------------------------- poeticmichael · 2023-10-13 15:17 Not trying to hijack the post, but I was wondering if you can help? I want to restrict access to my Authentik admin only to a given IP. The Authentik is running behind Nginx Proxy Manager and its network. * so I was hoping that any attempt to mydomain.xt/if/admin would be blocked to all, but allow IP 129.xx.xx…. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-13 15:25 But your app server connection to the dB should be limited as well to that device and only that device. ---------------------------------------------------------------------- SillyLilBear · 2023-10-13 16:42 You are secure as much as what you expose is. ---------------------------------------------------------------------- timothyclaypole · 2023-10-13 17:11 If your app server has connectivity open to a DB server and your app server is compromised then an attacker can with just one more attack move laterally from your app server to your DB server and then perhaps further elsewhere or more likely the DB server is the ultimate target of the attacker. Reverse proxies help reduce lateral movement because they typically have fewer and less interesting targets that they can reach after they are penetrated. So the attacker has to breach first the proxy, then an app server before getting to a DB server. It’s about making the job of an attacker increasingly difficult - there’s no perfect solution but sufficient defense in depth can usually protect against casual and most targeted attacks. ---------------------------------------------------------------------- chaplin2 · 2023-10-13 17:13 Can we have two layers of authentication: login with SSO with reverse proxy, which will bring the login page for the application? (Not replacing application authentication with reverse proxy authentication). ---------------------------------------------------------------------- thekrautboy · 2023-10-13 17:48 Oh hi Yoda! ---------------------------------------------------------------------- thekrautboy · 2023-10-13 17:50 Never used it myself but i read just recently that this would cause a conflict because only one set of auth headers can be send at a time, so you can either have the auth header from authelia for example, or the auth from the app itself, not both. But as i said, never used that myself, maybe there is some way. But honestly i dont see much point in doing this. ---------------------------------------------------------------------- mshorey81 · 2023-10-13 18:51 I look at reverse proxy as being more of a convenience to the administrator rather than a more secure way of exposing services. I don't feel warm and fuzzy about just letting my NPM instance hang out there so I use pfblockerng in front of it for geoIP blocking and threat lists. I also utilize Crowdsec and Fail2Ban for additional security. My NPM VM also sits on an untrusted vlan inside my network with explicit rules of what it can reach on any segment of my internal network. It all boils down to your comfort level and setting your allowed risks. ---------------------------------------------------------------------- yarisken75 · 2023-10-13 18:55 Use a vpn. Nginx is not making your applications safer. There are thousand of scans each day on all ip's in the world that exist. 1 flaw and they are inside your network. ---------------------------------------------------------------------- pielman · 2023-10-13 19:26 I have added authelia for MFA on my web services on top of normal authentification. In addition I banned countries like russia /china ( I will never visit them anyway). ---------------------------------------------------------------------- Kryosleeper · 2023-10-13 20:19 One possible example from my setup. I have a Spring Boot app for scrapping and storing certain information periodically. It has two exposed HTTP methods (one for scrapping and one for returning stored results), and the app is configured to only accept connections from localhost. I expose the reading method via nginx, while the scrapping one is only used from cron and is not available for anything outside. This setup also scales well - I can add new services without having to copy-paste any additional checks, all configs for them are in the same nginx site, and if ever I add a login system to it, I can control access per-service from a single point. ---------------------------------------------------------------------- billiarddaddy · 2023-10-13 20:31 Having all your tragic going to one node regardless of domain is nice. Also one ghost for cert renewal. ---------------------------------------------------------------------- zoredache · 2023-10-13 20:39 Well lets imagine a case where you had to keep a really old application online. Perhaps something still susceptible to the heartbleed bug or something like that. With a reverse proxy in place the outside world would only be communicating with your proxy, and have little to no control against the system behind it with an issue. A reverse proxy potentially protects you against some kinds of issues that could exploited on the web servers behind the proxy. Not all of the issues, but some of them. That said, you obviously should be keeping everything behind your proxy secure as possible. Ideally your reverse proxy should be something minimal and different from what you are running on the backend. By that I mean, you wouldn't get much benefit by having nginx in the front, and nginx in the back. ---------------------------------------------------------------------- zoredache · 2023-10-13 20:47 You would have issues if you were trying to use HTTP authentication on both a proxy, and the backend. But often people are using some kind of form-based authentication that stores the state in cookies. Authentication that stores state in cookies usually won't conflict. Anyway, it can be useful to protect resources behind the proxy that don't have authentication, or have weak authentication. Or in the case of selfhosting, for apps where you can disable authentication the backend application, it lets you unify the authentication for many application you are running. ---------------------------------------------------------------------- zoredache · 2023-10-13 20:48 > Can we have two layers of authentication: login with SSO with reverse proxy, which will bring the login page for the application? Yes that is certainly a possibility, at least for some software. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-13 21:29 I do this with Authentik and NPM! ---------------------------------------------------------------------- youngsecurity · 2023-10-13 22:12 Have you considered making your services dark with an overlay network? ---------------------------------------------------------------------- hmoff · 2023-10-13 22:21 The http server code in a reverse proxy like nginx is very well tested, and probably more so than whatever framework your individual apps are using. Many of those are not expected to be exposed publicly eg gunicorn (popular Python server). ---------------------------------------------------------------------- Affectionate-Fig-805 · 2023-10-13 23:24 You can also add modsecurity module to your Nginx to.protect against common attacks like SQL injections or XSS attacks. ---------------------------------------------------------------------- SitDownBeHumbleBish · 2023-10-14 00:11 Just set this up with LLDAP, Authelia and Trafik. ---------------------------------------------------------------------- Interesting_Argument · 2023-10-14 01:33 Thanks. Can you point me to any resources on best practices for home network segmentation? ---------------------------------------------------------------------- thekrautboy · 2023-10-14 01:38 Thanks! I should have been more clear, i meant http auth, not just any auth in general. ---------------------------------------------------------------------- Bagel42 · 2023-10-14 03:43 I recently setup Authentik, single sign on is awesome. ---------------------------------------------------------------------- MrSliff84 · 2023-10-14 05:44 I don't know how "hackable" nginx proxy manager or any service i host from my home network is. But you can add more layers of security on it than just having a login page. Starting from your home network, you are running a opnsense instance: - Put your web services in their own vlan and set up rules, that the services themselves can not communicate to each other or anything in your home network (sandbox them) - Use Cloudflare to hide your public ip and set up rules for ports 80/443 to only accept incoming traffic from the cloudflare proxy. This won't work for things like nextcloud it plex, since it violates cloudflares tos - set up pfblocker (don't know the service for opnsense) with öp blocklists to block at least some or most known malicious ip addresses scanning your firewall. - extra layer of security for login pages/brute force protection: Set up authentik in front of your services and profit from single sign on and multi factor authentication. With nginx proxy manager it's fairly easy to set up. Either your service already supports sso, or you set up forward Auth for your services. so you can use something like oauth/OpenID, saml, totp and user certs to authenticate with your services. All these authentication forms can be combined. It's even possible to use your phone to authenticate with your fingerprint. For services which support OpenID or saml, you can just deactivate normal user login, for the other services just use forward Auth. Once authenticated with authentik, you can access all services without authenticating again. Its even adjustable how long your login token is valid. I would go a way with a combination using user certificates and password or fingerprint. In the end, you are just a normal consumer and not a company. So for the average "hacker" there is not much benefit from hacking your services and even less when you provide some extra security. Only thing which comes in my mind may be a open VM which he could use for some thing like farm crypto or build some kind of botnet to run ddos attacks or some kind of script kiddie stuff. You already have opnsense running, so i assume you set it up in a proper way. You already have a more secure home network than 95% of the consumers out there. ---------------------------------------------------------------------- timothyclaypole · 2023-10-14 06:41 I don’t have any resources I use personally (I just bring my own professional experience home with me) but a quick search threw up this article which I think from a brief read makes a reasonable starting place. https://medium.com/swlh/basic-home-network-hygiene-network- segmentation-22f81791a264 ---------------------------------------------------------------------- SelectCase · 2023-10-14 22:26 VPNs can provide a false sense of security, unless you're the only person that accesses your self hosted services. Unless you very carefully segment off the VPN from the rest of your network, anyone that connects to the VPN is getting access to a large chunk of your network... Which at that point, your probably going to be using a both VPN and a reverse proxy. With the vast majority of modern attacks, "the call is coming from inside the house". You're far more likely to get ransomwared or added to bot net by an infected device a friend owns connecting to your VPN or even one of your own devices (I'm looking at you, suspicious smart TV or off-brand Android tablet). Don't get me wrong, a VPN can be a valuable tool to reduce attack surface, but it's not a substitute for appropriately protecting your own internal network from itself. I personally put services for me only behind a VPN, and services I share with friends behind a reverse proxy with two-factor authentication. The servers themselves are on their own VLAN protected by a fairly gnarly firewall against both the public Internet and my own internal network. ---------------------------------------------------------------------- SelectCase · 2023-10-14 22:55 You can set up a ton of complex stuff on your home network, but I'd just start with: 1. Make sure upnp is disabled on your home router. upnp is like wearing assless chaps, your butt is fully exposed. You don't want anything opening public facing ports on your router automatically. 2. Make sure your router firmware is up to date. 3. Use your guest net. Your smart home junk, IoT junk, smart TVs, and friends should be on the guest network. If you want to go extra careful and your router will let you have an additional VLAN, put your server(s) on their own special VLAN, and only access them via port forwarding from your own internal network. You could just stick everything else on your guest network instead, but I personally would rather have my servers more exposed to my laptop/phone instead of my laptop/phone being exposed up my smart TV or friends laptops. 4. Keep the OS and web server applications up to date on any server that serves the public Internet, patching at least monthly. 5. On your services, use at least two of these: * two factor authentication * fail2ban * Strong passwords * Login rate limiting These five steps are pretty easy to implement, and they'll block the vast majority of common attack vectors. If you're using docker, your can go a step further and make it so your applications only open ports on a docker network, and the only actual open port on the box is the reverse proxy. This obviously only works with http traffic, so stuff like DNS would probably still need to be open.