Remote Access Good Practice reddit / selfhosted ---------------------------------------------------------------------- MerkaMatt · 2023-10-15 16:04 Hi all, In the past few months I've started to dip my toes into the world of self-hosting and have slowly added more and more functionality to my home box, starting with a CLI debian install hosting a minecraft server for some friends, to a full-blown ProxMox instance with a ZeroTier bridge, NAS, and a Windows 10 VM with a direct GPU pass- through for game streaming and RDP to use various programs on slower remote systems (Raspberry Pi, netbook laptops, etc.). As it stands, I'm very happy with my system's functionality, though as someone who's new to the world of self hosting, I've been very wary (and often confused) about safe practices from a security standpoint. Currently, the only direct external ports I have open are for RDP (which is obfuscated on a non-standard port), and the port for a Minecraft server, though this is run through an external service to prevent against DDoS and other similar attacks. The RDP port is open as I have my server setup for family and friends to use, and I want them to be able to access it with their own respective logins without needing to worry about a VPN service. For myself, my ZeroTier bridge is what handles SSH access to my ProMox containers, as well as access to my NAS, which I can mount directly as an SMB share once connected to the ZeroTier network (this is setup via a TurnKey Linux Filesharing LXC). This works more or less flawlessly for me on my personal devices, however, I want to open this up for family and friends to access too on their respective computers without needing to worry about configuring the ZeroTier client on their machines. TKL's FileSharing container has a great webservice built in, though it seems like its security (or lack thereof) is [rather readily exploitable](https://null-byte.wonderhowto.com/how-to/exploit-webdav- server-get-shell-0204718/) if opened up, so I'm hesitant there. My question- is there \*any\* way for me to safely open these external services up at the "login prompt" level for others without them needing to mess with VPN services? As set up with RDP and TKL's local samba share, I'm comfortable setting up different logins with respective permissions. Or is this just generally regarded as something you shouldn't do due to the risks involved? I already have a domain setup and pointed to my public IP (via No-IP on my router so it's able to keep it updated), so if that adds options to what I can do I'm able to configure it as such. Cheers! ---------------------------------------------------------------------- No_Requirement_64OO · 2023-10-15 16:36 I think most convenient way which involves some security is wireguard. Check wg-easy, it is convenient to create config parameters via web interface and import them on client devices (you only need to take care of your wg server ip subnet not to be common one like [192.168.1.0/24](https://192.168.1.0/24) which may match their local subnet - this is in case you want to use split tunnel at their end). If you do not want wireguard, check Guacamole. If you need better performances I read KASM is providing them (I have no experience). RDP open port on public interface is disaster waiting to happen... ---------------------------------------------------------------------- e92coupe · 2023-10-15 17:04 ( I am not a professional, but I heard things from friends ) If you want to know how enterprise do it: I think they use reverse- proxy. So have you set up the reverse proxy? If you want to know what's the best practice, I think the answer is don't open up anything. Just don't do it. If you want to share some compute/storage/videos, buy commercial accounts and share your subscription. ---------------------------------------------------------------------- ianskoo · 2023-10-15 18:00 In my limited knowledge, I'd say for security go VPN or VPS. There is an easy installation script on GitHub for OpenVPN which also allows you to generate keys for people to connect to it. Then it's as easy as telling your friends and family to download the OpenVPN client and add their key (a file) to it. ---------------------------------------------------------------------- zfa · 2023-10-15 20:47 Holy shit dude, get that RDP port closed. You shouldn't expose RDP nor SMB directly. If you don't decide to go the VPN route (connect to that before using those services) then you need to give out your requirements before we can give suggestions... E.g. remote desktop might be better served by spinning up a webtop or KASM. Or maybe MeshCentral / Guacamole depending in exactly what is being accessed. As for for sharing, well there's MeshCentral again as week as things like FileBrowser and FileRun if you're heir with a webui, or SFTP- based solutions. Maybe even SyncThing but all depends on the use cases. GL. ---------------------------------------------------------------------- MerkaMatt · 2023-10-15 22:49 The SMB exposure I’d figured was a bad idea, hence why I hadn’t done anything on that front yet. The RDP exposure is something I’ve gone back and forth on for a while, as one of the primary reasons I wanted it externally facing was to be able to have access to a personal machine from any other computer. I.e., a friend’s laptop if I’m at their house, a computer at my university or a library, a phone or a tablet, etc. That is functionality I’ve used a lot in the year and a half or so I’ve had it setup, and has been very convenient having access to a high-power system with all of my software and files on it. Guacamole is something I’d looked into- though it definitely seems like there are compromises over the standard RDP apps available, which I’ve used across all types of devices and am happy with. Where I’m sitting now is knowing that the “correct” way is to shut everything off and just ‘use a VPN’ as I’ve been told before, though it’s definitely disappointing to have to choose between functionality and security in this case. ---------------------------------------------------------------------- zfa · 2023-10-15 23:48 You don't have to choose between functionality and security though. You just have to use different tools more suited to the tasks at hand. We all have different requirements when you get down in the weeds but as an example I use MeshCentral to access my home devices securely. Works from any browser anywhere I sit. I've not lost functionailty by not using RDP, I'm just using something more fit for purpose. ---------------------------------------------------------------------- veyper · 2023-10-16 04:19 Go checkout tailscale, don't open ports, just create your own network. If you're using proxmox already, create a container that runs tailscale and automagically pulls in your internal network as if you were physically there. ---------------------------------------------------------------------- ProffesionalAds · 2023-10-16 09:05 I will go with this all day long (Tailscale or [Netmaker](https://www.netmaker.io/)) which do not require one to open ports thus more secure.