How secure is a vanilla install of nginx with .htaccess authentication? reddit / selfhosted ---------------------------------------------------------------------- Kilnarix · 2023-10-18 18:59 I have installed nginx on an Arch Linux VPS with Vultr. I intend to use it to serve files to myself and two colleagues. I have setup three accounts for us all with login names and passwords via the .htaccess and .htpasswd files. I will also be adding a certificate with let's encrypt before the server will be used. The data we will be sharing is commercially sensitive. Is there anything else I need to worry about? Is there anything else I can do to harden the server? ---------------------------------------------------------------------- myradishes · 2023-10-18 19:16 Do yourself a favor and use a commercial provider until you have an idea of that answer yourself. Or encrypt them before upload. ---------------------------------------------------------------------- zoredache · 2023-10-18 19:27 > Is there anything else I can do to harden the server? Depending on how sensitive your docs are, you could configure the server to only be usable when accessed via a VPN connection. ---------------------------------------------------------------------- ElevenNotes · 2023-10-18 19:29 A simple webserver secured by htaccess is not inherit insecure, but there are a lot of steps you can take to improve security further: Like proper authentication via OICD or something similar. Only access to the server via VPN, files encrypted, and so on. ---------------------------------------------------------------------- Spacelord09 · 2023-10-18 21:11 nginx doesnt know .htaccess files. You need to configure this in the nginx config. You can use a .htpasswd with some basic auth to get the job done. But I would use something like nextcloud for your usecase. If you need help with nginx config, just ask 😉 ---------------------------------------------------------------------- tjcooks · 2023-10-18 22:00 This is the way. If it's just private access for a few people, there's no reason to expose potentially insecure services to the open internet. Much safer than guessing if your config is secure. (Hint: nginx does not support .htaccess, so there's a start) But something tells me you all might be better off using dropbox or google drive or something where security is someone else's responsibility and you can use 2FA and there are password reset functions, enforcement of password strength, as well as customer support. Self-hosting corporate assets on a server hand-configured by a novice is a recipe for data breach. HTTP auth is fine behind SSL, but there are a million ways to mess up the config and expose your delicious data. ---------------------------------------------------------------------- gwillen · 2023-10-18 22:31 Personally, if correctly configured (and with a strong password), I treat this setup as more secure than anything more complex that I could assemble for myself. It's very easy to accidentally screw up the configuration. Nginx is generally reverse-proxying some other server; if that server is exposed in any other way than via Nginx, your security is gone. If you ever transmit the password over http (rather than https) by accident, your security is gone. If you are somehow treating the three accounts as separate within the underlying application, I wouldn't trust the security of that part; I only use nginx with htpasswd to gate security of single-user apps. If you're just serving static files, it's harder to mess up and most of these comments don't apply. ---------------------------------------------------------------------- Atlasatlastatleast · 2023-10-19 00:47 I’m not asking from a knowledgeable position, so bear with me if it’s a dumb question: Why don’t people use client certificates for this and restrict access to only clients with the certificate? It seems about as a VPN, and also is revocable, and a time expiry can be put on (I suppose that’s the case with VPNs too). They seem like rather similar solutions but I only see VPNs suggested ---------------------------------------------------------------------- PaulEngineer-89 · 2023-10-19 01:27 With SFTP? That’s actually pretty common and easy. But to some users creating a certificate and loading them over Ssh or SFTP is complicated. With Tailscale it already has clients for all your devices, is simple to configure on the web site, uses your device names, sets up security and penetrates NAT automatically, does file sharing as well as static web sites, Docker, etc. it’s just so easy. ---------------------------------------------------------------------- zoredache · 2023-10-19 01:49 > Why don’t people use client certificates The difference is that the client certificates are usually implemented as part of the web server. If there is a issue with either configuration, or bug in the web server, you potentially immediately can bypass the certificate requirement. On the other hand a VPN is often a completely separate piece of software, that is operating at the network layer. Another thing. If you run a simple port scan against the Internet it is easy to find http/https servers. Some VPN protocols that have been strongly configured will be more or less invisible to any kind of port scans. This eliminates a lot of the scanning and probing get for basically thing that is visible on the Internet. Not saying client certs don't have their place. Just not sure I would choose them, when I think a VPN provides stronger protection, and is potentially pretty easy to implement for a selfhosted environment. ---------------------------------------------------------------------- Atlasatlastatleast · 2023-10-19 01:59 What I meant, and perhaps I have a misunderstanding, is that I was under the impression that SSL could be configured such that it behaves in the way that's widely known - either a website is "trusted" because an authority has verified that the true owner owns it within a certain period of time - but also as second method more akin to SSH keys, wherein the server has one certificate, the client has a signed cert, and you can only access the server if you're in possession of a signed certificate on the device being used to access the site. [This digicert description](https://www.digicert.com/faq/public-trust-and- certificates/whats-the-difference-between-client-certificates-vs- server-certificates) matches mine, so I don't think I'm too far off but I'm missing something ---------------------------------------------------------------------- zoredache · 2023-10-19 02:08 > What I meant, and perhaps I have a misunderstanding, i Yes, I understand what you mean, and you don't seem to be misunderstanding how TLS client certificates function. But my point was, that usually it is web server is that accepts and validates the client certificate. A web server is externally visible, and so it is potentially something that can be attacked even if the attacker doesn't have a valid client certificate. ---------------------------------------------------------------------- lilolalu · 2023-10-19 07:30 I think it's main vulnerability is that nothing will stop a brute force attack by default. So a hacker-tool can indefinitely and very quickly try all variations of passwords. So JUST nginx and simple auth is not good I guess but If you add crowdsec or fail2ban to the mix, to slow down the attack by temporarily blocking IP's after N auth failures , I think it's an acceptable risk. ---------------------------------------------------------------------- lilolalu · 2023-10-19 07:31 It's very secure and very easy to establish. I think most people don't know or never thought of this way to secure access to webpages. ---------------------------------------------------------------------- Atlasatlastatleast · 2023-10-19 08:06 I appreciate the answer. It does indeed seem easier to spin up a VPN, and I remember having when creating a VPN on Pfsense, there was a little checkbox that said something like “check client certificates?” I also have seen this on HAProxy. If that checkbox weren’t, well, checked, I presume that would then allow anyone to access the server, as you mentioned. I would hope someone implementing either one tested it, but just about everyone has used a VPN before, so there’s familiarity. Additionally, I am thinking about how many organizations would grant access to multiple servers and other resources in network, and ensuring certificates are installed on each server appropriately, as well as the clients, would suck - running a vpn on the firewall sounds like more time to ~~fuck around on Reddit~~ ensure secure and efficient use of company hardware for any admin