Securely but reliably self-hosting Vaultwarden? reddit / selfhosted ---------------------------------------------------------------------- fmillion · 2023-10-30 20:55 Lastpass is out. Aside from all the ongoing issues with vaults being decrypted, I just canceled my paid subscription only to discover the free account is basically useless for anyone who actually uses technology (they limit you to either computers *or* mobile devices). I've successfully gotten a Vaultwarden instance running and it works great. But I have a few concerns: * Right now the vault is hosted on my LAN, and I use a VPN to connect to my LAN from my mobile devices as needed to access other internal private services. The problem I see here is that if my LAN goes down for some reason, I might not have access to my passwords... * I thought about hosting the vault on one of my cloud VPS's. However I don't feel as secure having the instance "flapping in the breeze" ready as a target for the first exploit that's found in the server. I strongly prefer the idea of it only being accessible via some sort of VPN. * So, I thought I can just run a VPN on the VPS itself like I do with my home LAN right now, but then I realized my second concern is that if something were ever to happen to me, even temporarily (say I end up hospitalized), *my VPS will just shut off* as soon as payment isn't received on time and all the other family members who might need to use the instance (e.g. to access my passwords) will be out of luck. * The problem with requiring a VPN to get to the VPS or to my LAN is that I can't use the "give someone else access if I become incapacitated" options. I doubt my mom will ever remember how to activate the VPN and get into the vault, for example. (Not to mention I'd like to be able to offer family accounts on the instance as well, but I still am not sure how I feel about a Vaultwarden instance just sitting there on an open HTTP server.) For those who self-host Vaultwarden (or even the official Bitwarden server), how do you do it securely and reliably? I know there isn't much to be done about the "it goes down if I don't pay" option other than setup autopay and hope it'll be able to withdraw from your account in your absence, but what about security in general? It *really* smells bad to run a known password-storing server out on the public Internet for easy scanning and infiltration, plus it just makes your host a *prime target*... ---------------------------------------------------------------------- Sky_Linx · 2023-10-30 21:17 Bitwarden is one of those things that aren’t worth self hosting. The premium service is just $10 per year so if you are asking questions about security, I’d recommend you just use that. ---------------------------------------------------------------------- sk1nT7 · 2023-10-30 21:31 - regular patch and release management - exposure via reverse proxy with hardened TLS and https only - 2FA for all user accounts required - strong password policy for your organization - Disabled admin panel or at least very strong password - Email notifications about new device logins - Geo blocking and WAF by Cloudflare or other means - Fail2ban for intrusion detection (login bruteforce) - Disabled password hints - Optionally: Do not expose at all and use a VPN or put another authentication wall in front such as Authelia or Authentik. In the end, the vault is encrypted on rest. So even if an attacker obtains somehow code execution on the server or the vault data itself, he cannot do much with it, if we assume a strong master password. 2FA ensures that attackers cannot just login with obtained credentials. Furthermore, I doubt that someone will waste a 0-day vulnerability for your private instance to target you specifically. Most attacks work due to outdated software and lazy developers/hosters. Additionally, most attacks require some form of user interaction or specific conditions. Only a few are very severe one-click, unauthenticated vulnerabilities that can cause real havok. It is more likely that you click random stuff on the Internet and your PC gets infected. And even then, attackers will likely watch out for banking credentials stored in your browser in clear text or just crypto-lock your files and demand ransom. Just apply common sense and understand what you are doing and exposing. If you do not feel safe in exposing stuff, keep using VPN only or outsource something crucial like a password manager to a SaaS platform like bitwarden.com. No shame in it. ---------------------------------------------------------------------- gioco_chess_al_cess · 2023-10-30 21:39 My instance is publicly accessible. Even if you get compromised, the database is encrypted through the master password so it is no use for the attacker. The fact of having the vault accessible over the internet instead of using a VPN makes it available in an emergency and you are not risking much in any case. The nice thing with vaultwarden is that you cannot mess up more. Once you have a strong master password and a recent export of the vault (both of which you should have also with managed bitwarden) you can sleep without concerns. Concerning backups, I make them daily for the server database and at least monthly for the vault export. ---------------------------------------------------------------------- esturniolo · 2023-10-30 21:40 “If my LAN goes down for some reason, I might not have access to my passwords” This is not entirely true. Meanwhile you don’t log off in your device (even browser extension), you will have access to your passwords even you LAN explodes. The only downside is if your LAN is down, you can’t add/edit any entry. You will have access to everything but in read only mode. ---------------------------------------------------------------------- tech2but1 · 2023-10-30 22:04 > Disabled admin panel or at least very strong password If you've got your vaultwarden instance sat behind a reverse proxy you can set access to the /admin path to be LAN only to give another level of security here. ---------------------------------------------------------------------- ScribeOfGoD · 2023-10-30 22:36 “Not worth self hosting” why is anything worth self hosting? Because we can/want too. Why host DNS with google, cloudflare, quad 9? Because we can and it allows us to do our own thing. Why pay 10$ for something you can self host when you’re already hosting things? ---------------------------------------------------------------------- junialter · 2023-10-30 22:48 That is true, but if you do not log out, you can access your data with only one factor, which is your password. I do not consider that secure enough. So you need to make a tradeoff between security of data and availability. ---------------------------------------------------------------------- tech2but1 · 2023-10-30 23:13 I selfhost lots of things, and do keep adding more security as it becomes available. In the olden days remote file access was FTP just available on default ports on the WAN! Most of the stuff I host is just for me and simply sits behind NPM which does the SSL termination. Behind this I have just added OPNSense for some geoblocking and IDS, but actually there's more than that once you start. You can add CrowdSec (like fail2ban but easier to set up across multiple services) so you're already several layers deep on security before you're even at the door of your vaultwarden interface. If you have family accessing the services you offer then you need to make it as simple and smooth as possible. This is why I have these things in place, they can simply connect to the shared file services/password manager etc just like they would any other service, like Google Drive or LastPass etc. No point making it complicated and hard work for them, they'll just learn to hate doing things properly! ---------------------------------------------------------------------- SammyDavidJuniorJr · 2023-10-31 00:03 I install Tailscale on every device that needs access to the passwords. So family computers, phones, etc. I run Vaultwarden and it's only accessible via the Tailscale network. https://github.com/dani-garcia/vaultwarden ---------------------------------------------------------------------- DopeBoogie · 2023-10-31 00:41 Ehh, I don't see how it's one-factor? Your password is one. The other is "an existing device already logged into the account" If anything its a stricter requirement than what you'd typically think of as 2fa. It still fits the definition: Password is "something you know", the device which is logged in already is "something you have". ---------------------------------------------------------------------- caffeine947 · 2023-10-31 01:21 This is the way ---------------------------------------------------------------------- _avee_ · 2023-10-31 01:30 Do you normally do a full logout every time after using password manager? If not, there is no difference between “LAN is down” scenario and normal usage. ---------------------------------------------------------------------- natermer · 2023-10-31 01:54 localhost is always going to be single point of failure. you could have 40 factors authentication and it really isn't going to make any realistic difference versus making sure you use a unique and meaningful password. If a attacker has access to your desktop and you log into your vault, or anything else, they can just capture what you are doing and/or do session hijacking. This is a very common misconception about the benefits of 2fa. ---------------------------------------------------------------------- ZaxLofful · 2023-10-31 02:23 !remindme 1 month ---------------------------------------------------------------------- RemindMeBot · 2023-10-31 02:24 I will be messaging you in 1 month on [**2023-11-30 02:23:52 UTC**](ht tp://www.wolframalpha.com/input/?i=2023-11- 30%2002:23:52%20UTC%20To%20Local%20Time) to remind you of [**this link **](https://www.reddit.com/r/selfhosted/comments/17k3gio/securely_but_ reliably_selfhosting_vaultwarden/k76flgu/?context=3) [**CLICK THIS LINK**](https://www.reddit.com/message/compose/?to=Remin dMeBot&subject=Reminder&message=%5Bhttps%3A%2F%2Fwww.reddit.com%2Fr%2F selfhosted%2Fcomments%2F17k3gio%2Fsecurely_but_reliably_selfhosting_va ultwarden%2Fk76flgu%2F%5D%0A%0ARemindMe%21%202023-11- 30%2002%3A23%3A52%20UTC) to send a PM to also be reminded and to reduce spam. ^(Parent commenter can ) [^(delete this message to hide from others.)] (https://www.reddit.com/message/compose/?to=RemindMeBot&subject=Delete %20Comment&message=Delete%21%2017k3gio) ***** |[^(Info)](https://www.reddit.com/r/RemindMeBot/comments/e1bko7/remind mebot_info_v21/)|[^(Custom)](https://www.reddit.com/message/compose/?t o=RemindMeBot&subject=Reminder&message=%5BLink%20or%20message%20inside %20square%20brackets%5D%0A%0ARemindMe%21%20Time%20period%20here)|[^(Yo ur Reminders)](https://www.reddit.com/message/compose/?to=RemindMeBot& subject=List%20Of%20Reminders&message=MyReminders%21)|[^(Feedback)](ht tps://www.reddit.com/message/compose/?to=Watchful1&subject=RemindMeBot %20Feedback)| |-|-|-|-| ---------------------------------------------------------------------- kindrudekid · 2023-10-31 02:34 Standard Security practice + swag + Authelia or Authentik + crowdsec. If you reallly wanna go the length, setup a PKI infrastructure. ---------------------------------------------------------------------- PaleMongo · 2023-10-31 02:42 > The problem I see here is that if my LAN goes down for some reason, I might not have access to my passwords... Regularly back up your Vaultwarden data. If necessary, import this to KeePass should your docker system break. ---------------------------------------------------------------------- betahost · 2023-10-31 04:56 Selfhost Vaultwarden using CasaOS with Tailscale.com agents for vpn ---------------------------------------------------------------------- LNDN91 · 2023-10-31 05:22 To support the program. 👍🏽Same reason people pay for nabu instead of vpn-ing or reverse proxy. ---------------------------------------------------------------------- Developer_Akash · 2023-10-31 06:35 \> The problem I see here is that if my LAN goes down for some reason, I might not have access to my passwords ​ Not entirely true, you will still have read-only access. I had a similar concern when I thought about self-hosting password managers. So I started a [discussion regarding the same here](https:// www.reddit.com/r/selfhosted/comments/16qze9a/do_you_selfhost_password_ manager_on_premise/). Learned a lot of new stuff from the folks discussing here, take a look once, might help answer some of your queries as well. ---------------------------------------------------------------------- bufandatl · 2023-10-31 06:43 Have a look at cloudflare tunnel. You still have vaultwarden in your lan but accessible from the world. No open ports needed. ---------------------------------------------------------------------- Karbust · 2023-10-31 08:17 I have mine public, strong master password and 2FA enabled. The admin panel is also public with a very strong password, no one is breaking that in many life times. About the database I’m not worried, only accessible locally or through SSH tunnel that only accepts authentication via private key. I’m also using cloudflare, the subdomain is available for my country only, unless when I travel, then I disable it. ---------------------------------------------------------------------- killermouse0 · 2023-10-31 08:40 Those are all super relevant would you have any recommendations for implementing geo-blocking without relying on an external service by any chance? ---------------------------------------------------------------------- sk1nT7 · 2023-10-31 08:42 Depends on your used reverse proxy. I personally use Traefik and there are geo plugins that can solve this. https://plugins.traefik.io/plugins/62947302108ecc83915d7781/LICENSE For other reverse proxies like nginx there are also addons: https://docs.nginx.com/nginx/admin-guide/security- controls/controlling-access-by-geoip/ ---------------------------------------------------------------------- killermouse0 · 2023-10-31 09:14 I've actually just started using Traefik, so this is awesome! Thanks! ---------------------------------------------------------------------- saibot0224 · 2023-10-31 13:26 I've been selfhosting VaultWarden for about 4 years and it's been fantastic. I've installed Docker in an Ubuntu VM in Proxmox. I do weekly snapshots of my all my VMs and LXCs via the Proxmox GUI. I also backup my docker volumes to an offsite backup and rsync my Vaultwarden volume to Google Drive. In terms of access, I run a Nginx reverse proxy instance dedicated solely for internal services and Vaultwarden is only accessible only through Wireguard on my devices. A lot of people use Tailscale as well for this. It's simple and more secure than exposing it to any WAN traffic passing through port 443 or port 80. I have a handy shortcut automation I use on my iPhone. When I open up the Bitwarden iOS app, I have my phone automatically connect to my Wireguard VPN to sync any new changes to my passwords. When I close Bitwarden or switch to another app it automatically disconnects from it. ---------------------------------------------------------------------- digitalindependent · 2023-10-31 13:34 Your local bitwarden apps „only“ sync with your vaultwarden. So if you‘re not adding and changing multiple entries every day you can just endure an outage of a few hours or even days until you reconnect and sync. That said, I am very paranoid about hosting my password manager on a publicly available VPS. The VPS provider theoretically has access and if you don’t secure the VPS properly everybody else, too. So I make VW only accessible via a VPN (wireguard) and only host it locally on a pi. That is also backed up to another pi (Borg with borgmatic). For me this is a good mix of redundancy, access control and attack vector mitigation. ---------------------------------------------------------------------- ambricks · 2023-10-31 14:29 The iOS shortcut to connect to VPN when opening BW will be very useful to many. Will you mind sharing the shortcut? Thanks. ---------------------------------------------------------------------- saibot0224 · 2023-10-31 17:26 It may be a bit sloppy but I'll share! Make sure you have a Wireguard VPN tunnel already added to your iphone and verify that it works by manually connecting to it and opening Bitwarden and manually syncing to see if it successfully does it. I create two shortcuts and two automations in the Shortcuts app.   The first shortcut is Called Connect VPN. I first use the Get Network Details Block to get Wi-Fi network's Network name. Then I use an if block and there are 3 fields in it. In the first field select the variable Network Details. The second field is set to "is not" and then in the third field enter your home ssid (wifi network name). Nested under that is a Set VPN code block with two fields. First field is set to Connect and the second field is set to my Wireguard VPN. Then I delete the otherwise block and make sure that the final code block is an End If statement.   The second shortcut is Disconnect VPN and it's exactly identical to Connect VPN except it's Disconnect instead of Connect in the Set VPN codeblock. Here's what the shortcuts should look like: [example](https://i.imgur.com/gGXrvhj.jpg)   For the automation, go into the Automation tab in the Shortcuts app and create Two Automations. For the first one, when the App Bitwarden is open, trigger the shortcut Connect VPN. For the second one, if Bitwarden is closed, trigger the shortcut Disconnect VPN. I have the automations set to "Run Immediately" ---------------------------------------------------------------------- ambricks · 2023-10-31 17:27 Thank you, I’ll give it a try in a bit. ---------------------------------------------------------------------- Steeler_Train · 2023-10-31 17:59 My issue with Vaultwarden is ssl locally. I couldn’t figure it out to save my life ---------------------------------------------------------------------- wickedswami215 · 2023-11-01 01:12 IIRC I got a duckdns domain, set the ip to be my server's lan ip, and used a dns challenge on nginx proxy manager for my local ssl. Hope this helps ---------------------------------------------------------------------- CYCLONOUS_69 · 2023-11-01 01:19 I have successfully hosted Bitwarden on my unused laptop and no one was willing to buy it (typical Indian mentality). I run my laptop 24x7 with other applications and softwares on it while keeping it plugged to the wall. I have configured CloudFlare tunnel to Bitwarden so I can access it outside of my local network without any issues. You just have to get a domain. I have configured my firewall on the server and the router to prevent unautorized access or DDoS. I have deployed Bitwarden using Docker-Compose according to official method which just works fine without any issues. I did look into Vaultwarden but I always prefer to stick with offical docker images. ---------------------------------------------------------------------- Ariphaos · 2023-11-01 01:31 Are you trying to have Vaultwarden communicate to your reverse proxy via SSL (through Rocket) or are you having trouble setting up SSL on your reverse proxy? The latter is much easier and much more reliable. ---------------------------------------------------------------------- 0xvino · 2023-11-02 19:19 U can self host, that's great. But payin 10$ to support a great project is a great idea too. ---------------------------------------------------------------------- ambricks · 2023-11-05 02:07 u/saibot0224 Thank you for the detailed description of the shortcut. I was able to recreate it on my phone. Cheers. ---------------------------------------------------------------------- htims05 · 2023-11-08 22:11 Wireguard has an option on iOS to connect automatically if not connected to specific wifi SSID's...I set mine up to auto connect if I'm not on my home wifi or any other trusted SSID i frequent. I also have all traffic going through wireguard so when I leave my house, my phone automatically connects to the VPN...then everything else just works since I'm within the LAN.