About the security of self-hosting reddit / selfhosted ---------------------------------------------------------------------- efitzpercy · 2023-11-04 14:53 Hi all, I recently have been reading about self hosting NextCloud. While setting it up though, on the github instructions it says that certain ports (80, 8080, 433)needed to be forwarded if I want it to be accessed remotely (which I do) so I did it ( port 3478 I did not because I don't need Talk). I have successfully set it up ultimately with Docker on Ubuntu. However I was wondering how safe this a vanilla AIO NextCloud setup is considering I know am new to this. I scanned my domain here [https://scan.nextcloud.com/](https://scan.nextcloud.com/) and it came back A+ even though I didnt do anything any of the extras mentioned here [https://docs.nextcloud.com/server/latest/admin\_manual/installat ion/harden\_server.html](https://docs.nextcloud.com/server/latest/admi n_manual/installation/harden_server.html) , only what was required during setting it up. Should I believe the A+ score im getting? Or is it more of a marketing thing to comfort users to using nextcloud more? The only users of nextcloud would be my family and I. I definitely plan on setting up 2FA. Will this be enough? Running Nextcloud **27.1.3.2** via Docker on Ubuntu on a Mac. Used a domain from DuckDNS. ---------------------------------------------------------------------- georgegigantic · 2023-11-04 15:08 the usual workflow is * expose only ports 80 (http), 443 (https), 51820 (wireguard vpn if needed) * route 80 and 443 to a reverse proxy e.g. NPM (easiest), swag, caddy, traefik etc * point reverse proxy to NextCloud * never expose your services directly i.e. always go through a reverse proxy * layer your exposed services behind SSO e.g. authelia, authentik etc if privacy is not a concern, you can consider going through cloudflare tunnels which is a shortcut for all the above steps. however, your data will be unencrypted and cloudflare is able to see ALL your data ---------------------------------------------------------------------- Eirikr70 · 2023-11-04 15:31 In addition to u/georgegigantic's excellent advice, I would recommend adding an intrusion detection system such as Crowdsec. ---------------------------------------------------------------------- georgegigantic · 2023-11-04 15:52 yes!! hands down. swag covers you with fail2ban as part of the default package. but there's a docker-mod available for you to replace fail2ban with crowdsec. highly recommend ---------------------------------------------------------------------- redditorforthemoment · 2023-11-04 16:35 george’s comment covers most everything you should be doing. Any service you’re exposing should be done through a reverse proxy as it’s much more scalable and easier to manage if you decide to expose anything else in the future. It also offers easier management of things such as SSL certificates and managing client access. As for Nextcloud’s A+ rating, I wouldn’t put all of your confidence in it. It is great to check as it will always give you an idea if you’re following best practices per Nextcloud’s recommendations, but at the end of the day any piece of software will have vulnerabilities and placing complete trust in the developers will lead to something being compromised. Hiding this stuff behind a VPN is usually the best choice, I know Wireguard will auto connect if you’re not on a whitelisted network so you won’t need to do anything if you’re outside of your network. OpenVPN may do this as well, I just haven’t used them in a few years. If you’re sharing Nextcloud with other users it would be best long term to look in to a VPN or fine-grained access controls. I personally don’t expose Nextcloud to the greater internet outside of share links, which the reverse proxy handles based based on path URI. P.S. I also run the AIO container, and if I remember correctly 8080 is the AIO management interface, which I really do not recommend exposing to the WAN. ---------------------------------------------------------------------- acid_etched · 2023-11-04 16:53 When you open ports on your router, you’re moving trust from the router (nothing can get in because no ports are open) to whatever service you’re running (nothing can get in because x service is secure). This can be ok for single services that you trust, but if you want to grow it can become unmanageable. The nice thing about a reverse proxy is that there’s one entry point, the reverse proxy, for as many services as you’d want to run. This means the only one you really have to trust is your reverse proxy, as long as you have something like fail2ban or crowdsec set up. ---------------------------------------------------------------------- gangstaPagy · 2023-11-04 17:44 I use tailscale to access my Nextcloud instance, saves me opening up ports or messing with a reverse proxy. ---------------------------------------------------------------------- autogyrophilia · 2023-11-04 18:14 Yea. No. This assumes your reverse proxy sanitizes the payload it passes through. And to a point it does. Any attack that relies on flaws on HTTP, QUIC or TCP will probably be cleaned as the connection it's reassembled. But it will happily pass through exploits, brute force attempts and all other nasties if there is no additional configuration. The easiest one it's putting all that behind MFA. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-04 18:18 What is it you want to accomplish by exposing your services through a reverse proxy in regards to security? If everything else is blocked except your services I don't see what this contributes to. NextCloud vulnerabilities aren't going to disappear just because you expose it through a proxy. ---------------------------------------------------------------------- Jims-Garage · 2023-11-04 18:48 An A+ rating is good, but doesn't mean a great deal compared to other things (e.g., you still need MFA, strong passwords, principal of least privilege etc which won't be assessed in a SSL labs test). I never recommend exposing services unless you need to, TrueNAS and Proxmox are prime examples of things you don't want to expose directly. Wherever possible use a VPN like WireGuard, or if you're behind cgnat try something like Headscale. ---------------------------------------------------------------------- krimsonstudios · 2023-11-04 19:24 Hides your services from general IP scanning. The IP scan would find Nginx on port 80 and 443 but can only get through to Nextcloud if you know the specific domain that forwards on to it. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-04 19:29 It doesn't matter. Wireguard would be exposed on one of your other IPs, and in the event of compromise it would be on the host driving the workloads anyway. Using a reverse proxy has benefits from an operational perspective but the idea of never exposing NextCloud directly without a reverse proxy doesn't make sense. ---------------------------------------------------------------------- Reverent · 2023-11-04 19:44 Wireguard is UDP and requires a knock to respond, it's functionally closed to scans. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-04 20:01 I don't agree. If you would expose NextCloud without TLS of course it would be an improvement to make a reverse proxy handle it (as long as you terminate TLS after transmitting over untrusted networks), but I believe NextCloud can handle TLS by itself. It's just as discoverable no matter what, if you take CT (Certificate Transparency) into account even more so. Please elaborate. ---------------------------------------------------------------------- Reverent · 2023-11-04 20:12 So if you install nextcloud with certbot and use let's encrypt to provide the certs to nextcloud's Apache instance, you'd be right. https://help.nextcloud.com/t/how-to-get-certificate-with-letsencrypt- using-dns-to-verify-domain/126329 Sounds pretty complicated though. Or you can use self signed certificates generated yourself if you happened to do it right, and not let through the literally hundreds of misconfigurations possible with certificate generation. Oh but if you get man in the middled you would have no idea because it's not a trusted certificate. Or you can use caddy and fix all this with one line: `reverse-proxy nextcloud:8080`. ---------------------------------------------------------------------- Gabe_Isko · 2023-11-04 21:15 You generally implement security controls on the reverse proxy. SWAG comes with fail2ban pre-configured for example. ---------------------------------------------------------------------- th3pleasantpeasant · 2023-11-05 00:11 I used fail2ban with swag reverse proxy and duckdns in the past. It was very effective and also allowed me to host other services like airsonic, jellyfin, Plex and Nextcloud etc by only opening up 2 ports on the firewall...80.and 443. Then along comes cloudflare tunnels and it changes everything. No port forwarding required. Have a look at it. It's free ---------------------------------------------------------------------- AbdulmalekA · 2023-11-05 00:57 my ISP router wont let my open any ports , is your setup require opening ports ? currently using cloudflare tunnels . ---------------------------------------------------------------------- th3pleasantpeasant · 2023-11-05 01:01 When using swag, yes. Ports 80 and 443 needed to be forwarded when using nextcloud and some other services. When using cloudflare tunnels, no ports need to be forwarded ---------------------------------------------------------------------- Omni__Owl · 2023-11-05 01:54 The one caveat is that Cloudflare can read anything you pass through their tunnels. ---------------------------------------------------------------------- lilolalu · 2023-11-05 11:51 You don't have to put an extra proxy in front of Nextcloud because the docker already contains a proxy server. There are a couple of things you can do inside of Nextcloud to enhance security: - enable a reasonable user password policy in Nextcloud - enable the brute force settings - enable native NC encryption or encrypt the volume that holds the files from nextcloud - enable built in 2FA in Nextcloud, it supports TOTP his authenticator but also other services like signal, telegram etc. In terms of extra external security, you can run crowdsec with Nextcloud to block malicious login attempts. https://www.crowdsec.net/blog/install-and-secure-your-nextcloud- server-with-crowdsec Generally speaking, if you enable the built in security features of Nextcloud, only open the required ports 80/433 you are fairly safe. ---------------------------------------------------------------------- efitzpercy · 2023-11-05 15:01 this is good to hear... ---------------------------------------------------------------------- efitzpercy · 2023-11-05 15:01 8080 now disabled. Thank your for your advice ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-05 17:56 Yes, terminating TLS on a reverse proxy makes life easier. Even more so with web servers like Caddy that you mentioned. Using a self-signed certificate isn't limited to any of these setups. They shouldn't be used in any case because your client can't establish trust with something that hasn't been signed with a key that's in your trust store. Reverse proxies are not a magic cure to this, and it doesn't protect against portscans. I'm not saying reverse proxies are a bad idea. But it is a false claim that it improves security by itself. Sometimes the opposite, because a faulty configuration (cache keys in cloudfront comes to mind), request smuggling, header poisoning or just the fact of introducing more software that could be prone to additional issues. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-05 20:58 Yes, but then you need to implement that. It's not a feature of reverse proxies in themselves. And just to be a pain in the ass and try to prove my point ;) Introducing new software and thinking of security as a product isn't always the answer. CVE-2021-32749 and many others are proof of that. I promote reverse proxies in a homelab for operational ease and privacy reasons primarily. If your nextcloud, immich, jellyfin or other typical selfhosting software gets some high severity vulnerability a reverse proxy at its core is not going to help you. But it's a good place to implement security controls, whatever it may be, rate limiting, tls authentication, geoip blocking, ips, etc. ---------------------------------------------------------------------- Gabe_Isko · 2023-11-05 21:22 So the difference is semantic. Either crowd security is a part of your security posture, or it is a separate issue from patching vulnerabilities in software. I mean, you asked. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-05 21:29 You're correct, but we're reaching into other areas of this discussion. My primary criticism is to the idea of "never expose your service directly".