Managing security risks from unmanaged device access reddit / selfhosted ---------------------------------------------------------------------- Big-Finding2976 · 2023-11-07 09:21 I'm not planning to allow public access to my server. There will be another server at my Dad's house which will connect via Tailscale and sync data, and I don't have any concerns about that as I'll manage both servers and can tightly control what is running on them. Anything that provides external access will be running under Docker Compose/Portainer. My concern is with unmanaged devices, like my family's PCs and Android phones, where I have no control over what is installed on them. I want these devices to be able to access the server via Tailscale so they can store photos, notes, etc. but I'm worried that some malware on them could take advantage of the Tailscale connection to access/delete files on the server. How do you make sure that can't happen? ---------------------------------------------------------------------- HearthCore · 2023-11-07 09:45 You could restrict access to services to MAC addresses and maybe use another Auth method with 2FA Other than that, the end user is always the weakest link. I-e. If one device is compromised with network access and stolen passwords.. that it, therefore restrict access and have a good backup solution in addition to your dublication setup ---------------------------------------------------------------------- Big-Finding2976 · 2023-11-07 09:54 MAC addresses won't help because the threat comes from the authorised devices. 2FA for each service might be the answer, as the malware won't have the credentials to pass that. It's difficult to know how big the risk is. With the phones, people install all kinds of free games without considering that they might be paying with their privacy by the app harvesting data, but I believe with recent Android versions, the apps are isolated from each other and can't access data entered into or stored by another app. So the risk might be bigger with Windows PCs in theory, as they don't have this isolation, but people are less likely to install random free games so maybe in practice the risk is minimal. ---------------------------------------------------------------------- HearthCore · 2023-11-07 10:00 The Mac address filtering was for when you setup static routes to your hosted devices in your relatives network. I.e. I have 3 networks in my home, co signed Internet with another party. I have one router that I own, it’s wan port is connected to the isp router and my router hosts its own subnet From that subnet I have my ProxMox main machine reachable, which hosts a vm router and services on another subnet - plus the same setup for my IoT stuff that does not need to phone home etc. Additionally to security through obscurity ( not setting the gateway to my router on the ISP, therefore manual setup needed to reach subnets) I run a mac filter for ingress on internal traffic and every service is behind a SSO/w 2FA gateway before the reverse proxy ---------------------------------------------------------------------- Big-Finding2976 · 2023-11-07 10:23 I'm not saying MAC address filtering is pointless. It makes total sense to limit access in this way if you only need a few specific devices to have access (as I do). It just doesn't protect against malware that is running on one of those devices. ---------------------------------------------------------------------- EriksonEnterprises · 2023-11-07 11:30 If you setup your server right you shouldn't have to worry about that... Attacks like that go after the device OS itself, not necessarily the Tailscale. But it can obviously affect the data inside of Tailscale Basically what happens is, it uses the connection to infect the device itself, and then goes from there to cause damage Prime example is Windows. When you're browing the internet, nothing happens to any of your stuff on your device. Nobody even sees it... Until your device itself gets infected, at which point they could gain access to your stuff. It starts at the OS level before it hits the file/program level