Security and exposing apps reddit / selfhosted ---------------------------------------------------------------------- Joyfulsinner · 2023-11-09 17:51 I recently figured out reverse proxies and I have several apps that I want to expose for ease of use for family members. I have found authelia and thought I could set that up as an extra protection against suspicions activity but after thinking about it a bit more I realized that the apps I want to expose already have user accounts and passwords so it would make things a bit more annoying when logging in. plus would authelia even work if the user is using a phone app instead of the web browser? What are your ways of keeping your servers safe from suspicious activity or even monitoring them for suspicious activity ? Before this post gets blasted with "just use a VPN" Yes I already have wireguard up and running but trying to get family members setup with a vpn that are technology illiterate is a nightmare ---------------------------------------------------------------------- mztiq · 2023-11-09 19:49 Authelia is a good start, but I'd always combine it with VPN or even start with VPN only. I wrote a blog post on both topics ([Wireguard](https://dizzytech.de/posts/wireguard/) / [Authelia](https://dizzytech.de/posts/authelia/)). I'd honestly never expose services without VPN. ---------------------------------------------------------------------- nyrosis · 2023-11-09 20:08 One powerful trick is to make use of the access lists in something like NPM. That way you define what can even connect at all to the proxy manager. It's not too difficult to figure out what public ip range something like your phone, your isp at home, your isp at work is using. Even if the address is dynamic you can figure out the public range being assigned. Allow those ranges and deny everything else. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-09 20:12 > would authelia even work if the user is using a phone app instead of the web browser? No. > the apps I want to expose already have user accounts and passwords so it would make things a bit more annoying when logging in See if some of those apps can do federated authentication. It would allow you to work out a Single Sign-On (SSO) setup where people login only once and then can access any of the services (that support SSO). Even without SSO it should be possible to login to Authelia only once (to gain access to the LAN) and then not have to deal with Authelia login for a while. Otherwise you're correct, you have to login twice. ---------------------------------------------------------------------- xardoniak · 2023-11-09 20:44 I used to use Nginx Proxy Manager for exposing services but generally you end up exposing the login page for that particular app and you have a different login per app which is a pretty shitty solution for non-IT folk. I've tried to set up Authelia and other similar things and found them to be very annoying to set up / configure. Maybe I'm just an idiot though! I would suggest having a think about what you want to expose and whether there's a better way (eg overseerr instead of exposing radarr/sonarr) CloudFlare tunnels are also great - they obfuscate your public IP and can have a login form in front of them. You provide a list of email addresses that can log in to Cloudflare and only those users can access the website. I have mine set up to auth through Google accounts for example but you can use GitHub, office and I believe Discord. Not managing user accounts has been a life saver for me... You can also block access from outside of your country. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-09 21:21 >Even without SSO it should be possible to login to Authelia only once (to gain access to the LAN) and then not have to deal with Authelia login for a while. Ideally I woulnt mind setting up Authelia if the whole device gained access. i.e. if have the bitwarden app on my phone I could authenticate with Authelia and then bitwarden would work fine until I have to log in again. ​ >You can try leaving WG on all the time on their phones. Or use an automation app to turn it on. My whole thing is that I dont want do anything setup on their side. lets say auntie jane that lives on the other side of the country and messages me and wants a couple pictures. The easiest thing for me to do would be to give her a username and password and a website. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-09 21:21 Hmm I do remember learning about the access list but thought it would useless since most ips are dynamic. This could definitely lower the chances of malicious activity. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-09 21:21 In my opinion combining them would be like locking a lockbox inside another lockbox. The only way I could see this being useful is if you give out your VPN to everyone but you want certain apps to be blocked the VPN users ---------------------------------------------------------------------- Joyfulsinner · 2023-11-09 21:26 Thats exactly what I want to do but what happens when hacker jimmy finds out that he can get to login page and brute forces his way in? I wouldnt mind if this happened if I got a notification about it cause then I could shut it down. Your not an idiot! this stuff is difficult! ---------------------------------------------------------------------- bubbayo21 · 2023-11-09 22:06 This is how I do it. Only allowed ip into my vps is my home or via Tailscale. ---------------------------------------------------------------------- patel21 · 2023-11-09 22:18 They can't access the login page if you only use CF tunnel to access your internal site as you don't need to open the ports. So tunnels are still way better and using CF app authentication on top of it is even more secure. ---------------------------------------------------------------------- persiusone · 2023-11-09 22:29 >Before this post gets blasted with "just use a VPN" Yes I already have wireguard up and running but trying to get family members setup with a vpn that are technology illiterate is a nightmare I mean, the reasons to do this cannot be understated. A VPN literally accomplishes the security and exposure issues. It's your network through. You can feel free to expose your ports and services to the entire internet and take the risk of zero day attacks, brute force, and credential leaks. Knowing that your family is illiterate, it sounds like they may not use best cyber security practices with your services... So, that leaves it on you. You can either support it on the front end with a proper VPN like Wireguard, or support it on the back end with IDS, honeypots, advanced threat management, constant monitoring, mitigation, patch management, backup and restores, isolation, etc. There are not shortcuts to proper security and exposure management. You can also pay someone, or a company to do this for you. ---------------------------------------------------------------------- ithilelda · 2023-11-10 00:21 people are not getting the risks of exposing services correctly. think about it again. even you lock everything behind a password protection, if the password is weak, it is still not anything better than no protection. The chain is only as strong as the weakest link. Your tech illiterate family members may very likely setup something like 88888888, then they are effectively making the entire server naked. It is best to use device specific authentication apps like wireguard. If they can't even use such app, then only expose apps that support webauthn (or oidc, and setup an oidc provider that supports webauthn or nopass), where they can use fingerprint readers on their phone to login. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 00:21 Yes the reason why I said that is because I know what a VPN is and I know why its secure but I am asking for a different solution to the same problem. I am looking for different options and I know one option is a VPN so it doesnt help to me to find a solution when the only answers are "just use a VPN" Thank you for the couple of keywords. I will start my research there. ---------------------------------------------------------------------- persiusone · 2023-11-10 00:25 The suggestion comes from the heart. I support several clients doing both, and can assure you that the amount of work you'll need to properly secure a non-vpn solution will far exceed that of a vpn solution here. It is a major undertaking to do it right without a vpn because your exposure is enormously greater. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 01:01 Im not looking for a non breakable solution but I want some basic security. I just want to make it more difficult then its worth. The stuff that I want to expose is worthless to most people. My server wont have the best security and Im sure it will be a learning curve but that is what I like about this hobby. ---------------------------------------------------------------------- persiusone · 2023-11-10 01:42 Like I said, it's your network.. I'm not here to tell you to ignore best practices but assume you wanted valid experience responses by asking. Otherwise, you do you- I can't advise on something substandard though, because compromised systems are a problem for the rest of us to deal with and I'm not going to contribute to that horrible problem. Just do some of my alternative recommendations. It may be more work than simply setting up a VPN, but I emplore you to consider other people you may impact by not properly securing your stuff which will likely be used as a launching point to try to compromise one of my systems or other victims of attack. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 02:25 How would my compromised server be a problem for other networks? I understand that it would be a problem for anyone that using my network because the hacker could essentially hop around once on a local network but I am not understanding how it would be a problem for anything outside my lan. If my server is used as a lunching point the only thing that will do is protect the hackers identity or is there something else I'm missing? I will definitely work on setting up the solutions you mentioned. I have found a few good solutions already. ---------------------------------------------------------------------- persiusone · 2023-11-10 02:36 I'm glad you are finding suctions. Yes, hackers use your compromised server and internet bandwidth to attack others. It provides a layer of anonymity and uses your resources to compromise others. In addition, they will often host child porn on your systems. Professionally, I offer colocation services for others in data centers. When they are compromised, and child porn is found on compromised servers- law enforcement literally arrives with a search warrant and seizes the equipment. Vulnerable systems impact everyone. I can't emphasize this enough. You truly have a responsibility to do what you can to avoid this. Seized equipment takes years to return, and if CP is found- it will not be returned. Speaking from experience as a provider with customers who have had this happened to them. ---------------------------------------------------------------------- schklom · 2023-11-10 02:39 The idea is to allow IPs originating from your country/continent and block everything by default. For example, I block Asia America Africa because I know none of my family or me goes there. If we plan to travel there, I will unblock. ---------------------------------------------------------------------- Silencer306 · 2023-11-10 02:41 You can never have too much of security ---------------------------------------------------------------------- Silencer306 · 2023-11-10 02:45 Thank you for the blog, im just starting out so looks like you have a bunch of posts I could use. One question, wireguard + authelia + nginx + (any firewall?), would this be the best security and lockdown one can get on their server? Plus including whitelists for ips maybe? I want to access all my apps from anywhere in the world, but also want to not be vulnerable to attacks ---------------------------------------------------------------------- notherebleh · 2023-11-10 03:09 Authelia is an additional security option for your reverse proxy, but it may not be needed if the apps you are exposing already have user accounts and passwords. It can be used with phone apps, but the app must support OAuth2 authentication. Make sure to install and maintain a firewall to prevent unauthorized access to your servers. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 03:32 Ok so I already monitor my server pretty often with some decent tools that aren't built for monitoring but they do give me good info. If were to install a decent monitoring system would this type of activity be noticeable? i.e. My network traffic being through the roof when not much is going on or something along those lines. I could see data centers being a easier place to hide because of all the resources. Thats super slimy. I hope none of my stuff ever gets that far compromised. ---------------------------------------------------------------------- John_Mason · 2023-11-10 03:42 > You can either support it on the front end with a proper VPN like Wireguard, or support it on the back end with IDS, honeypots, advanced threat management, constant monitoring, mitigation, patch management, backup and restores, isolation, etc. Isn’t there a middle ground with something like Cloudflare Tunnels or Tailscale Funnel? Those still expose your services to the internet outside of a VPN, but they require a lot less maintenance than you described. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 03:52 if you are starting out just use wireguard. you will be able to access your home network from anywhere as long as wireguard is turned on. you will be super secure with wiregurad unless you give people your private key. ---------------------------------------------------------------------- johngizzard · 2023-11-10 03:55 Another approach is to setup your reverse proxy to only allow traffic from your local lan OR cloudflare. Then setup cloudflare firewall rules to block traffic based on whatever regions/known scrapers and bots yada yada. That way your home IP is never exposed, and you offload a lot of IP management to cloudflare. You could also use their zero trust service to require use of logins. You could ratchet it up further and use CF tunnels so you don't even have any ports open, with the added benefit of not requiring a static IP. Or you could DIY something similar by using a VPS as a host for your reverse proxy, and setup a VPN between your Web servers and the VPS, which gives you a ton of granual control without relying on any 3rd parties (other than VPS hosting). For the record I don't do 90% of that LOL. I use cloudflare geoblocking for my server for everywhere outside my home country. Which is basically just a very rudimentary second layer of security, since all my exposed apps already have 3rd party auth (plex, overseerr). Everything else is only accessible via Tailscale which runs out my router, which is honestly 100x times easier than everything else. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 03:56 hmmm if the phone apps can be used with Authelia that might be a game changer. ---------------------------------------------------------------------- StillParticular5602 · 2023-11-10 06:43 Teleport is a good alternative https://goteleport.com/ ---------------------------------------------------------------------- mztiq · 2023-11-10 08:20 /u/Joyfulsinner is right. Wireguard is totally fine for the most part, only combine it with Authelia if necessary. ---------------------------------------------------------------------- GolemancerVekk · 2023-11-10 09:11 Ah I understand, remote setup is a pain in the ass. 🙂 [Here's a potential alternative](https://github.com/zuavra/nginx-ip- whitelister): it's a service that runs alongside Nginx and does IP whitelisting. It requires you to put the service you want people to access behind an Nginx reverse proxy. You give Auntie Jane an URL that has a key included in it and her current IP is whitelisted for a period of time (configurable). She uses the username and password as usual but the rest of the world can't access the service even though it's available publicly (the reverse proxy intercepts requests and throws errors without the key). ---------------------------------------------------------------------- keixver · 2023-11-10 09:24 That's how security layers work. Nothing is and will be 100% foulproof, we just make our home security on the assumption we are too insignificant for a bunch of ill intended fellas to dedicate time and money in order to breach our home network. It basically comes to how well you want to guard yourself and your self hosted data ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 13:37 That’s a neat option! I think I will end up implementing this once I get the time. The only thing I don’t like about it is that’s it’s under major development but that is how things like this become great. ---------------------------------------------------------------------- Joyfulsinner · 2023-11-10 14:15 This is true but in my opinion WireGuard does a better job at keeping people out then a house lock an key. We have people that we can call if someone locks their key in their house. If you loose your private key for WireGuard you are Sol. So the fact that I keep data more secure then the place I sleep is fine with me. ---------------------------------------------------------------------- keixver · 2023-11-10 15:16 Again, it's just a matter of the level of peace of mind you want ---------------------------------------------------------------------- Silencer306 · 2023-11-11 05:18 Can you have CF authentication on top of wireguard and Authelia? Im a little new and trying to understand better