Authentik as it's own VM/Container - Does it provide extra security?
reddit / selfhosted

----------------------------------------------------------------------
useless_mlungu · 2023-11-09 20:33

The title really.

I've just got my head around Authentik and OAuth in general, and I
will start implementing it in my homelab.  But I was wondering, if I
run the Authentik docker container alongside my other containerized
services in the same VM, does this provide as much security as running
this on a separate VM?

In my head, if there is this "physical" separation, the attacker would
have nowhere to go if they somehow defeated Authentik.

So is it categorically better, or just a placebo to separate them out?
I'd love to understand this fully, and do some recommended reading on
the concepts whatever the answer, but I'm struggling to discover what
to search for exactly.  Thanks!

----------------------------------------------------------------------
Wojojojo90 · 2023-11-10 01:27

Like literally anything computing or security, *it depends*

Will running it in a different VM make it less likely for you to keep
that VM up to date with security patches/releases? How would you allow
it to connect to the various services it needs to connect to? What do
you mean by "if [the attacker] defeated Authentik"?

----------------------------------------------------------------------
useless_mlungu · 2023-11-10 02:50

Firstly, I'm making a lot of assumptions since I'm not knowledgeable
enough to know this for myself, but I meant assuming an attacker
managed to exploit a bug in Authentik, or somehow managed to
breakthrough it, but the service being on a different machine the
attacker would then need to break through the confines of the VM to
somehow get to the VM where the service is actually held. If that
makes any sense?

As for less likely to keep the authentik specific VM up to date, I
don't think I'd let it fall behind.

----------------------------------------------------------------------
Wojojojo90 · 2023-11-10 03:03

> exploit a bug

Depends on the bug then

> breakthrough it

Break through what?

> the service being on a different machine the attacker would then
need to break through the confines of the VM to somehow get to the VM
where the service is actually held. If that makes any sense?

It doesn't really make much sense. Are you trying to learn how to
protect the VMs or the services? Seems like you could just do some
general reading about security best practices for VMs and containers,
I'm not really seeing a specific question here that wouldn't be
covered by general hardening