OwnCloud Safe to Expose with Reverse Proxy reddit / selfhosted ---------------------------------------------------------------------- thatoneguy5464 · 2023-11-16 21:52 Is OwnCloud hardened enough to expose with a reverse Proxy? Are there any specific settings that need changed to make it safe? ---------------------------------------------------------------------- multidollar · 2023-11-16 21:59 Nothing is ever “safe” to expose publicly. Everything comes with issues, and the answer to your question about it being hardened enough is that we don’t know what we don’t know. We could find out in a year that there’s an exploit that has existed since day 1 and hadn’t been patched. Your approach is on the right track: how do you take steps to harden it yourself. Approach with the mindset first of “why”? Then “how”. Make sure you have the ability to easily shut it off, look at authentication mechanisms, make sure your VLANs and firewall rules are closed off from any main home networking of personal devices etc. ---------------------------------------------------------------------- thatoneguy5464 · 2023-11-16 22:07 I really appreciate the write up and for taking time to respond, Thank you! ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-16 22:15 Don't fall for the capitalist corporate SCARE PROPAGANDA, your private little server is not a target for a dedicated hacker. FEAR has always been the greatest tool for manipulating the general population. Just update your system regularly and you will be safe from the bots that are probing the Internet. Source: 40 years network professional. ---------------------------------------------------------------------- thatoneguy5464 · 2023-11-16 22:18 Thanks so much for the reply! ---------------------------------------------------------------------- multidollar · 2023-11-16 22:49 There are some caveats to this advice because a dedicated hacker might not be interested in your little home lab, but bots are. And all it takes is one bot that uses an exploit to do something that affects you. There’s more to be worried about than dedicated people caring about your server, there’s plenty of automation out there just causing carnage where it can. ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-16 23:24 To add on to what others are saying; at the end of the day, little targets like us are barely worth trifling with unless we are easy targets. So just don't make yourself an easy target, and you can do this by following two rules. First: *always always always* keep your systems and software up to date. This is the most important thing you can do above all else. Second: make as little noise as possible. Inexperienced techs love saying "obscurity isn't security" but the best mitigation for an attack is to never get attacked in the first place. A more accurate phrase is "obscurity isn't a *replacement* for security". Nothing will ever be perfectly secure, you will be made vulnerable by zero-day exploits. The best way to not get hit by these exploits is to not be noticed. Get a domain name. Point only the wildcard DNS record for it at your IP. Get only a wildcard certificate. Only open port 443 on your firewall. Only use subdomains to host your web services. Configure your reverse proxy to ignore anything that isn't asking for a recognized subdomain. Domain names and certificate requests are public record. However, following this guide, your DNS and certs will only say `*.domain.tld`. That wildcard could be anything and it would still be valid, but your server selectively listens to only a few. Without reliable DNS or certificate records to go on, attackers are left blind and will need to bruteforce your subdomains before they can even begin attacking anything. You are being port-scanned constantly, but that's irrelevant if your only open port doesn't even respond unless they ask for the right subdomain. You are *not* having your subdomains enumerated constantly. Even if you called it `nextcloud.domain.tld` most bots aren't going to just test random things unless they have a record pointing to it. ---------------------------------------------------------------------- adamshand · 2023-11-16 23:44 ^ THIS. ---------------------------------------------------------------------- Deathmeter · 2023-11-16 23:44 Yeah I don't know if I 100% agree with that either. If I was hosting an app vulnerable to log4j when bots were scanning the internet for it at the time, I would've felt significantly safer if it was behind a VPN than a reverse proxy open to the internet. I personally only expose apps that need to be accessed by other people. ---------------------------------------------------------------------- runherd · 2023-11-17 00:39 Just use unusual ports - bots won't find you no more ---------------------------------------------------------------------- abeNdorg · 2023-11-17 00:46 [https://doc.owncloud.com/server/10.13/admin\_manual/configuration/ser ver/harden\_server.html](https://doc.owncloud.com/server/10.13/admin_m anual/configuration/server/harden_server.html) You can start by checking out that URL ---------------------------------------------------------------------- multidollar · 2023-11-17 01:00 Yeah, right. Except for bots that just do a complete valid range scan and probe what API responses come out. They’re pretty sophisticated these days. ---------------------------------------------------------------------- Lankiness8244 · 2023-11-17 06:53 „Only“ revserse proxy no. You need more. Https ---------------------------------------------------------------------- Lankiness8244 · 2023-11-17 06:57 Thats not true. Hackers will use his compromised server as a "zombie" within a botnet. ---------------------------------------------------------------------- user01401 · 2023-11-17 12:14 This shouldn't be the only protection but you should certainly do this. After changing a ssh port 22 to a high random port, I'll now see a scan maybe once a month instead of hundreds a day. ---------------------------------------------------------------------- YourFlakingFuture · 2023-11-17 13:21 All this shit for owncloud hosted on a cheap vps lmao ---------------------------------------------------------------------- thatoneguy5464 · 2023-11-17 14:16 I use lets encrypt through the Nginx proxy manager for each domain, is that what you're referring to? ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-17 14:37 Did you read the update part? ---------------------------------------------------------------------- Ursa_Solaris · 2023-11-17 16:05 This isn't any more or less than selfhosting in any other situation. It's just a particular way of configuring the things you already have to do in order to reduce your attack rate and surface. ---------------------------------------------------------------------- persiusone · 2023-11-17 16:39 Is there a reason you cannot accomplish this with a selfhosted VPN? Exposing anything has risk. Risk of loss of data, your systems being used for other attacks, and loss of time/money to fix. It is entirety possible to do this as safe as practical of course- keeping your stuff up to date and having some kind of visibility into intrusion detection for immediate response are ways to minimize issues. ---------------------------------------------------------------------- thatoneguy5464 · 2023-11-17 16:45 I want to be able to share files with family through ownclouds share feature. I currently have wire guard set up and works great for my own access. ---------------------------------------------------------------------- Symnet · 2023-11-17 18:19 what exactly is the end goal of manipulating people to..... have better security practices? ---------------------------------------------------------------------- Lankiness8244 · 2023-11-17 18:37 yes and in a perfect world i would agree with you, where no configuration errors, no xss etc exist. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-17 18:50 Corporate want to sell products. Capitalism 101 ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-17 18:53 Weakest link is always the stupidity of the person behind the keyboard. But you can counter that with education, to some degree. ---------------------------------------------------------------------- MrFlibble1980 · 2023-11-18 00:15 I have been running Owncloud since 2011 without any reverse proxy and it's been fine. I'm still on an old version because every time I have tried to upgrade it, it has fucked up, and i've wasted loads of time getting it back running again. New versions /should/ be better I hope! Pick decent user passwords, protect it with SSL, and have a local firewall on your server that only allows required ports though (80 and 443), and you should be fine. I take a backup of mine now and again, but it's quite small - only about 50gb. ---------------------------------------------------------------------- thatoneguy5464 · 2023-11-18 00:39 Thanks! This gives me confidence in the set up