Sshwifty secure login question
reddit / selfhosted

----------------------------------------------------------------------
AhmedBarayez · 2023-12-03 18:01

I’m in the process of selecting a web based ssh app to add all my ssh
servers in one place and i’ve tried apache guacamole and it’s been
working fine,

Also I’m trying sshwifty but the thing is, sshwifty doesn’t have a
login interface before accessing the data so it’s not the best thing,
so I’ve made an install and asking if that’s the best for my current
setup..

I actually don’t have authelia nor authentik to put it behind 2fa app,
and i don’t plan to install one soon BUT
i installed sshwifty on oci vm that have a public ip of
123.123.123.123, and i only allowed port 8182 for this ip address so i
added in the security list 123.123.123.123/32 so no one can access
this app except localhost, and then i installed cloudflare tunnel into
this vm and activated otp by email and allowed only my email.

So my question is, is this secure enough?

----------------------------------------------------------------------
NekoLuka · 2023-12-03 19:13

Running behind cloudflare is usually secure enough as long as you also
don't expose the ports to the internet

----------------------------------------------------------------------
zfa · 2023-12-03 21:52

You're likely ok but have done a lot more than necessary and when
you've more links in a china than necessary there's more places to
make mistakes.

You could just get sshwifty to listen on hostname=localhost (which
will bind it to only ip 127.0.0.1) and then forget about having
entries in the OCI security list (which isn't needed anyway even in
your current design btw).

cloudflared can be configured to access 127.0.0.1:8182 just fine so
you'll get the same result, but a simpler less-prone-to-fat-fingering-
something setup imo.

----------------------------------------------------------------------
AhmedBarayez · 2023-12-04 08:59

That's good enough for me :)

----------------------------------------------------------------------
AhmedBarayez · 2023-12-04 09:00

That's new info, Thank you

----------------------------------------------------------------------
JoseLopezC11 · 2023-12-04 10:46

I don't remember how, but my sshwifty has a password to log in. Even
before I can enter the portal with all my connections, I have to enter
a password. Just make it a really tough password and it will be an
extra layer of security.

----------------------------------------------------------------------
AhmedBarayez · 2023-12-04 10:48

Maybe your setup is behind authelia or authentik?

----------------------------------------------------------------------
JoseLopezC11 · 2023-12-04 10:49

Its sshwifty who asks for the password, I even have to enter it
locally.

----------------------------------------------------------------------
AhmedBarayez · 2023-12-04 10:54

hmm, that's interesting, can you share your docker-compose file?

----------------------------------------------------------------------
JoseLopezC11 · 2023-12-04 10:55

As soon as I have access to my computer, will do.

----------------------------------------------------------------------
AhmedBarayez · 2023-12-04 10:55

Thanks!

----------------------------------------------------------------------
JoseLopezC11 · 2023-12-04 13:22

Its not a value in the docker-compose, its a value in the
sshwifty.conf.json:

"SharedKey": "yourpasswordhere"

----------------------------------------------------------------------
AhmedBarayez · 2023-12-04 13:54

It actually works 😮😮
Thank you!!

----------------------------------------------------------------------
JoseLopezC11 · 2023-12-04 14:00

Glad to help.