Securing publicly visible Services reddit / selfhosted ---------------------------------------------------------------------- RobertDieGans · 2023-12-10 00:19 Hey there, how can I properly secure a website I want publicly accessible (like nextcloud, vaultwarden, jellyfin etc.)? I have VPN tunnels but some services have to be public, for example nextloud so I can share files and collaborate on docs. How can I secure this? Any help is appreciated! ---------------------------------------------------------------------- InvaderToast348 · 2023-12-10 00:25 Look up reverse proxy. I use traefik - it has a built in basicAuth middleware but you could use a different one. ---------------------------------------------------------------------- RobertDieGans · 2023-12-10 00:31 I already have nginx rpm in place but didn't know it offered security functions. Will look into that, thanks! ---------------------------------------------------------------------- InvaderToast348 · 2023-12-10 00:38 Your welcome :) ---------------------------------------------------------------------- emprahsFury · 2023-12-10 01:13 Basic auth needs to have ssl alongside it. Any good tutorial would say that, but it shouldn't be proffered as a solution without the appropriate caveat ---------------------------------------------------------------------- chaplin2 · 2023-12-10 04:30 If I want to login to nextcloud, do I have to first login to basicAuth with a password, then to nextcloud with a second password (two rounds)? ---------------------------------------------------------------------- ithilelda · 2023-12-10 06:21 disable registering, make sure every account has a strong password. If someone can't remember complicated stuff, setup a vaultwarden instance . ---------------------------------------------------------------------- NinjaFragrant7710 · 2023-12-10 08:49 CLoudflare tunnels is a great way to access workloads running in a private network (self host) from the internet securely. You do not need to allow traffic to your firewall or use port forwarding (which could be a security risk). You just install a daemon locally and that creates an outbound connection to cloudflare. It is free and super easy to configure, you just have to use cloudflare for dns. ---------------------------------------------------------------------- austozi · 2023-12-10 09:46 Just activate two-factor authentication in Nextcloud under admin settings. ---------------------------------------------------------------------- InvaderToast348 · 2023-12-10 10:18 Yes, but if a service already has its own authentication you can disable the middleware per container. ---------------------------------------------------------------------- chaplin2 · 2023-12-10 10:24 You mean instead of BasicAuth, 2FA? I want an additional layer of authentication not 2FA ---------------------------------------------------------------------- austozi · 2023-12-10 10:58 You could add BasicAuth at the proxy as a completely separate authentication step, just be aware that it will break client apps that do not recognise BasicAuth. 2FA is a more elegant solution that integrates well with the desktop/mobile clients. It is also an industry standard so no less secure. Whatever you use, tie it to fail2ban to thwart bruteforce attacks and it should be solid. ---------------------------------------------------------------------- chaplin2 · 2023-12-10 11:41 2FA is a different story. You want to protect against vulnerabilities, so you need a separate app. ---------------------------------------------------------------------- colonelmattyman · 2023-12-10 12:36 I'm using Authelia in a Docker container connected to Duo. It's neat. Sends notifications directly to my phone for MFA authentication. ---------------------------------------------------------------------- InvaderToast348 · 2023-12-10 13:11 This is true - I should have mentioned it. Without ssl, the login details are sent in plaintext and it is trivially easy for someone to capture them. ---------------------------------------------------------------------- InvaderToast348 · 2023-12-10 13:13 Very nice. I've been considering a proper 2fa solution for a while, but havnt really been bothered since everything is LAN or localhost only. ---------------------------------------------------------------------- Eirikr70 · 2023-12-10 16:24 Set up Crowdsec to secure Nginx. ---------------------------------------------------------------------- utahbmxer · 2023-12-10 17:50 A reverse proxy by itself doesn't add much security at all other than being able to mask some headers from backend/upstream web servers. What you really need in conjunction is a WAF to block some possible vulnerabilities and also something like CrowdSec. Block countries that don't need access. Create a default site on your reverse proxy so that probes to your IP will just get 403 Forbiddens. Only requests with a valid host will be served. E.g. nextcloud.domain.com allowed, 24.22.14.234 denied, where that is your public IP.