Following security best practices for open ports reddit / selfhosted ---------------------------------------------------------------------- nooneelsehasmyname · 2023-12-13 12:02 I'm loving the process of learning about servers by self-hosting all my stuff. I have a home server running Linux with Docker installed and a few dozen containers, such as Jellyfin, Firefly, Immich, Home Assistant, Gitea, Homepage, Traccar, Tailscale, etc. The absolute best way to secure your server, I've heard, is to use a VPN to access your services and close your router's firewall. So that's what I'm doing: I'm using Tailscale on the server, with a direct Wireguard connection to the home router (with DDNS) as backup, and all router firewall ports are closed (except for Wireguard on some random port). Actually, unfortunately no. There is ONE exception. I have a GPS tracker on my car, and it needs to connects to Traccar running on my server. The GPS tracker doesn't have Tailscale (it doesn't even have an OS running on it where I would install Tailscale), all it does is a TCP connection to my IP/port (this specific tracker follows the Wialon IPS protocol, btw). So this is the one port that I need to open on my router and forward to my server. Assuming that I do need to have this port open, and connected to the Traccar container, what would you suggest is the best way to secure this? ---------------------------------------------------------------------- Eirikr70 · 2023-12-13 12:14 Install a reverse proxy (Nginx ?) and an intrusion detection system (Crowdsec ?). ---------------------------------------------------------------------- nooneelsehasmyname · 2023-12-13 12:19 I have been familiarizing myself with what reverse proxies do, so there the question is: what would a reverse proxy do for me in this case, given that I'm only placing one service behind the proxy, it's not using https/certificates, etc. The only thing the proxy would do is forward the data from the external router port to the server port, which is what happens already anyway, no? Crowdsec is a new thing for me, I'll look into it ---------------------------------------------------------------------- Eirikr70 · 2023-12-13 12:38 Lol, I am no expert and I am not going to argue with you. But you asked for best practice, and I told you about best practice. For instance, if you go to a bank, there is a desk and you ask what you need to the desk, then the desk will ask the back office. You don't go directly to the vaults with your key or whatsoever. A reverse proxy is the desk. And an IDS is the security agent at the entrance. ---------------------------------------------------------------------- lilolalu · 2023-12-13 12:50 If you want to be very thorough, make sure that the docker container you are exposing is not running as root, does not have any bind mounts to docker.socket and other relevant system paths that could be used for privilege escalation. Or run that software in a VM, which will give you an extra layer of protection. On a more general note, I think that running a firewall in front of your home network is a great idea, because there are a lot of things that can be misconfigured or vulnerable, from IoT devices, connected fridges, Babyphones, Chromecast to printer GUIs, some of them opening their own ports if UPnP is enabled in your router. The security focus in this subreddit is usually only about your homeserver, and forgets about all this stuff so a firewall is great. ---------------------------------------------------------------------- thekrautboy · 2023-12-13 13:17 The reverse proxy is a application that is developed with the goal of being exposed to the internet. You can expect a certain degree of security and stability of it. Is traccar secure enough to be open directly to the internet? Plenty of tools like that recommend to not be used by that but placed behind a reverse proxy for security, added HTTPS, authentication and such. Basically, if you trust traccar and the features it has are enough for you, sure then dont use a proxy. Its up to you. ---------------------------------------------------------------------- nooneelsehasmyname · 2023-12-13 13:35 Maybe I'm missing something here, but it's not that I don't want to use HTTPS, it's that the Wialon IPS protocol used by the tracker uses TCP directly and that's it. If you have some hardware that expects to connect to some IP/Port over TCP and send some string on some specific format, I don't think you can expect the same hardware to work if you instead put an HTTPS endpoint on that IP/Port, right? ---------------------------------------------------------------------- thekrautboy · 2023-12-13 13:37 I dont use traccar myself but from a quick search i have seen that people have placed it successfully behind a reverse proxy with HTTPS. I would assume if the apps of traccar are not compatible with that then there wouldnt be any reason to do this for those users. Give it a try? Ask on the traccar github/forum? ---------------------------------------------------------------------- nooneelsehasmyname · 2023-12-13 13:39 A firewall is absolutely required, and I have one running on my router where all ports, except one, are closed. As for making the docker container itself safe, yes, I believe that (if vulnerabilities in docker itself are not exploited) the worse that can happen is I lose the Traccar database, but that is ok because I have hourly and daily backups. ---------------------------------------------------------------------- nooneelsehasmyname · 2023-12-13 13:44 They may have done for the user interface/web GUI side (whcih I don't need to because I have a VPN), but not for the data acquisition side from the trackers. But I'll look into it again! ---------------------------------------------------------------------- thekrautboy · 2023-12-13 13:46 And fyi, HTTP/S is a protocol that runs on top of TCP/IP. So just because something uses TCP/IP doesnt mean it couldnt be HTTP/S on top of that. ---------------------------------------------------------------------- lilolalu · 2023-12-13 13:46 Not to be nitpicking here but a lot of those "built in" firewalls are not very secure firewalls but focused on usability for the end-user, which often means very permissive rule management. ---------------------------------------------------------------------- nooneelsehasmyname · 2023-12-13 13:49 Yes, that I know. But if you have a client expecting protocol XYZ on top of TCP, then you have a server with procotol ABC on top of TCP normally doesn't work, right? ---------------------------------------------------------------------- thekrautboy · 2023-12-13 13:51 sigh... thats why i said to check with the traccar people... ---------------------------------------------------------------------- hereisjames · 2023-12-13 14:04 The port opening itself is not particularly germane to the security. What's important is the security of whatever application is receiving that connection. If it's just some black box container the vendor provides then you would want to isolate that as much as possible. If you must run it under Docker then make it rootless or unprivileged if you can and put it in a logically isolated VM, then instrument the VM so you know if something unusual happens. That said, people seem to be happy running all sorts of random containers without having any security around them whatsoever, so you could be securing this while being exposed elsewhere. Best practice would be to push everything through your own container registry for security scanning before deploying. I've used Harbor in the past for this purpose, nowadays I've moved away from containers as much as possible. ---------------------------------------------------------------------- nooneelsehasmyname · 2023-12-13 15:53 Thank you! Traccar is open source, so I can inspect the code (to the extent of my knowledge in security, of course). It is already running in Docker, and I will follow the principles of least privilege as much as possible, yes. ---------------------------------------------------------------------- CactusBoyScout · 2023-12-13 15:55 Maybe a dumb question but if I’m already using Authentik and NPM would CrowdSec add anything? ---------------------------------------------------------------------- hypercyanate · 2023-12-13 17:25 Firewall, at minimum block countries like Russia and China ---------------------------------------------------------------------- kihaji · 2023-12-13 18:22 If you want to get spicy, and have some coding ability, you could get a free tier VPS outside your network, build a little listener for your GPS traffic, then forward that on through a VPN connection. Also, if you are currently hosting this at home, do you not have a dynamic IP? Or are you setting up a domain that you can put into your GPS device? ---------------------------------------------------------------------- HardChalice · 2023-12-13 19:16 Yeah, Crowdsec is an IDS, so it monitors and alerts you for unauthorized traffic. Authentik and NPM are ways to secure traffic coming in, but they dont necessarily watch for malicious traffic. ---------------------------------------------------------------------- MoneyVirus · 2023-12-13 20:23 Im not an expert, just homelab admin but my thoughts are: Host traccar external, pull data from database to local traccar instance via vpn ( no vpn initiated from the external side/ push from external side) ---------------------------------------------------------------------- hereisjames · 2023-12-14 00:22 The source code probably isn't much help - you're most interested in the versions of libraries it's running. Like if it was still running an old version of log4j, for example. Container vulnerability scanning would help with that. If you want to experiment with something cool - try Threatmapper from Deepfence. ---------------------------------------------------------------------- ikbosh · 2023-12-14 03:08 Let's take a step back, how is the GPS Tracker getting internet? It's own 4G SIM? How is it told/configured to speak to your traccar endpoint? Just an IP address? Looking at the Wialon protocol specs, every tcp session requires authorisation, so there's at least some basic security to the protocol? ---------------------------------------------------------------------- KD_done · 2023-12-14 11:49 I read what you were doing, and although I find the majority overkill, I can't say it's wrong or actually overkill to begin with. You are learning, and you are finding your own way. So, I will refrain giving direct advice.. just some cases where I would use a proxy server (work, and at home). Besides, I don't know what you use your extra toys/apps for besides a couple of websites.. so, this is an explanation for a simple case: "private lan http traffic from outside secure with nice human-understandbale name" A proxy server functions as a funnel. That's it, there ya go, good evening and have a good one! Jokes aside, that's what it does. It funnels traffic between 2 points. Often you see a proxy server between 2 networks. A public facing side, and a private side. If you would squint (a lot) and look at cloudflare.. it's just a glorified HTTP proxy service with a lot of fancy features. A proxy service for imap, smtp, ftp or any other service is also possible.. but then we delve into the realms of SOCKS (google socks connection, although a good pair of colorful socks is never a bad google search imo). Lets stick to HTTP proxy services. Easier and more common. If I have, for instance, 4 web-applications running locally on [10.10.0.10](https://10.10.0.10), the urls would look something like [http://10.10.0.10:9000/](http://10.10.0.10:9000/) to [http://10.10.0.10:9003/](http://10.10.0.10:9003/). And there is 1, perhaps 2, of those apps that I would like to open up to the outside. I would avoid VPN's, NAT or anything else that would provide direct traffic to these web-applications. First I am looking to open up only 2 webapps, not 4. Second, I would like to add an SSL certificate on the outside, and thirdly.. I would like to route the traffic per webapp based on a human-understandable domain. Like "[https://wiki.example.com/](https://wiki.example.com/)" to port 9002, and "[https://media.example.com/](https://media.example.com/)" to port 9003. In effect I will only need to open up specific traffic between my LAN and host the proxy server lives on.. NOTHING else. It's a funnel.. simple and effective. Like others said, you can add all kinds of extra's to your funnel on the outside, like crowdsec and other stuff. These are all good suggestions but make it a little more complicated. Pick the tools that fit the job, and try. It's a suggestion on how to do things.. it's for sure not the only thing, or the right thing. Keep playing and fiddling around, and pick that what fits and works (and keeps you "safe" ;)). ---------------------------------------------------------------------- aviodallalliteration · 2023-12-14 22:46 So as I understand it the GPS tracker in your car doesn’t support HTTPS and so is sending location data towards your home server IP in the clear. I personally think the biggest issue here is that without encryption of the data in flight, you’re opening up your location data to be caught by person in the middle attacks. Would it be possible to install another device in your car (rasberry pi with cellular modem perhaps) that acts as a forward proxy for your GPS tracker and sends your location data towards your server through an encrypted connection? Then you can have a reverse proxy on your server that terminates the HTTPS connection before sending the data on towards traccar or whatever you’re using.