Same domain (subdomains) for multiple services - safe? reddit / selfhosted ---------------------------------------------------------------------- julien-38 · 2023-12-13 21:27 Hello, Is it risky to use the same domain for quite private things (like n8n, on n8n.domain.tld, or jellyfin.domain.tld) as for Mastodon, which is visible to everyone (mastodon.domain.tld)? Should I use a completly separate domain? Thank you ---------------------------------------------------------------------- thekrautboy · 2023-12-13 21:31 Doesnt really make a difference. Some people believe having random "hidden" subdomains provide them security, i believe that is bullshit. But whatever makes someone feel safer, fine. ---------------------------------------------------------------------- bmaeser · 2023-12-13 21:49 from a security perspective there is no difference. they all are handled by the same host and the same webserver. doesnt matter how you access it you might however want to move a specific service to another host/ip, in which case its much more convenient to already have a subdomain for it. ---------------------------------------------------------------------- KD_done · 2023-12-13 21:49 don't think about security in the sense of obscuring something.. Your naming scheme is to make your life easier. Example; webmail-service.yourdomain.tld fe80::200:5aee:feaa:20a4 git-server.yourdomain.tld fe80::200:5aee:feaa:20a5 radarr-service.yourdomain.tld fe80::200:5aee:feaa:20a6 What would you be inclined to remember, an ip address or a name? A name, ofcourse. Make your life easier, and when it comes to security.. don't try and fake it with obscurity :) If I wanted to figure out what service you would be running I would do something else than read "understand" the domain-name. nmap might help my cause if I would be so inclined. ---------------------------------------------------------------------- AnApexBread · 2023-12-13 22:11 It's not bullshit, it's just the best security. If I check my Cloudflare firewall logs I can see my pics. Subdomain gets hammered but my backup hidden Subdomain gets almost no traffic. Hidden Subdomain won't stop a dedicated adversary, but it will stop bots programmed to hammer common domains. ---------------------------------------------------------------------- thekrautboy · 2023-12-13 22:17 > it's just the best security. Sure! ---------------------------------------------------------------------- AnApexBread · 2023-12-13 22:20 Meant not the best security ---------------------------------------------------------------------- zfa · 2023-12-13 23:24 Remember not to confuse netsec with opsec. netsec has been answered (partially) already but for opsec - do you want everyone who knows your domain name being able to check for `jellyfin.example.com` and found out you run jellyfin? What about looking for `overseer.example.com` or `sonarr.example.com` or `sabnzbd.example.com` and lettign them know you probably pirate stuff? What about `stash.example.com` telegraphing you have a porn habit so big you curate your own collection? Obfuscated subdomains could also help there I guess but you catch my drift. ---------------------------------------------------------------------- 83736294827 · 2023-12-14 00:35 Hidden subdomains don’t make it more secure, but does filter out a lot of noise making it easier to see actual threats. ---------------------------------------------------------------------- Stryker1-1 · 2023-12-14 01:16 Ah the old security through obscurity approach ---------------------------------------------------------------------- bbyboi · 2023-12-14 01:39 How do you get a hidden subdomain? Is it just dns every you manage locally without actually creating actual dns records on the domain? ---------------------------------------------------------------------- thedawn2009 · 2023-12-14 01:46 Jokes on them, stash is where my bitbucket is hosted ---------------------------------------------------------------------- unconscionable · 2023-12-14 01:50 Local recursive DNS server, such as unbound. Practically speaking, I have unbound installed on an opnsense router. ---------------------------------------------------------------------- -ShavingPrivateRyan- · 2023-12-14 02:31 It’s not, you can enumerate all subdomains that have a TLS cert with cert.sh https://crt.sh ---------------------------------------------------------------------- zfa · 2023-12-14 03:24 wildcard certs ftw. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-12-14 03:51 Using a private overlay network is far more secure. For example set up Tailscale. This will issue a bunch of 100.x.x.x addresses. And a bunch of domain names like host.network.ts.com. Only those on the network.ts.com network can see other hosts on it. This is great for private services. Tailscale automatically handles https. Just issue a Tailscale serve command and your server is up and running. ---------------------------------------------------------------------- jared252016 · 2023-12-14 05:26 It is more secure if, and only if, you do it right. For starters, you have to use a wildcard (*) subdomain and point it to your IP address. This works with Cloudflare and Cloudflare-ddns (docker) to keep your IP updated in the event it changes. Second, don't use let's encrypt's http/s verification. Use DNS and a wildcard subdomain for the certificate. This prevents you from being listed on any websites. Third, don't use something easily guessable. jellyfin.example.tld would be easily guessed by a DNS searching script. So you might use jellyfin-j23.example.tld instead. Where j is the first letter and 23 is the last of the IP address. Doing these 3 will make it damn near impossible to find, even by targeted attacks. Thus improving security. Alternatively, you could set up oauth2-proxy and put it all behind a password. It breaks the jellyfin web client, but you have the option to do it by subdomain. Also, I recommend NginxProxyManager for managing your subdomains and what they route to. You can do most of the setup within NPM and it makes it very intuitive and easy to use. ---------------------------------------------------------------------- Verum14 · 2023-12-14 05:37 I use subdomains for everything Also, arguably the more important piece for security, all of my incorrect subdomains redirect to rick astley ---------------------------------------------------------------------- neumaticc · 2023-12-14 05:38 but it's a matter of which type of security? for opsec in particular, if you have some 'arr services hosted at domains like `radarr.my.host` people using subdomain scammers could find your love of *downloading linux isos* ---------------------------------------------------------------------- bschlueter · 2023-12-14 05:54 It's not security, period, just obscurity. Not to say that obscurity can't lessen the magnitude of direct attacks, just that it doesn't make any attacks more difficult. ---------------------------------------------------------------------- zfa · 2023-12-14 06:33 > all of my incorrect subdomains redirect to rick astley You know the rules. And so do I. ---------------------------------------------------------------------- Lankiness8244 · 2023-12-14 07:04 Security through obscurity and less information disclose ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-14 10:15 Are you sure that your cookies would be valid only for `sub.example.com` and not the whole `example.com` **in every service** that you use? Also, as said, don't confuse NETSEC and OPSEC. Put all public stuff on a 'public' domain; all private stuff on a 'private' domain. Domains are generally inexpensive, around $5-$10 per year. ---------------------------------------------------------------------- TryHardEggplant · 2023-12-14 13:14 You version control your porn collection? ---------------------------------------------------------------------- LordSkummel · 2023-12-14 13:47 He is probably just old. Bitbucket server used to be called Stash. I think it's been 10 years since they did the rebranding of it. ---------------------------------------------------------------------- thedawn2009 · 2023-12-14 13:49 *checks notes* Yup, I'm a dinosaur in tech years. u/LordSkummel is right though, Bitbucket was previously called Stash. ---------------------------------------------------------------------- TryHardEggplant · 2023-12-14 15:02 I guess I should’ve put a “/s”. Also, please don’t scare me. It’s only been 8 years since the rebrand. I’m not ***that*** old yet. ---------------------------------------------------------------------- TryHardEggplant · 2023-12-14 15:10 *compares notes* Me too. I wonder if youngsters these days know that CVS doesn’t just refer to a drug store. Or how spoiled they are with git compared to svn. Or Perforce. *shudder* ---------------------------------------------------------------------- LordSkummel · 2023-12-14 15:33 Wait. was it just 8 years ago? Time flies I guess. ---------------------------------------------------------------------- TryHardEggplant · 2023-12-14 16:25 Yeah. Should’ve been around 2015 or so. ---------------------------------------------------------------------- PowerBillOver9000 · 2023-12-14 16:31 Security through obscurity is still security. As long as it's not the only layer in your security... ---------------------------------------------------------------------- onus-est-honos · 2023-12-14 19:10 Kerckhoff wouldn’t agree here. It might be a layer, but not a layer of security. ---------------------------------------------------------------------- Lazy-Fig-5417 · 2023-12-14 20:05 yes, this is good solution but what happen when you go with your laptop outside, for example you will connect to internet in work or school ... and your laptop try to connect to HIDDEN\_SUBDOMAIN.domain.com -> that means that resolver in stranger network will see what you are trying to reach and your laptop will try to connect to [1.2.3.4](https://1.2.3.4) what is not good i think, because it will maybe try you used session cookies .... I think that public dns provider should give [0.0.0.0](https://0.0.0.0) for \*.[domain.com](https://domain.com) and that means that your laptop will not try to make connection because [0.0.0.0](https://0.0.0.0) not exists ---------------------------------------------------------------------- jared252016 · 2023-12-14 20:12 With this said, I do still use multiple domains. I have my private personal domain that my network is also a part of, and my public domain. Due to Jellyfin not being allowed behind Cloudflare, I don't use the Cloudflare proxy to access them and my IP is public. I don't serve a website from this domain and it's not in any search results, where as my public domain has a website and mastadon under social.example.tld. ---------------------------------------------------------------------- julien-38 · 2023-12-15 08:22 Yes I agree, but should I use a separate domain (not subdomain) for very public things like Mastodon? ---------------------------------------------------------------------- thekrautboy · 2023-12-15 19:47 Doesnt make much difference imo. The most security issues come from improperly setting software up, having weak account security, using outdated software with known exploits and such things. Simply using a different domain for something doesnt impact that much by itself. ---------------------------------------------------------------------- bbyboi · 2023-12-17 09:41 Thank you