Want host a password manager, but specific way reddit / selfhosted ---------------------------------------------------------------------- FUBUKIIIIII · 2023-12-23 11:51 I got told from multiple people that Bitwarden is a good password manager for self hosting, though i never used any password manager and never self hosted one. Is it possible to host it device independent: like, that it runs on my phone and on my pc at the same time, where they sync each other over the local network, depending on which password database is newer/older ? ---------------------------------------------------------------------- jhf2442 · 2023-12-23 11:57 actually you would host a bitwarden (or vaultwarden) *server*, to which *clients* (on different platforms) would connect and sync ---------------------------------------------------------------------- cakee_ru · 2023-12-23 12:06 No, it is not p2p. Server is required. ---------------------------------------------------------------------- FUBUKIIIIII · 2023-12-23 12:56 oh alright, guess i have to look for another pw manager ---------------------------------------------------------------------- Rare-Victory · 2023-12-23 13:19 I use KeePass I have the client installed on a Linux, and a Windows PC. Each client has a local file on the PC, and a backup on a samba share. Every time I save it merges the records between the local copy, and the samba share. On the samba share I run mirrored ZFS drives with daily snapshots one month back. The daily snapshots is then send to another physical server, also with mirrored drives, but with monthly snapshots stored forever. So the KeePass file is on 6 disks, if I have one am good. ---------------------------------------------------------------------- trynafindavalidname · 2023-12-23 13:33 Honest question. What’s the advantage of self-hosting Bitwarden vs. using their servers? Is it worth it for a relative noob such as myself (only doing Plex + *arrs + PiHole + Minecraft) to pursue given that it might trade some of the security of not done exactly correctly? ---------------------------------------------------------------------- g2g079 · 2023-12-23 13:36 Sounds like you're going for the most painful way possible. ---------------------------------------------------------------------- BootlessReddits · 2023-12-23 13:49 If you don't have enough disposable income for the subscription (mainly TOTP usage is common as a benefit for it), you can instead self host Vaultwarden (bitwarden rewritten in RUST with all premium features enabled) on any free tier VPS. I've used it on Oracle's free tier, and it has worked out very well for me in the last year. Other than that, your specific question to be answered is for keeping your data to yourself, and that's it ig. The above is a bonus if you'd like to go that way. ---------------------------------------------------------------------- BootlessReddits · 2023-12-23 13:50 So like... Syncthing but for password management? What's the benefit to the server-client model? ---------------------------------------------------------------------- user01401 · 2023-12-23 13:51 Yes, KeePass is the gold standard. I've been using KeePass2Android reliably on Android as well. ---------------------------------------------------------------------- flaming_m0e · 2023-12-23 13:54 >If you don't have enough disposable income for the subscription $10/year? ---------------------------------------------------------------------- Bonsailinse · 2023-12-23 13:59 You don’t need a server. I can see how this can be favorable. ---------------------------------------------------------------------- bigahuna · 2023-12-23 14:13 We use passbolt ---------------------------------------------------------------------- Geoffman05 · 2023-12-23 14:14 I self hosted Bitwarden on my server for a bit to see if I liked it. I liked it a lot so I moved to letting them worry about security, updates, and data resiliency. $10.00/year is well worth keeping the added stress off my plate. ---------------------------------------------------------------------- yarmak · 2023-12-23 14:16 What you're talking about is possible with [pass](https://www.passwordstore.org/), but not out of the box. It uses git for versioning of encrypted password, which in its turn can be syncronized via central server or via P2P interactions (like an export of `git bundle`). It even has mobile app and browser extensions. However, establishing such P2P sync of underlying git repo will require some hassle. ---------------------------------------------------------------------- sebampueromori · 2023-12-23 14:23 Yeah, I don't think money would be a major cause I selfhost it because the only thing I really care about is my passwords and I wont be trusting any online service, only myself ---------------------------------------------------------------------- daYMAN007 · 2023-12-23 14:35 No need to develope anything keepassxc works like this. ---------------------------------------------------------------------- North-Plantain1401 · 2023-12-23 14:40 Why not just store a keepass database on a shared drive like one drive or Google? ---------------------------------------------------------------------- FUBUKIIIIII · 2023-12-23 14:45 >keepassxc Gonna try it, thanks in advance ---------------------------------------------------------------------- Blockstar · 2023-12-23 14:49 The mobile app integrations seem to be less secure. ---------------------------------------------------------------------- sjustinas · 2023-12-23 14:50 I use a similar solution as well. The password manager is KeePassXC (a more maintained fork), and I sync between all of my devices with Syncthing. That said, there's a few important caveats: * Syncthing is P2P, so that means if your devices are rarely online at the same time, they will not have a chance to sync. Since I already have a 24/7 server, I run another Syncthing instance there, so other devices always have something to sync with. * Android is notorious for [killing off apps running in the background](https://dontkillmyapp.com/). This is obviously problematic for the Android Syncthing client * Sync conflicts are possible, and there's AFAIK no good way to "merge" them as you could with text files * I would strongly recommend independent backups of your password vault to avoid locking yourself out of everything. Neither RAID, nor file sync solutions are a backup. The parent comment outlines one possible setup for backups. ---------------------------------------------------------------------- Trubanaught · 2023-12-23 14:56 I also use Keepass. I have it located in my self-hosted Nextcloud instance. One of the amazing things about Keepass is that it can directly open a WebDAV URL, so from desktop or mobile, the experience is like opening a local file, but it actually pulls from and saves to the server. This works especially well where I don't want to install the full Nextcloud sync client. ---------------------------------------------------------------------- Ok_Temperature_5019 · 2023-12-23 15:08 I started playing around with this. Then I acknowledged to myself that I know next to nothing about security and realized that somethings are better left to the experts. Bitwarden hosted is free. I chose to leave this one alone. That's my two cents. ---------------------------------------------------------------------- paulstelian97 · 2023-12-23 15:08 It can P2P as opposed to just using the local file which you manage yourself? ---------------------------------------------------------------------- daYMAN007 · 2023-12-23 15:17 No but you can sync the keyfile yourself to whatever you want. ---------------------------------------------------------------------- Grizzlechips · 2023-12-23 15:26 Not sure if people are understanding your question here, but Vaultwarden works this way exactly. There’s an initial sync from your library to your phone, but then each device syncs from the other one, depending on which one has been updated most recently. ---------------------------------------------------------------------- geo38 · 2023-12-23 16:13 If you run a server on your pc, then vaultwarden/bitwarden clients on your pc and phone would work just as you described. ---------------------------------------------------------------------- AdScared1251 · 2023-12-23 16:23 I use syncthing to sync my kdbx file and then open with respective clients on my devices. KeepassXC on desktop and KeepassDX on Android. Only problem I've ever had is every once in a while a sync conflict occurs, usually caused by my windows vm for whatever reason. Can easily be remedied by just merging the database through KeepassXC if you're unsure about it something was lost. Otherwise a solid solution. ---------------------------------------------------------------------- Front_House · 2023-12-23 16:38 The best way and to ensure security, create an excel spreadsheet and call it NotPasswords.xlsx ---------------------------------------------------------------------- casce · 2023-12-23 16:41 He probably wants the passwords stored on both his phone and and his computer locally so he can access them both on his phone and his pc and they never leave his devices or his network. In that case he doesn't really need to host anything at all, just use a password manager that runs on both your phone and your PC and then somehow automate a synchronisation between the underlying databases ---------------------------------------------------------------------- geo38 · 2023-12-23 16:59 Ah. Yes. Good distinction. I only played with vaultwarden briefly and didn’t realize the clients didn’t keep an offline copy. I run codebook on my desktop, phone, and tablet. Each has their own copy, and they can sync with the version running on the desktop ---------------------------------------------------------------------- trekkie86 · 2023-12-23 17:23 They do keep an offline copy. The syncing to the server just ensures it's updated. I don't know if the local copy expires if it hasn't synced in X time. ---------------------------------------------------------------------- Capable_Agent9464 · 2023-12-23 17:49 We self-hosted Vault on a server to which my team could connect to and get their passwords, keys, and hashes. ---------------------------------------------------------------------- FUBUKIIIIII · 2023-12-23 18:02 alright im now using KeyPassXC and windows pc and android together where the database is synced over a local ftp server ---------------------------------------------------------------------- alex2003super · 2023-12-23 18:14 Sounds like you want Syncthing combined with any Keepass variant of your choice ---------------------------------------------------------------------- Tech88Tron · 2023-12-23 18:44 If someone can't $10 a year, they can't afford hardware to self host. ---------------------------------------------------------------------- Oujii · 2023-12-23 18:46 Yes, but they can host it on Google, Oracle or Fly.io for free. ---------------------------------------------------------------------- Yosyp · 2023-12-23 19:05 KeepassXC has cache functionality on Android ---------------------------------------------------------------------- adamshand · 2023-12-23 19:07 The same advantages of selfhosting anything. Most of it boils down to control and privacy. I really dislike the idea of having all my passwords sync'd to somebody else's cloud. It doesn't make sense to me to store my passwords on a service that is constantly being targeted by professional hackers (and probably state backed hackers). So I'm willing to take the responsibility and risk of selfhosting my own passwords. ---------------------------------------------------------------------- Anand999 · 2023-12-23 19:08 Syncthing and KeepassXC works great for me. I haven't been able to get Syncthing and Keepass2Android to work the way I want on my phone, so on my phone I have Keepass2Android get the file via SFTP from one of the machines that's part of my Syncthing cluster. ---------------------------------------------------------------------- Tech88Tron · 2023-12-23 19:11 "Self host on a hosted service" WTF ---------------------------------------------------------------------- ayoungblood84 · 2023-12-23 19:17 I self host VW and it is only accessible on my wifi. If I'm out and about all of the passwords are still cached I just cannot make changes. Advantage: very secure. Too often even these password companies make mistakes or are hacked and there goes all your info to the dark web. No thanks. Oh and it's nearly free as that server is running the same stuff you have. ---------------------------------------------------------------------- Oujii · 2023-12-23 19:30 Unless you are your own datacenter and ISP, you are always on a hosted service. Sorry to break it to you. ---------------------------------------------------------------------- weeklygamingrecap · 2023-12-23 19:40 This is the answer for the OP, you can host bitwarden locally, use an app on your phone and a plugin in your browser and it never has to leave your local network for connections. ---------------------------------------------------------------------- FUBUKIIIIII · 2023-12-23 19:45 I've now solved my problem, im using KeypassXC and Keypass2Android but without Syncthing, I've connected these 2 devices over a local ftp server running on my PC, and Keypass on both devices should do the syncing automatically i think. ---------------------------------------------------------------------- milkman3407 · 2023-12-23 19:48 Vaultwarden self hosted server. Then use bitwarden client side. ---------------------------------------------------------------------- user01401 · 2023-12-23 19:49 They're not. It uses it's own internal keyboard for security, uses the same encryption algorithm as desktop, and the database is encrypted at rest. ---------------------------------------------------------------------- kaanyalova · 2023-12-23 19:58 Syncthing + KeepassXC/DX ---------------------------------------------------------------------- Tech88Tron · 2023-12-23 20:15 Okay buddy. When I own the server, I own the firewall, that means I own and control the data. The entire point of self hosting. When you "self host" in the cloud you DO NOT own or have complete control over the data....so you ARE NOT self hosting, my guy ---------------------------------------------------------------------- bobowhat · 2023-12-23 20:15 If you are only keeping passwords for yourself, there is no clear advantage. However, if you are hosting passwords that need to be shared within an organization/group there is a large advantage. ---------------------------------------------------------------------- ayoungblood84 · 2023-12-23 20:30 I should add, I run pfsense and openvpn so if, for some reason I need to update a critical password while not at home I can. ---------------------------------------------------------------------- tomhasser · 2023-12-23 20:39 I's suggest against this, but to reach your goal, you could let Syncthing two-way-sync a keepass file between pc and phone. Then open that file on phone or pc with a keepass client of you choice. One its changed on the phone, it will be synced to the pc and vice versa. ---------------------------------------------------------------------- malferro · 2023-12-23 20:40 Sounds like you want KeePassXC and Syncthing. ---------------------------------------------------------------------- LeeHide · 2023-12-23 20:42 My setup is KeePass plus syncthing, thats ends up being p2p like you want. ---------------------------------------------------------------------- ZaxLofful · 2023-12-23 20:49 If you mean, will it work on any device….Yes, it already does all of that. And they will update each other when connected to the main server. You still need the main server to host it though! ---------------------------------------------------------------------- Zeal514 · 2023-12-23 20:57 Bitwarden/vaultwarden does this by default. Though I'd recommend hosting it publically, either with a free domain or cloud flare or something. Bitwarden doesn't check in with the home server every use case, it saves it on the client in a cache... ---------------------------------------------------------------------- Karoolus · 2023-12-23 21:16 Yes, but also no. If you rent a VPS and run the service on there, setup iptables + fail2ban to block all incoming traffic except yours and setup a Wireguard tunnel to your LAN, you can self host in the cloud. If you have enough control over the OS, this is all possible. Encrypt the drive so the hoster can't see what's on it and you're good to go ---------------------------------------------------------------------- TremulousTones · 2023-12-23 21:23 This is quite feasible with syncthing and KeePassXC ---------------------------------------------------------------------- LinkeSpurParker · 2023-12-23 21:32 KeePass + SyncThing would fit your use case ---------------------------------------------------------------------- Avanchnzel · 2023-12-23 21:53 Isn't it that you *can* make changes, but they're not synced until you're back in your network? ---------------------------------------------------------------------- enfly · 2023-12-23 22:00 you mean $10/mo? ---------------------------------------------------------------------- jmeador42 · 2023-12-23 22:12 I would switch to KeePassXC before I self hosted Bitwarden if this is for personal use only. ---------------------------------------------------------------------- flaming_m0e · 2023-12-23 22:14 No. I pay $10/year for bitwarden....family ---------------------------------------------------------------------- ayoungblood84 · 2023-12-23 22:18 Maybe it is my version, but my android BW app doesn't like changes when bw is not accessible. ---------------------------------------------------------------------- sevengali · 2023-12-23 22:43 I find it pretty hit and miss. My living conditions have recently changed and I can't run my server 24/7 anymore. I've basically just stopped using it as anything other than a NAS because of this, if I want to watch some TV shows on it I just turn it on and play the files in MPV etc. It's been over two months since DNS has routed correctly to my server. My Firefox browser extension still works even though it's not contacted Vaultwarden in over two months. I could never get offline access working on my Android phone even when I did have my server running. I'd always have to VPN up. ---------------------------------------------------------------------- unkazak · 2023-12-23 23:45 >Too often even these password companies make mistakes or are hacked and there goes all your info to the dark web Is not all the data hashed? Even if data is leaked, would be near impossible for anyone to use it. ---------------------------------------------------------------------- AnomalyNexus · 2023-12-23 23:50 > What’s the advantage of self-hosting Bitwarden vs. using their servers? Security. The major providers have a giant bullseye painted on their back. It's a juicy target & on the open internet. It's a bit like declaring that something is unhackable. After that it is only a matter of time. My self-hosted setup is way more janky security wise, but lets be honest no serious hacker is going to spend the time & effort to getting into my network, and fishing out the password data to what...reddit logins. lol ---------------------------------------------------------------------- trynafindavalidname · 2023-12-24 00:22 Haha, fair point! Thanks for the response all. I haven’t checked out the docs on Bitwarden/Vaultwarden… do y’all recommend? ---------------------------------------------------------------------- Farmer_Pete · 2023-12-24 00:32 Weird. My phone works fine offline. Had my Internet go down during an extended power outage. While my server and network was up, all of my vault warden stuff is setup with an external DNS address. So nothing could talk to it natively. Still worked great offline on my phone and work laptop. ---------------------------------------------------------------------- AnomalyNexus · 2023-12-24 00:34 You can use the official bw extension with either. On the back end...bw is the official thing but heavier than vault...but you're also trusting some random dude's code. ---------------------------------------------------------------------- stackPeek · 2023-12-24 01:25 Why is this downvoted? Why is the parent comment deleted? ---------------------------------------------------------------------- tx69er · 2023-12-24 03:21 Just use bitwarden out of the box and it works the way you want. You can run it on your pc and phone and it syncs both ways. You don't even need to self host it (but you can if you want) you can use the default servers for free. The people telling you that it doesn't work p2p are misunderstanding what you are trying to achieve. ---------------------------------------------------------------------- a_sugarcane · 2023-12-24 04:49 What your are looking for is KeePassXC. It works exactly the way you want. I use syncthing to sync password database file. ---------------------------------------------------------------------- ButterscotchFar1629 · 2023-12-24 04:57 Vaultwarden. ---------------------------------------------------------------------- ButterscotchFar1629 · 2023-12-24 04:58 I use Vaultwarden and my passwords are synced to my phone even if my server is offline. ---------------------------------------------------------------------- Beneficial_Company_2 · 2023-12-24 04:59 Subscribe to 1pass or alike. They have apis to manage password aside from their desktop and mobile app. ---------------------------------------------------------------------- ModernSimian · 2023-12-24 06:54 Try my new hunter2 blockchain. Each site password combination is issued as a NFT encrypted with a private key kept on your devices. ---------------------------------------------------------------------- InternationalAd1304 · 2023-12-24 07:54 Bitwarden/Vaultwarden does exactly what you want, out of the box. ---------------------------------------------------------------------- g2g079 · 2023-12-24 08:13 I can't find anything about a ******* blockchain. ---------------------------------------------------------------------- Kenzijam · 2023-12-24 09:28 Your memory could still get dumped or your memory leaked by some novel CPU exploit. I would agree with the other guy that if it's not on your own hardware, it's not self hosting. Either you trust bitwarden to not get hacked or you trust AMD/intel and/or oracle/fly.io not to. Self hosting is supposed to be completely within your realm of control. ---------------------------------------------------------------------- cjwebster93 · 2023-12-24 09:44 I just use BitWarden’s servers, but for your needs I’d also suggest KeePass or one of its forks and you can either p2p sync with syncthing or stick your database on something like Google Drive or OneDrive etc. as at the end of the day those 3rd parties can’t read the contents so it’s still a perfectly good solution. ---------------------------------------------------------------------- einstein987-1 · 2023-12-24 10:15 KeePass has an extension to safely sync 2 databases. I've been running it for at least a year now and it's proven to be flawless. You need to open both dbs so the password prompt is inevitable. ---------------------------------------------------------------------- purepersistence · 2023-12-24 10:34 I continue to self host. I have a bunch of services on my local network and SSH etc all protected with secure logins thru bitwarden. It would suck to not have bitwarden just because the internet is down. ---------------------------------------------------------------------- purepersistence · 2023-12-24 10:41 The real product on a linux VM is my preference. https://bitwarden.com/help/install-on-premise-linux/ ---------------------------------------------------------------------- purepersistence · 2023-12-24 10:48 >then each device syncs from the other one, depending on which one has been updated most recently The devices do not talk to each other. All devices synch with the bitwarden/vautwarden server. ---------------------------------------------------------------------- xkcd__386 · 2023-12-24 11:58 > Sync conflicts are possible, and there's AFAIK no good way to "merge" them as you could with text files true. however, if somehow you do get a conflict, KeePassXC has a merge database feature that is pretty damn good at preserving data. I have tested it fairly rigorously at one time (about 2 years ago), and the only time you lose data is if both sides change the same item in different ways. worth keeping in mind ---------------------------------------------------------------------- xkcd__386 · 2023-12-24 11:59 I see lots of people suggesting self-host bw, and I worry "do the people who listen to them realise they need to secure their servers now"? it's not trivial... ---------------------------------------------------------------------- Grizzlechips · 2023-12-24 12:51 If I add a password on mobile, the password doesn’t show up on the server machine archive until the sync happens. If I wanted to restore an archive on a new server, I could export from mobile and use that to restore a new Vaultwarden instance. I know that because I can still access all of my passwords even in Airplane Mode. That’s a back and forth dialogue. ---------------------------------------------------------------------- ayoungblood84 · 2023-12-24 13:51 Depends on the level of access the bad actors have. Usually what you are saying is true, however. But again, I don't want to rest on that Laurel as all too often that is not true and you end up with "free credit monitoring for a year because we suck" emails. ---------------------------------------------------------------------- purepersistence · 2023-12-24 14:11 >If I **add a password** on mobile, the password doesn’t show up on the server machine archive until the sync happens If I'm in airplane mode and try to add a new login I'll get told that it can't do it while I'm not connected to the internet. If I AM connected to the internet the server gets updated immediately. ---------------------------------------------------------------------- Grizzlechips · 2023-12-24 14:20 I just tested this and you’re absolutely correct. My mistake. I could have sworn I’d done that in the past, almost would have bet money on it. 😅 ---------------------------------------------------------------------- Zealousideal_Mix_567 · 2023-12-24 15:16 Even for personal it's fantastic. All my passwords are on my server, not someone else's. ---------------------------------------------------------------------- 404invalid-user · 2023-12-24 16:21 does the $10 a year include adding and being able to manage other users? main reason i currently selfhost ---------------------------------------------------------------------- Coalbus · 2023-12-24 22:42 I started self-hosting Bitwarden after my Bitwarden,com vault all of the sudden stopped working. The password that I’ve used a thousand times to unlock my vault wouldn’t unlock my vault anymore. Bitwarden support assures me that it’s my fault for forgetting the password. Actually, that’s a very uncharitable retelling because the support person I emailed was extremely thorough in their email with things to try to regain access, but at the end of the day it boils down to “you must’ve forgotten your password”. There was a Bitwarden outage that day, confirmed by multiple people reporting issues on the Bitwarden subreddit, even though Bitwarden’s own status page never reported issues. After that I lost all access. I decided if someone’s going to lose all my passwords, it should be me, so I started self-hosting. It was very easy to setup and I’ve had no issues since I set it up. I’d rather be mad at myself for screwing something up than at some faceless entity in the cloud. At least I know where I live and can enact proper retribution against myself for being a bozo. ---------------------------------------------------------------------- Coalbus · 2023-12-24 22:45 My solution for this is a WireGuard VPN. I have it configured to automatically turn on any time I’m not connected to my home WiFi SSID. Always have access to Bitwarden and all my other self-hosted services like AdGuard Home and whatnot. ---------------------------------------------------------------------- Avanchnzel · 2023-12-24 23:25 I'm using a VPN for this as well, but I was just curious if belated syncing didn't work for them even when they came back into their WiFi. ---------------------------------------------------------------------- king_hreidmar · 2023-12-25 05:52 I have to +1 Vaultwarden. It’s reliable, there are container images, it’s easy to run bare metal (single binary), every device you sync to is basically another backup. It’s e2e encrypted and so safer to host on a cloud provider. It’s super light weight so you can run it on a pi or whatever you have laying around. It’s extremely easy to automate backups as well. ---------------------------------------------------------------------- TBT_TBT · 2023-12-25 20:02 Security by obscurity is no security at all. You could counter argue, that the password Hosters have to and are deeply invested in the security of their vault hosting and that it is therefore more secure to host there. Another argument: if a self hosting environment gets destroyed by the user him/herself, the password manager might also be gone. I am all for self hosting. But I keep my passwords with 1Password. ---------------------------------------------------------------------- AnomalyNexus · 2023-12-25 20:39 >Security by obscurity is no security at all. The predictable soundbite. That's not what is going on here though. It's merely recognition that risk profile (nuclear codes vs grandmother's recipe) determines who's coming after you and thus minimum level of security needed. ---------------------------------------------------------------------- TBT_TBT · 2023-12-25 21:42 The soundbite ist true however. It is highly questionable if a „grandmother‘s recipe“ is really no target. It could be bycatch from a mindless crypto trojan. Having the password vault encrypted by ransomware is just as bad. ---------------------------------------------------------------------- teabag_ninja · 2023-12-26 10:59 I use KeepassXC and KeepassXD and use Syncthing on my phone and laptop and desktop to keep them all in sync.