As the title says ive started running webmin. And i wanna know if its safe for me to reverse proxy (with 2fa) or should i just use tailscale or ssh to access it.
You must log in or register to comment.
- curbstickle@anarchist.nexusEnglish10 days
Considering the vulnerabilities that have been found just this past year, I sure wouldn’t. Use a VPN.
- slazer2au@lemmy.worldEnglish10 days
It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale. - LewdLemon@sh.itjust.worksEnglish9 days
Why would you want to expose it to the web in the first place? In a homelab scenario, you’re the only one who needs access, so putting it behind a VPN comes at zero convenience or monetary cost.
- ITGuyLevi@programming.devEnglish9 days
My homelab stuff I like to be able to access from places that take all my free time (like work), making things accessible is a bit of a requirement for me.
- LewdLemon@sh.itjust.worksEnglish9 days
That’s fair, but I still can’t see how a VPN connection makes your stuff less accessible - at least to you.
- ITGuyLevi@programming.devEnglish9 days
Just by making it so I can’t access from a system I don’t control. Like say I need to retrieve a document from my house, but I’m in a SCIF, or a waiting room, or anywhere else I wouldn’t have my personal device, it’s super useful to just connect to something like Nextcloud and pull it down.
- LewdLemon@sh.itjust.worksEnglish9 days
I didn’t say you should put your Nextcloud instance behind a VPN. Mine is public too.
I’m saying you should put your administrative access behind a VPN. SSH, reverse proxy admin panel, you name it. You need not do administrative stuff from work.
- ITGuyLevi@programming.devEnglish9 days
Oh yeah, I 100% agree with that, honestly two VPNs are better given you wouldn’t want your normal VPN to terminate into your management vlan (nor should you want your management vlan to have access to the internet). I thought we were just discussing normal homelab stuff, all administrative stuff should really be oob.
- ITGuyLevi@programming.devEnglish9 days
Hmm… Where I work setting up a VPN on my work machine would not only break my workflow, it would probably cost me my job. Plus I’m not a big fan of giving computers I don’t control access to the internals of my network. Reverse proxies were invented for a reason, no reason not to use one.
9 daysI think you might be drastically misunderstanding what a reverse proxy does.
Reverse proxy: Gives EVERY computer a direct connection to your network if you make it public, which it certainly sounds like you mean.
VPN: gives only you access to your internals.
In terms of connecting from work and not allowing some untrusted computer, there’s a hundred different options, even running portable QEMU from a USB and using that trusted virtual machine to connect.
- ITGuyLevi@programming.devEnglish8 days
USB’s are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it’s essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ.
VPNs allow you to become part of a virtual network (like one you aren’t physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy).
- fancy_pants@reddthat.comEnglish9 days
I had it exposed for maybe ten years (mostly so that users could manage their accounts), nothing bass happened, but i have shut down that server about a year before the ai security disaster, so ymmv
- crandall@lemmy.todayEnglish10 days
Is tail scale really that much more secure than reverse proxy and auth control?
- frongt@lemmy.zipEnglish10 days
Not necessarily. But it’s one service, compared to multiple, which could each have their own vulnerabilities. It’s about reduction of risk.
- Lka1988@lemmy.dbzer0.comEnglish10 days
Tailscale is just wireguard with a central management console.
- epyon22@sh.itjust.worksEnglish10 days
Tailscale and wire guard, it’s underlying vpn application, have a big stake in being secure. Webmin not as much more focused on providing features and being secure. There is much more surface areas for a web application over a simple vpn service. And self hosted you probably aren’t implementing intrusion monitoring as serious as tailscale web services would.
- Creat@discuss.tchncs.deEnglish10 days
Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible. This is fundamentally different than for example a web interface, which needs to present “the Web page” to allow the user to log in, which might involve multiple individual parts that can already have a 0-day.
As a more direct comparison: look into historic vulnerabilities between ipsec VPN and SSL VPN. The former is the older technology, the second is more “web like”. The number of serious CVEs for the latter over just some manufacturers (Cisco, fortinet, …) in one year probably beats the number for ipsec in is entire life time.
Going back to Tailscale (or netbird, …): it is one very secure layer which then secures everything. You can have 1 service or 20, same security. If you expose individual services, c you also expose every possible vulnerability of all of them, so all 20 services if that’s what you run.
- crandall@lemmy.todayEnglish10 days
Makes sense. Its unfortunate though that it presents a hurdle for end users. My users need to hit a webpage and acesss stuff, asking them to connect to a VPN client is too much.
- Creat@discuss.tchncs.deEnglish10 days
It’s all a matter of what you consider reasonable risk. I also run some specific services exposed where it makes sense (they are designed to do this, think things like home assistant or next cloud or jellyfin), but would never put anything that is used to do server administration public facing (Webmin, Termix, proxmox, that sort of thing). If the purpose of the tool is to perform or allow elevated actions, I run it behind a VPN (yes for me that includes ssh).
There’s also a difference between being randomly port scanned and/or probed, or being actively and personally targeted for some reason. If the second is ever a reasonable threat, that changes what is acceptable dramatically as well.
- Lka1988@lemmy.dbzer0.comEnglish10 days
Yes, and it’s very useful. Cockpit, too.
I would never expose either of them to the internet.
- 10 days
I use cockpit, but via the client. They have a flatpak client that gives you cockpit’s features, connects over ssh (and reuses your ssh config), and doesn’t require anything to be installed on the host/server you are managing (besides ssh ofc).
