Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A story on home server security

raniseth.com

Post reply on HN
Print view View original

191–200 of 287 posts

Re: A story on home server security

#191

Post by j_bum »

vinay_ys wrote: post #188
j_bum wrote: post #164

Ok - curious if anyone can provide some feedback for me on this. I am running Immich on my home server and want to be able to access it remotely. I’ve seen the options of using wireguard or using a reverse proxy (nginx) with Cloudflare CDN, on top of properly configured router firewalls, while also blocking most other countries. Lots of this understanding comes from a YouTube guide I watched [0]. From what I understa…

Well, you are better off using Google Photos for securely accessing your photos over Internet. It is not a matter of securing it once, but one of keeping it secure all the time.

I suppose yes, it is more confident and “easy” to pay a cloud provider. But we have more data than I’m willing to flush away money for cloud storage.

As such, I’m hosting Immich and am figuring out remote access options. This kind of misses the point of my question.

Re: A story on home server security

#192

Post by Fnoord »

01HNNWZ0MV43FF wrote: post #136
Fnoord wrote: post #72

Earlier quoted context omitted.

I always have to define 'external: true' at the network. Which I don't do with databases. I link it to an internal network, shared with application. You can do the same with your web application, thereby only needing auth on reverse proxy. Then you use whitelisting on that port, or you use a VPN. But I also always use a firewall where OCI daemon does not have root access on.

I thought "external" referred to whether the network was managed by compose or not

Yeah, true, but I have set it up in such a way that such network is an exposed bridge whereas the other networks created by docker-compose are not. It isn't even possible to reach these from outside. They're not routed, each of these backends uses standard Postgres port so with 1:1 NAT it'd give errors. Even on 127.0.0.1 it does not work:

$ nc 127.0.0.1 5432 && echo success || echo no success no success

Example snippet from docker-compose:

DB/cache (e.g. Postgres & Redis, in this example Postgres):

    [..]
    ports:
      - "5432:5432"
    networks:
      - backend
    [..]
App:

    [..]
    networks:
      - backend
      - frontend
    [..]
networks: frontend: external: true backend: internal: true

Re: A story on home server security

#193

Post by dns_snek »

j_bum wrote: post #164

Ok - curious if anyone can provide some feedback for me on this. I am running Immich on my home server and want to be able to access it remotely. I’ve seen the options of using wireguard or using a reverse proxy (nginx) with Cloudflare CDN, on top of properly configured router firewalls, while also blocking most other countries. Lots of this understanding comes from a YouTube guide I watched [0]. From what I understa…

If you care about privacy I wouldn't even consider using Cloudflare or any other CDN because they get to see your personal data in plain "text". Can you can forward a port from the internet to your home network, or are you stuck in some CG-NAT hell?

If you can, then you can just forward the port to your Immich instance, or put it behind a reverse proxy that performs some sort of authentication (password, certificate) before forwarding traffic to Immich. Alternatively you could host your own Wireguard VPN and just expose that to the internet - this would be my preferred option out of all of these.

If you can't forward ports, then the easiest solution will probably be a VPN like Tailscale that will try to punch holes in NAT (to establish a fast direct connection, might not work) or fall back to communicating via a relay server (slow). Alternatively you could set up your own proxy server/VPN on some cheap VPS but that can quickly get more complex than you want it to be.

Re: A story on home server security

#195

Post by j_bum »

dns_snek wrote: post #193
j_bum wrote: post #164

Ok - curious if anyone can provide some feedback for me on this. I am running Immich on my home server and want to be able to access it remotely. I’ve seen the options of using wireguard or using a reverse proxy (nginx) with Cloudflare CDN, on top of properly configured router firewalls, while also blocking most other countries. Lots of this understanding comes from a YouTube guide I watched [0]. From what I understa…

If you care about privacy I wouldn't even consider using Cloudflare or any other CDN because they get to see your personal data in plain "text". Can you can forward a port from the internet to your home network, or are you stuck in some CG-NAT hell? If you can, then you can just forward the port to your Immich instance, or put it behind a reverse proxy that performs some sort of authentication (password, certificate)…

Yikes… I had no idea about CDN being able to see raw data.

> forward a port

From what I understand, my Eero router system will let me forward ports from my NAS. I haven’t tested this to see if it works, but I have the setting available in my Eero app.

> forward port to Immich instance

Can you expand on this further? Wouldn’t this just expose me to the same vulnerabilities as OP? If I use nginx as a reverse proxy, would I be mitigating the risk?

Based on other advice, it seems like the self hosted VPN (wireguard) is the safest option, but slower.

The path of least resistance for daily use sounds ideal (RP), but I wonder if the risk minimization from VPN is worth potential headaches.

Thanks so much for responding and giving some insight.

Re: A story on home server security

#196

Post by vinay_ys »

j_bum wrote: post #191
vinay_ys wrote: post #188

Earlier quoted context omitted.

Well, you are better off using Google Photos for securely accessing your photos over Internet. It is not a matter of securing it once, but one of keeping it secure all the time.

I suppose yes, it is more confident and “easy” to pay a cloud provider. But we have more data than I’m willing to flush away money for cloud storage. As such, I’m hosting Immich and am figuring out remote access options. This kind of misses the point of my question.

If cheap is what you are looking for, then yes, a wireguard running on your home server is the way to go. Instead of exposing your home-server directly to Internet, I would put it behind a cloudflare zero trust network access product (costs free).

Re: A story on home server security

#197

Post by akerl_ »

Fnoord wrote: post #192
01HNNWZ0MV43FF wrote: post #136

Earlier quoted context omitted.

I thought "external" referred to whether the network was managed by compose or not

Yeah, true, but I have set it up in such a way that such network is an exposed bridge whereas the other networks created by docker-compose are not. It isn't even possible to reach these from outside. They're not routed, each of these backends uses standard Postgres port so with 1:1 NAT it'd give errors. Even on 127.0.0.1 it does not work: $ nc 127.0.0.1 5432 && echo success || echo no success no success Example snipp…

Nobody is disputing that it is possible to set up a secure container network. But this post is about the fact that the default docker behavior is an insecure footgun for users who don’t realize what it’s doing.

Re: A story on home server security

#198

Post by Cyph0n »

smarx007 wrote: post #175
Cyph0n wrote: post #148

Earlier quoted context omitted.

Are you sure about that? Because I was under the impression that these firewall rules are configured by Docker. So if you use Docker Compose with Podman emulating the Docker socket, this shouldn’t happen. Maybe someone more knowledgeable can comment.

I think you are both correct, see https://news.ycombinator.com/item?id=42602429 - the socket would still listen on 0.0.0.0 but podman would not punch holes.

Aha, thanks for confirming! Yes, this was the behavior I was talking about.

I encountered it with Docker on NixOS and found it confusing. They have since documented this behavior: https://search.nixos.org/options?channel=24.11&show=virtuali...

Re: A story on home server security

#199

Post by dns_snek »

j_bum wrote: post #195
dns_snek wrote: post #193

Earlier quoted context omitted.

If you care about privacy I wouldn't even consider using Cloudflare or any other CDN because they get to see your personal data in plain "text". Can you can forward a port from the internet to your home network, or are you stuck in some CG-NAT hell? If you can, then you can just forward the port to your Immich instance, or put it behind a reverse proxy that performs some sort of authentication (password, certificate)…

Yikes… I had no idea about CDN being able to see raw data. > forward a port From what I understand, my Eero router system will let me forward ports from my NAS. I haven’t tested this to see if it works, but I have the setting available in my Eero app. > forward port to Immich instance Can you expand on this further? Wouldn’t this just expose me to the same vulnerabilities as OP? If I use nginx as a reverse proxy, wou…

> Can you expand on this further? Wouldn’t this just be exposing myself to the same vulnerabilities as OP?

Yeah I wouldn't do this personally, I just mentioned it as the simplest option. Unless it's meant to be a public service, I always try to at least hide it from automated scanners.

> If I use nginx as a reverse proxy, would I be mitigating the risk?

If the reverse proxy performs additional authentication before allowing traffic to pass onto the service it's protecting, then yes, it would.

One of my more elegant solutions has been to forward a port to nginx and configure it to require TLS client certificate verification. I generated and installed a certificate on each of my devices. It's seamless for me in day to day usage, but any uninvited visitors would be denied entry by the reverse proxy.

However support for client certificates is spotty outside of browsers, across platforms, which is unfortunate. For example HomeAssistant on Android supports it [1] (after years of pleading), but the iOS version doesn't. [2] NextCloud for iOS however supports it [3].

In summary, I think any kind of authentication added at the proxy would be great for both usability and security, but it has very spotty support.

> Based on other advice, it seems like the self hosted VPN (wireguard) is the safest option, but slower.

I think so. It shouldn't be slow per se, but it's probably going to affect battery life somewhat and it's annoying to find it disconnected when you try to access Immich or other services.

[1] https://github.com/home-assistant/android/pull/2526

[2] https://community.home-assistant.io/t/secure-communication-c...

[3] https://github.com/nextcloud/ios/pull/2908

Re: A story on home server security

#200

Post by josephcsible »

smarx007 wrote: post #16

Docker has a known security issue with port exposure in that it punches holes through the firewall without asking your permission, see https://github.com/moby/moby/issues/4737 I usually expose ports like `127.0.0.1:1234:1234` instead of `1234:1234`. As far as I understand, it still punches holes this way but to access the container, an attacker would need to get a packet routed to the host with a spoofed IP SRC set t…

It only exposes ports if you pass the command-line flag that says to do so. How is that "without asking your permission"?
Post reply on HN