Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A story on home server security

raniseth.com

Post reply on HN
Print view View original

271–280 of 287 posts

Re: A story on home server security

#271

Post by diggan »

phartenfeller wrote: post #224
diggan wrote: post #123

Earlier quoted context omitted.

> I think the takeaway here is that the pg image should autogenerate a strong password or not start unless the user defines a strong one. Currently it just runs with "postgres" as the default username and password. Takeaway for beginner application hosters (aka "webmasters") is to never expose something on the open internet unless you're 100% sure you absolutely have to. Everything should default to using a private n…

There are ton of hobby VPSes with a simple website, CMS, email server, or maybe a Plex. Do you really think that these kind of scenarios should use a bastion host?

Since we're talking about a home network, definitely. Don't accept connections from public internet straight into your home unless you're OK with the consequences of that.

Re: A story on home server security

#272

Post by anthropodie »

smarx007 wrote: post #100
somebehemoth wrote: post #81

Earlier quoted context omitted.

podman rootless running services with quadlet is not a bad start.

Is there a tool/tutorial that assumes that I already have a running docker compose setup instead of starting with some toy examples? Basically, I am totally excited about using systemd that I already have on my system instead of adding a new daemon/orchestrator but I feel that the gap between quadlet 101 and migrating quite a complex docker compose YAML to podman/quadlet is quite large.

Search for podlet. It lets you do what you want.

Re: A story on home server security

#273

Post by Volundr »

globular-toast wrote: post #264
Volundr wrote: post #143

Earlier quoted context omitted.

Do you not run firewalls on your internal facing machines to make sure they only have the correct ports exposed? Security isn't just an at the edge thing.

No. That would be incredibly annoying and it's probably why docker overrides it as it would cause all manner of confusion.

You really, really should. Just because someone is inside your network is no reason to just give them the keys to the kingdom.

And I don't see any reason why having to allow a postgres or apache or whatever run through docker through your firewall any more confusing than allowing them through your firewall installed via APT. It's mor confusing that the firewall DOESN'T protect docker services like everything else.

Re: A story on home server security

#274

Post by tomjen3 »

diggan wrote: post #223
tomjen3 wrote: post #220

Earlier quoted context omitted.

To run Docker, you need to be an admin or in the Docker group, which warns you that it is equivalent to having sudo rights, AKA be an admin. As for it not being explicitly permitted, no ports are exposed by default. You must provide the docker run command with -p, for each port you want exposed. From their perspective, they're just doing exactly what you told them to do. Personally, I think it should default to givin…

I don't remember the particular syntax, but isn't there a different to binding a port on the address the container runs on, VS binding a port on the host address? Maybe it's the difference between "-P" and "-p", or specifying both "8080:8080" instead of "8080", but there is a difference, especially since one wouldn't be reachable outside of your machine and the other one would be on worse case trying to bind 0.0.0.0.

-p exposes the port from the container on a specific port on the host machine. -P does the same, but for all ports listed as exposed in the container.

If you just run a container, it will expose zero ports, regardless of any config made in the Docker image or container.

The way you're supposed to use Docker is to create a Docker network, attach the various containers there, and expose only the ports on specific containers that you need external access to. All containers in any network can connect to each other, with zero exposed external ports.

The trouble is just that this is not really explained well for new users, and so ends up being that aforementioned foot gun.

Re: A story on home server security

#275

Post by nitwit005 »

bluedino wrote: post #30
smarx007 wrote: post #16

Docker has a known security issue with port exposure in that it punches holes through the firewall without asking your permission, see https://github.com/moby/moby/issues/4737 I usually expose ports like `127.0.0.1:1234:1234` instead of `1234:1234`. As far as I understand, it still punches holes this way but to access the container, an attacker would need to get a packet routed to the host with a spoofed IP SRC set t…

Containers are widely used at our company, by developers who don't understand underlying concepts, and they often expose services on all interfaces, or to all hosts. You can explain this to them, they don't care, you can even demonstrate how you can access their data without permission, and they don't get it. Their app "works" and that's the end of it. Ironically enough even cybersecurity doesn't catch them for it, t…

There are certainly people that don't care about security out there, but the biggest issue is just how much people are expected to know.

Docker, AWS, Kubernetes, some wrapper they've put around Kubernetes, a bunch of monitoring tools, etc.

And none of it will be their main job, so they'll just try to get something working by copying a working example, or reading a tutorial.

Re: A story on home server security

#276

Post by smarx007 »

anthropodie wrote: post #272
smarx007 wrote: post #100

Earlier quoted context omitted.

Is there a tool/tutorial that assumes that I already have a running docker compose setup instead of starting with some toy examples? Basically, I am totally excited about using systemd that I already have on my system instead of adding a new daemon/orchestrator but I feel that the gap between quadlet 101 and migrating quite a complex docker compose YAML to podman/quadlet is quite large.

Search for podlet. It lets you do what you want.

WOW, thank you!

Re: A story on home server security

#277

Post by dizhn »

josephcsible wrote: post #200
smarx007 wrote: post #16

Docker has a known security issue with port exposure in that it punches holes through the firewall without asking your permission, see https://github.com/moby/moby/issues/4737 I usually expose ports like `127.0.0.1:1234:1234` instead of `1234:1234`. As far as I understand, it still punches holes this way but to access the container, an attacker would need to get a packet routed to the host with a spoofed IP SRC set t…

It only exposes ports if you pass the command-line flag that says to do so. How is that "without asking your permission"?

It should have the proxy set up but leave opening the port to the user.

No other sever software that I know of touches the firewall to make its own services accessible. Though I am aware that the word being used is "expose". I personally only have private IPs on my docker hosts when I can and access them with wireguard.

Re: A story on home server security

#278

Post by dfsegoat »

malfist wrote: post #121
dfsegoat wrote: post #69

Earlier quoted context omitted.

I feel this. Recently implemented a very trivial “otp to sign an electronic document” function in our app. Security heard “otp” and forced us through a 2 month security/architecture review process for this sign-off feature that we built with COTs libraries in a single sprint.

Oh I know that feeling. We got in hot water because the codes were 6 digits long and security decided we needed to make them eight digits. We pushed back and initially they agreed with us and gave us an exception, but about a year later some compliance audit told them it was no longer acceptable and we had to change it ASAP. About a year after that they told us it needed to be ten characters alphanumeric and we did a…

Heh. We also got treated to the digit thing. That topic alone was about 30 mins of mtg. time with a vp of eng and 2 seniors in the mtg.

Re: A story on home server security

#279

Post by immibis »

Fnoord wrote: post #257
jcgl wrote: post #243

Earlier quoted context omitted.

I hope you'll reconsider your stance on Tor exit nodes; many people use the Tor network to avoid censorship or even just bolster their own privacy. Blacklisting users on the basis of their Tor usage is hostile to their goals of privacy and anti-censorship.

There's no reason Tor exit nodes need to access my home network. Zero. I do use BitTorrent but behind a VPN; this remains unaffected, though if it were I would block traffic which isn't supposed to go through Tor (since BitTorrent over Tor is not recommended). As a rule of thumb, I will gladly pass on Tor traffic, but no exit node, and I understand if network admins want to block entry node, too. It is a decision eve…

You don't have to help commercialize it.

Re: A story on home server security

#280

Post by sureglymop »

smarx007 wrote: post #16

Docker has a known security issue with port exposure in that it punches holes through the firewall without asking your permission, see https://github.com/moby/moby/issues/4737 I usually expose ports like `127.0.0.1:1234:1234` instead of `1234:1234`. As far as I understand, it still punches holes this way but to access the container, an attacker would need to get a packet routed to the host with a spoofed IP SRC set t…

I use rootless docker and then also do this for my traefik container. Then, a bit of nftables config to expose to the outside world.
Post reply on HN