41–50 of 81 posts
Earlier quoted context omitted.
Just put up basic auth infront of your services and be done with it.
the fact that we have to keep reinventing kerberos all the time because it doesn't speak http is starting to legitimately annoy me.
Earlier quoted context omitted.
Just put up basic auth infront of your services and be done with it.
the fact that we have to keep reinventing kerberos all the time because it doesn't speak http is starting to legitimately annoy me.
Chrome, Firefox, Internet Explorer -- all support some form of kerberos auth in HTTP/HTTPS.
Earlier quoted context omitted.
the fact that we have to keep reinventing kerberos all the time because it doesn't speak http is starting to legitimately annoy me.
HTTP auth can work with kerberos. Chrome, Firefox, Internet Explorer -- all support some form of kerberos auth in HTTP/HTTPS.
I've been using the LSIO Webtop images for a few years. They're awesome for composable desktops that I run behind a VPN for a quick and easy dirty connection at home. Combine the Webtop images by forcing it's traffic through the Gluetun [0] container and you're up and running. These Webtop containers are nice and snappy as well thanks to Kasm. Awesome OSS. [0] https://github.com/qdm12/gluetun
This is me being rather lazy admittedly, but do you have a compose/similar for connecting them by chance?
Earlier quoted context omitted.
Just put up basic auth infront of your services and be done with it.
I've done that in the past, even for securing the admin pages of some software (there was once an issue where the admin page auth could be bypassed, this essentially adds another layer). With TLS it's okay for getting something up and running quickly. Of course, for the things that matter a bit more, you can also run your own CA and do mTLS, even without any of the other fancy cloud services.
The guides I find often contain the openssl incantations with little explanation so I feel a bit like stumbling through the dark. I realize how much I've taken stacktraces for granted when this auth stuff is very "do or do not, there is no error"
[0] https://github.com/alangrainger/immich-public-proxy/blob/mai...
Earlier quoted context omitted.
There are operations that put cryptominers into any unauthenticated remote desktops they can find. Ask me how I know... Way friendlier than wiping your data though.
There are groups of people who hunt for writeable ftp servers to be used for random filesharing. At least this used to be a thing
Earlier quoted context omitted.
Yeah, I made a mistake with my config. I had setup SWAG, with Authelia (i think?). Got password login working with 2fa. But my dumbass didn't realize I had left ports open. Logged in one day to find a terminal open with a message from someone who found my instance and got in. Called me stupid (I mean they're not wrong) and all kinds of things and deleted everything from my home drive to "teach me a lesson". Lesson pa…
But you can have Obsidian access from any device already if you easily setup syncing using the official method (and support the project by doing so) or one of the community plugins. Doing it this normal way avoids opening up a massive security hole too.
It surprises and annoys me that obsidian, logseq, etc don't have self hosted web front ends available. I think logseq will once they wrap up the db fork, and maybe someday we'll have nuclear fusion powerplants too.
> "Warning Do not put this on the Internet if you do not know what you are doing. By default this container has no authentication and the optional environment variables CUSTOM_USER and PASSWORD to enable basic http auth via the embedded NGINX server should only be used to locally secure the container from unwanted access on a local network. If exposing this to the Internet we recommend putting it behind a reverse pro…