81–90 of 100 posts
Earlier quoted context omitted.
It is all included in their Docker compose file.
I use Kubernetes But also what about the whole lifecycle? I can easily deploy a HA Postgres cluster that is backed up for me. I'd have to do the same thing to back up BW.
Earlier quoted context omitted.
If you're running on kubernetes, a simple network policy and blocking the container from using DNS will stop any compromised image from performing a data exfill. I do this for most containers. If the container must have web access in some form, setup a squid proxy and only whitelist safe and trusted domains that can't be exfilled to.
Why do you think that DNS is required? Anything malicious could (and likely should) hard-code an IP.
Hardcoding an IP won't help if the network policy disallows all network access.
Most of the comments seem to confirm (all but one at time of writing) that this feature is more intended for corporate/business environments. Does anyone know if Vaultwarden has commercial users? By no means am I arguing against the inclusion of this feature, I'm just curious. Everywhere I've worked that was big enough to use SSO was also wary of selfhosting FOSS tools. I should clarify I don't consider myself workin…
How secure is Vaultwarden?
You can read the code and see?
But I think it can be assumed that someone asking such a questions is highly unlikely to be a world-class security researcher equipped to answer it for themselves by auditing the source code, so your response comes across as snarky for the sake of snark.
Earlier quoted context omitted.
If you're running on kubernetes, a simple network policy and blocking the container from using DNS will stop any compromised image from performing a data exfill. I do this for most containers. If the container must have web access in some form, setup a squid proxy and only whitelist safe and trusted domains that can't be exfilled to.
> a simple network policy and blocking the container from using DNS Can you please point to some resources that can help with how to do this?
https://kubernetes.io/docs/concepts/services-networking/netw...
Edit: Did some research and found that Calico has a feature for some kind of DNS filtering
https://www.tigera.io/blog/how-to-secure-kubernetes-workload...
Earlier quoted context omitted.
If you're running on kubernetes, a simple network policy and blocking the container from using DNS will stop any compromised image from performing a data exfill. I do this for most containers. If the container must have web access in some form, setup a squid proxy and only whitelist safe and trusted domains that can't be exfilled to.
The web frontend could still send secrets to third parties.
Earlier quoted context omitted.
What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?
Pocket ID[1] is what I use, and I cannot recommend it enough. It's an incredible project. [1] https://pocket-id.org
Earlier quoted context omitted.
SSO is really important in the "few tools, many users" case, but just as important in the "many tools, few users" case. I'm self hosting dozens of tools, and without SSO I'd have to set up username, password, TOTP and WebAuthn for each and every one of them, my 2FA app would be 90% my own services. With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I c…
What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?
Most of the comments seem to confirm (all but one at time of writing) that this feature is more intended for corporate/business environments. Does anyone know if Vaultwarden has commercial users? By no means am I arguing against the inclusion of this feature, I'm just curious. Everywhere I've worked that was big enough to use SSO was also wary of selfhosting FOSS tools. I should clarify I don't consider myself workin…
As someone who manages the vault warden instance for a nonprofit with many volunteers but no fulltime employees I see this as a wonderful thing. Yes bitwarden has a nonprofit discount but no playing wack a mole with which of the 20+ volunteers are active at any moment to avoid getting a huge bill isn't worth it vs self hosting.
So what is the point of this, if the user still needs a master password?