Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn’t really think about it when I started. I make a half-assed effort at security where I don’t use “admin” or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I’m running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what’s the threat model? Is there an easier way?
I’ve been looking into some kind of simple SSO to handle this. I’m tired of entering passwords (even if it’s all done by the password manager) a single authentication point with a single user would be great.
Keycloak and friend are way too complex. Ideally I would like to have something in my nginx reverse proxies that would handle authentication at that level and tell the final app what user is logged on in some safe way.
Don’t remember the tool, maybe someone here does, but there’s some web service out there that boasts a “no storage” approach. You provide some URI and some other value (maybe username) and it makes a password for you, but it’s always the same for a given combination. Basically it’s a purely functional generator.
Downside would be forgetting a minor detail (Did it end with a slash or not? What was the username?) or the site going down. You can achieve the same thing yourself with a hash calculator but those passwords are a bitch to type in.
Same way I do at work. Different accounts and passwords for each service internally. Any service exposed to the net (game and email servers mostly) is on a segregated network and each machine has unique credentials to help prevent lateral movement. Self hosted Bitwarden tracks it all.
I do it for the same reason I require outbound firewall rules for almost everything on my home network - I’m a masochist.
All my local services follow the same rules as any other service. I have no idea what the passwords are, they are all random and long as fuck in my password manager. 2FA with a hardware key where allowed, TOTP if not.
What possible reason would anyone have to “relax” or security on local services? That would mean having 2 streamlines which only adds friction.
I strongly suggest you move all your credentials out of your browsers and into a password manager.
Like several people here, I’ve also been interested in setting up an SSO solution for my home network, but I’m struggling to understand how it would actually work.
Lets say I set up an LDAP server. I log into my PC, and now my PC “knows” my identity from the LDAP server. Then I navigate to the web UI for one of my network switches. How does SSO work in this case? The way I see it, there are two possible solutions.
The switch has some built-in authentication mechanism that can authenticate with the LDAP server or something like Keycloak. I don’t see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
I log into and authenticate with an HTTP forwarding server that then supplies the username/password to the switch. This seems clunky but could be reasonably secure as long as the username/password is sufficiently complex.
I generally understand how SSO works within a curated ecosystem like a Windows-based corporate network that uses primarily Microsoft software for everything. I have various Linux systems, Windows, a bunch of random software that needs authentication, and probably 10 different brands of networking equipment. What’s the solution here?
I don’t see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
Wdym? That’s not a thing, you can have some devices on LDAP some with local logins and some with OIDC or any other combination. Authentication is generally an application layer thing and switches operate at layer 2 maybe 3 if it’s doing some routing. As long as your network has a functioning DHCP server the web UI of the switch will be able to communicate with the LDAP server that you configure it to
I think I’m misunderstanding how LDAP works. It’s probably obvious, but I’ve never used it.
If my switch is expecting a username and password for login, how does it go from expecting a web login to “the LDAP server recognizes this person, and they have permissions to access network devices, so I’ll let them in.”?
Also, to be clear, I’m referring to the process of logging in and configuring the switch itself, not L2 switching or L3 routing.
If the switch supports it, you login with local credentials first, navigate to its config page and configure LDAP under there. You’ll tell it the IP address of the LDAP server as well as give it its client side configuration. You give it a bind account credentials (a dedicated service account with as minimal permissions as needed) that it uses to lookup the users on the server as well as Organization Unit paths and such
When a user goes to login the switch will query the provided credentials against the LDAP server, if it’s valid the LDAP server will respond with a success and the switch will log the user in
Generally there is always a local account fallback in the event that the LDAP server is unavailable for whatever reason
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
random credentials + password manager
Never not
Public-facing: Password generator, stored in a password manager.
Internal LAN: Everything gets the same re-used, low-effort password.
Nobody is going to hack my CUPS server.
I’ve been looking into some kind of simple SSO to handle this. I’m tired of entering passwords (even if it’s all done by the password manager) a single authentication point with a single user would be great.
Keycloak and friend are way too complex. Ideally I would like to have something in my nginx reverse proxies that would handle authentication at that level and tell the final app what user is logged on in some safe way.
Never tried Authelia or Authentik but I’ve heard good things about them. I’m sure one of them will integrate with a reverse proxy.
Those solutions are still way too complex and corporate to my likes. :(
Don’t remember the tool, maybe someone here does, but there’s some web service out there that boasts a “no storage” approach. You provide some URI and some other value (maybe username) and it makes a password for you, but it’s always the same for a given combination. Basically it’s a purely functional generator.
Downside would be forgetting a minor detail (Did it end with a slash or not? What was the username?) or the site going down. You can achieve the same thing yourself with a hash calculator but those passwords are a bitch to type in.
tl;dr just use KeePass
Same way I do at work. Different accounts and passwords for each service internally. Any service exposed to the net (game and email servers mostly) is on a segregated network and each machine has unique credentials to help prevent lateral movement. Self hosted Bitwarden tracks it all.
I do it for the same reason I require outbound firewall rules for almost everything on my home network - I’m a masochist.
deleted by creator
Keycloak to provide OIDC, although in hindsight I should have gone with
AutheliaAuthentikAll my local services follow the same rules as any other service. I have no idea what the passwords are, they are all random and long as fuck in my password manager. 2FA with a hardware key where allowed, TOTP if not.
What possible reason would anyone have to “relax” or security on local services? That would mean having 2 streamlines which only adds friction.
I strongly suggest you move all your credentials out of your browsers and into a password manager.
Like several people here, I’ve also been interested in setting up an SSO solution for my home network, but I’m struggling to understand how it would actually work.
Lets say I set up an LDAP server. I log into my PC, and now my PC “knows” my identity from the LDAP server. Then I navigate to the web UI for one of my network switches. How does SSO work in this case? The way I see it, there are two possible solutions.
I generally understand how SSO works within a curated ecosystem like a Windows-based corporate network that uses primarily Microsoft software for everything. I have various Linux systems, Windows, a bunch of random software that needs authentication, and probably 10 different brands of networking equipment. What’s the solution here?
Your confusion is confusing me lol
Wdym? That’s not a thing, you can have some devices on LDAP some with local logins and some with OIDC or any other combination. Authentication is generally an application layer thing and switches operate at layer 2 maybe 3 if it’s doing some routing. As long as your network has a functioning DHCP server the web UI of the switch will be able to communicate with the LDAP server that you configure it to
I think I’m misunderstanding how LDAP works. It’s probably obvious, but I’ve never used it.
If my switch is expecting a username and password for login, how does it go from expecting a web login to “the LDAP server recognizes this person, and they have permissions to access network devices, so I’ll let them in.”?
Also, to be clear, I’m referring to the process of logging in and configuring the switch itself, not L2 switching or L3 routing.
If the switch supports it, you login with local credentials first, navigate to its config page and configure LDAP under there. You’ll tell it the IP address of the LDAP server as well as give it its client side configuration. You give it a bind account credentials (a dedicated service account with as minimal permissions as needed) that it uses to lookup the users on the server as well as Organization Unit paths and such
When a user goes to login the switch will query the provided credentials against the LDAP server, if it’s valid the LDAP server will respond with a success and the switch will log the user in
Generally there is always a local account fallback in the event that the LDAP server is unavailable for whatever reason