Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn’t really think about it when I started. I make a half-assed effort at security where I don’t use “admin” or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I’m running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what’s the threat model? Is there an easier way?

  • pHr34kY@lemmy.worldEnglish
    511·
    3 months ago

    Public-facing: Password generator, stored in a password manager.

    Internal LAN: Everything gets the same re-used, low-effort password.

    Nobody is going to hack my CUPS server.

    • BCsven@lemmy.caEnglish
      911·
      3 months ago

      But if they do, they have every password for all your stuff. hopefutlly you have Ipv6 disabled

      • pHr34kY@lemmy.worldEnglish
        199·
        3 months ago

        IPv6 should not be disabled under any circumstances.

        In fact, many devices in my house have IPv4 disabled. Disabling IPv4 on my public-facing SSH reduced the attack traffic to zero.

        IPv4 is shit.

        • Turbo@lemmy.mlEnglish
          2·
          3 months ago

          Why not disable ipv6 for local lan?

          I disable It on everything for next decade until it’s mainstream.
          .

        • BCsven@lemmy.caEnglish
          1·
          3 months ago

          I was referring to the latest CVE for ipv6 where an attacker just sends a flood of IPv6 packets which puts things like WindowsOS into a mode for remote code execution, even via webpage. Windows remedy right now is turnoff all ipv6 capability, as they don’t have a fix yet

          • pHr34kY@lemmy.worldEnglish
            4·
            3 months ago

            I know about that one. The 800MB “fix” for it has been crashing machines quite hard.

            I don’t have that problem because I don’t run Windows.

            Windows is shit.

        • BearOfaTime@lemm.eeEnglish
          1615·
          3 months ago

          IP4 is shit

          Lol, right, right. It’s only run the internet for what, 40 years now?

          Guess you missed the recent gaping hole in IP6 on Windows?

          IP6 is only really useful in large (i.e. enterprise) environments . It offers no practical benefit to small networks at the moment.

          And even enterprise will only switch as they build out new infrastructure. The cost to switch is very high, and the risk is far more concerning than any potential benefit.

          • 2xsaiko@discuss.tchncs.deEnglish
            142·
            3 months ago

            It offers no practical benefit to small networks at the moment.

            The internet is not a “small network”, and I assume your small network is connected to it. You need local IPv6 routing to have access to IPv6-only hosts which are becoming more and more because it’s reasonable in terms of price to get an IPv6 block unlike IPv4 blocks which are being auctioned for tens of thousands of dollars at this point (!!!).

            Also restoring global addressing is a huge benefit. P2P communications in IPv4 has become an insane mess of workarounds due to lack of addresses and this becomes worse the more layers of NAT you stick behind each other to try to save your ass from the rising tide.

            I’m really sick of hearing these idiotic excuses over and over, “it’s hard” this, “it’s unsafe” that, “it’s expensive”, “understanding the eldritch secrets of IPv6 has driven 5 of my colleagues into madness” skill issue. THERE ARE NO MORE IPV4 ADDRESSES. So unless your network is so fucked that you haven’t managed to fix it in 26 years, since IPv6 has been standardized, or it really is just an internal network with no outward facing services where it doesn’t matter when someone who just has IPv6 can’t access it because they wouldn’t be able to access it anyway, and you’re not some kind of ISP, you have no reason not to have support for it at this point and you absolutely never have a reason to tell people it’s not “useful” because that is straight up wrong in the general case even if it might be true for your situation.

          • towerful@programming.devEnglish
            93·
            3 months ago

            How many people are running public facing windows servers in their homelab/self-hosted environment?

            And just because “it’s worked so far” isn’t a great reason to ignore new technology.
            IPv6 is useful for public facing services. You don’t need a single proxy that covers all your http/s services.
            It’s also significantly better for P2P applications, as you no longer need to rely on NAT traversal bodges or insecure uPTP type protocols.

            If you are unlucky enough to be on IPv4 CGNAT but have IPv6 available, then you are no longer sharing reputation with everyone else on the same public IPv4 address. Also, IPv6 means you can get public access instead of having to rely on some RPoVPN solution.

              • towerful@programming.devEnglish
                31·
                3 months ago

                If the router/gateway/network (IE not local) firewall is blocking forwarding unknown IPv6, then it’s a compromised server connected to via IPv6 that has the ability to leverage the exploit (IE your windows client connecting to a compromised server that is actively exploiting this IPv6 CVE).

                It’s not like having IPv6 enabled on a windows machine automatically makes it instantly exploitable by anyone out there.
                Routers/firewalls will only forward IPv6 for established connections, so your windows machine has to connect out.

                Unless you are specifically forwarding to a windows machine, at which point you are intending that windows machine to be a server.

                Essentially the same as some exploit in some service you are exposing via NAT port forwarding.
                Maybe a few more avenues of exploit.

                Like I said. Why would a self-hoster or homelabber use windows for a public facing service?!

                • SchmidtGenetics@lemmy.worldEnglish
                  1·
                  3 months ago

                  … all it can take is going to a website from a windows device… maybe less, it was literally discovered a couple days ago…

                  It’s not like having IPv6 enabled on a windows machine automatically makes it instantly exploitable by anyone out there.

                  Yes it actually kinda does, that’s why this exploit is considered the highest priority and critical.

                  But sure… downplay it, because we only think servers are at risk…

                  Yeesh buddy.

      • cmnybo@discuss.tchncs.deEnglish
        101·
        3 months ago

        Just because each device has a globally routable IP address doesn’t mean they can be accessed from outside your LAN. You still have to add a firewall rule to open a port to the device.

        • BCsven@lemmy.caEnglish
          31·
          3 months ago

          I was referring to the latest CVE for ipv6 where an attacker just sends a flood of IPv6 packets which puts things like WindowsOS into a mode for remote code execution, even via webpage. Windows remedy right now is turnoff all ipv6 capability, as they don’t have a fix yet

            • BCsven@lemmy.caEnglish
              2·
              3 months ago

              I have seen both. Typically you expect somebody self hosting to be about privacy and freedom, and thus choosing Linux, but there are WinFans too

            • BCsven@lemmy.caEnglish
              1·
              3 months ago

              Apparently crafted webpage could be a vector. Router has to block fragmented packages also. The issue is non savvy people get shipped a router with Ipv6 firewall turned off (as a shit default setting) and don’t know to check it. And as it is a worm type it can come in with otger binaries

        • seaQueue@lemmy.worldEnglish
          111·
          3 months ago

          Ipv6 is fantastic, it has less overhead than v4 and removes the need for NAT or other translation. Support can be spotty in cheaper and older devices but there’s no reason not to learn and adopt it where possible.

          • DaGeek247@fedia.io
            53·
            3 months ago

            You have to take extra steps to ensure that the benefits of NAT aren’t lost when you switch to ipv6. Everyone knowing exactly which device you’re using because a single ipv6 IP per-device is the default.

            Ipv6 is nice, but also you need to know what you’re doing to get all the benefits without any of the downsides.

            • cmnybo@discuss.tchncs.deEnglish
              5·
              3 months ago

              Most devices generate a random IPv6 address and change it frequently. Your browser fingerprint is much more useful for device tracking than your IP address anyways.

              • seaQueue@lemmy.worldEnglish
                4·
                3 months ago

                +1, your list of browser extensions, list of plugins and list of available fonts are also available to anyone trying to fingerprint you. This idea that NAT will somehow obscure you enough to be anonymous online is security voodoo.

            • seaQueue@lemmy.worldEnglish
              41·
              3 months ago

              Your firewall should take care of that, it’s pretty rare to be connected directly without one and by default any decent routing package will filter incoming traffic that’s not in the state tracking table. NAT isn’t designed for security, any security benefit it provides is a side effect rather than the intended purpose.

              Edit: check out ipv6 privacy extensions too, there are solutions there that can reduce info disclosure if that’s a concern. You can accomplish many of the same benefits of NAT with v6 features without the downsides that NAT brings.

              • BCsven@lemmy.caEnglish
                2·
                3 months ago

                There was an article that many Routers were shipped with Ipv6 firewall off, and less savvy users would never know to check

              • DaGeek247@fedia.io
                2·
                3 months ago

                Not access, knowledge. Giving a specifically unique device identifier every time you visit a page is different from the website guessing if you visited recently based on your screen size and cookies.

                You have to set up ipv6 to change regularly to avoid that.

                • seaQueue@lemmy.worldEnglish
                  41·
                  3 months ago

                  I mean, the horror of having to tick a box to use rotating v6 addresses. These are all solved problems, they’re not a flaw worth ignoring the entire ipv6 protocol over. Most major operating systems have moved to stable privacy preserving addresses by default, that’s true, but it’s not all that difficult to turn on address randomization and rotation either. And, hell, if you’re that married to NAT as security just use NAT66 and call it a day, nothing about NAT is exclusive to ipv4.

  • WhyJiffie@sh.itjust.worksEnglish
    19·
    3 months ago

    Everything gets a different, long random password. It’s not a hassle because my password manager handles everything. It’s bitwarden for whatever I may need to access elsewhere, few admin logins there, keepass everything else.

  • youmaynotknow@lemmy.mlEnglish
    15·
    3 months ago

    All my local services follow the same rules as any other service. I have no idea what the passwords are, they are all random and long as fuck in my password manager. 2FA with a hardware key where allowed, TOTP if not.

    What possible reason would anyone have to “relax” or security on local services? That would mean having 2 streamlines which only adds friction.

    I strongly suggest you move all your credentials out of your browsers and into a password manager.

  • arcayne@lemmy.todayEnglish
    10·
    3 months ago

    Apps: SSO via Authentik where I can, unique user/pass combo via Bitwarden where I can’t (or, more realistically, don’t want to).

    General infra: Unique RSA keys, sometimes Ed25519

    Core infra: Yubikey

    This is overkill for most, but I’m a systems engineer with a homelab, so it works well for me.

    If you’re wanting to practice good security hygiene, the bare minimum would be using unique cred pairs (or at least unique passwords) per app/service, auto-filled via a proper password manager with a browser extension (like KeePassXC or Bitwarden).

    Edit: On the network side, if your goal is to just do some basic internal self-hosting, there’s nothing wrong with keeping your topo mostly flat (with the exception of a separate VLAN for IoT, if applicable). Outside of that, making good use of firewalls will help you keep things pretty tight. The networking rabbit hole is a deep one, not always worth the dive unless you’re truly wanting to learn for the sake of a cert/job/etc.

  • RegalPotoo@lemmy.worldEnglish
    7·
    3 months ago

    Keycloak to provide OIDC, although in hindsight I should have gone with Authelia Authentik

  • cheddar@programming.devEnglish
    71·
    3 months ago

    Since I’m already using Bitwarden, generating and storing passwords is easy. I use my name as the username, though that user doesn’t have admin privileges.

  • CarbonatedPastaSauce@lemmy.worldEnglish
    6·
    3 months ago

    Same way I do at work. Different accounts and passwords for each service internally. Any service exposed to the net (game and email servers mostly) is on a segregated network and each machine has unique credentials to help prevent lateral movement. Self hosted Bitwarden tracks it all.

    I do it for the same reason I require outbound firewall rules for almost everything on my home network - I’m a masochist.

  • fmstrat@lemmy.nowsci.comEnglish
    5·
    3 months ago

    Unify them.

    Now I have a full FOSS Active Directory for SSO logging into computers and services that supports 2FA where desired.

  • Sunny' 🌻@slrpnk.netEnglish
    5·
    3 months ago

    Personally keep it very simple using same username and password for my services. But I also don’t host anything of value, just messing around with a few different projects I come across. Yes it’s not good practice, but nothing is exposed works well for me.

  • corroded@lemmy.worldEnglish
    5·
    3 months ago

    Like several people here, I’ve also been interested in setting up an SSO solution for my home network, but I’m struggling to understand how it would actually work.

    Lets say I set up an LDAP server. I log into my PC, and now my PC “knows” my identity from the LDAP server. Then I navigate to the web UI for one of my network switches. How does SSO work in this case? The way I see it, there are two possible solutions.

    • The switch has some built-in authentication mechanism that can authenticate with the LDAP server or something like Keycloak. I don’t see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
    • I log into and authenticate with an HTTP forwarding server that then supplies the username/password to the switch. This seems clunky but could be reasonably secure as long as the username/password is sufficiently complex.

    I generally understand how SSO works within a curated ecosystem like a Windows-based corporate network that uses primarily Microsoft software for everything. I have various Linux systems, Windows, a bunch of random software that needs authentication, and probably 10 different brands of networking equipment. What’s the solution here?

    • cm0002@lemmy.worldEnglish
      1·
      3 months ago

      Your confusion is confusing me lol

      I don’t see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.

      Wdym? That’s not a thing, you can have some devices on LDAP some with local logins and some with OIDC or any other combination. Authentication is generally an application layer thing and switches operate at layer 2 maybe 3 if it’s doing some routing. As long as your network has a functioning DHCP server the web UI of the switch will be able to communicate with the LDAP server that you configure it to

      • corroded@lemmy.worldEnglish
        1·
        3 months ago

        I think I’m misunderstanding how LDAP works. It’s probably obvious, but I’ve never used it.

        If my switch is expecting a username and password for login, how does it go from expecting a web login to “the LDAP server recognizes this person, and they have permissions to access network devices, so I’ll let them in.”?

        Also, to be clear, I’m referring to the process of logging in and configuring the switch itself, not L2 switching or L3 routing.

        • cm0002@lemmy.worldEnglish
          1·
          3 months ago

          If the switch supports it, you login with local credentials first, navigate to its config page and configure LDAP under there. You’ll tell it the IP address of the LDAP server as well as give it its client side configuration. You give it a bind account credentials (a dedicated service account with as minimal permissions as needed) that it uses to lookup the users on the server as well as Organization Unit paths and such

          When a user goes to login the switch will query the provided credentials against the LDAP server, if it’s valid the LDAP server will respond with a success and the switch will log the user in

          Generally there is always a local account fallback in the event that the LDAP server is unavailable for whatever reason

  • TCB13@lemmy.worldEnglish
    5·
    3 months ago

    I’ve been looking into some kind of simple SSO to handle this. I’m tired of entering passwords (even if it’s all done by the password manager) a single authentication point with a single user would be great.

    Keycloak and friend are way too complex. Ideally I would like to have something in my nginx reverse proxies that would handle authentication at that level and tell the final app what user is logged on in some safe way.