There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

What do you guys do about usernames / passwords for your local services?

Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn’t really think about it when I started. I make a half-assed effort at security where I don’t use “admin” or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I’m running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what’s the threat model? Is there an easier way?

BrianTheeBiscuiteer ,

Don’t remember the tool, maybe someone here does, but there’s some web service out there that boasts a “no storage” approach. You provide some URI and some other value (maybe username) and it makes a password for you, but it’s always the same for a given combination. Basically it’s a purely functional generator.

Downside would be forgetting a minor detail (Did it end with a slash or not? What was the username?) or the site going down. You can achieve the same thing yourself with a hash calculator but those passwords are a bitch to type in.

tl;dr just use KeePass

corroded ,

Like several people here, I’ve also been interested in setting up an SSO solution for my home network, but I’m struggling to understand how it would actually work.

Lets say I set up an LDAP server. I log into my PC, and now my PC “knows” my identity from the LDAP server. Then I navigate to the web UI for one of my network switches. How does SSO work in this case? The way I see it, there are two possible solutions.

  • The switch has some built-in authentication mechanism that can authenticate with the LDAP server or something like Keycloak. I don’t see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
  • I log into and authenticate with an HTTP forwarding server that then supplies the username/password to the switch. This seems clunky but could be reasonably secure as long as the username/password is sufficiently complex.

I generally understand how SSO works within a curated ecosystem like a Windows-based corporate network that uses primarily Microsoft software for everything. I have various Linux systems, Windows, a bunch of random software that needs authentication, and probably 10 different brands of networking equipment. What’s the solution here?

cm0002 ,

Your confusion is confusing me lol

I don’t see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.

Wdym? That’s not a thing, you can have some devices on LDAP some with local logins and some with OIDC or any other combination. Authentication is generally an application layer thing and switches operate at layer 2 maybe 3 if it’s doing some routing. As long as your network has a functioning DHCP server the web UI of the switch will be able to communicate with the LDAP server that you configure it to

BearOfaTime ,

Currently I have terrible local password rules.

Once I get my Vaultwarden reinstalled, everything will use properly managed passwords, with 2FA for things like servers/services/admin accounts (routers, DNS, etc).

dinckelman ,

Same as what i do for any other service. Password manager, randomized password, passkey when possible

ericjmorey ,
@ericjmorey@programming.dev avatar

What self-hosted services did you set up passkeys on? How did setting it up go?

Decronym Bot , (edited )

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters
CGNAT Carrier-Grade NAT
DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network
DNS Domain Name Service/System
HTTP Hypertext Transfer Protocol, the Web
IP Internet Protocol
NAT Network Address Translation
SSH Secure Shell for remote terminal access
SSO Single Sign-On
nginx Popular HTTP server

[Thread for this sub, first seen 20th Aug 2024, 14:45] [FAQ] [Full list] [Contact] [Source code]

TCB13 ,
@TCB13@lemmy.world avatar

I’ve been looking into some kind of simple SSO to handle this. I’m tired of entering passwords (even if it’s all done by the password manager) a single authentication point with a single user would be great.

Keycloak and friend are way too complex. Ideally I would like to have something in my nginx reverse proxies that would handle authentication at that level and tell the final app what user is logged on in some safe way.

BrianTheeBiscuiteer ,

Never tried Authelia or Authentik but I’ve heard good things about them. I’m sure one of them will integrate with a reverse proxy.

TCB13 ,
@TCB13@lemmy.world avatar

Those solutions are still way too complex and corporate to my likes. :(

ericjmorey ,
@ericjmorey@programming.dev avatar

Is there a passkey setup that’s easy to self host? I think passkeys with a backup would be best.

TCB13 ,
@TCB13@lemmy.world avatar

Hmm this is actually interesting, passkeys would indeed make things simpler.

pHr34kY ,

Public-facing: Password generator, stored in a password manager.

Internal LAN: Everything gets the same re-used, low-effort password.

Nobody is going to hack my CUPS server.

BCsven ,

But if they do, they have every password for all your stuff. hopefutlly you have Ipv6 disabled

sunzu2 ,

Is ipv6 that bad.

I keep hearing there is no real benefit and risk to it?

seaQueue ,
@seaQueue@lemmy.world avatar

Ipv6 is fantastic, it has less overhead than v4 and removes the need for NAT and NAT translation. Support can be spotty in cheaper and older devices but there’s no reason not to learn and adopt it where possible.

DaGeek247 ,
@DaGeek247@fedia.io avatar

You have to take extra steps to ensure that the benefits of NAT aren't lost when you switch to ipv6. Everyone knowing exactly which device you're using because a single ipv6 IP per-device is the default.

Ipv6 is nice, but also you need to know what you're doing to get all the benefits without any of the downsides.

pHr34kY ,

IPv6 should not be disabled under any circumstances.

In fact, many devices in my house have IPv4 disabled. Disabling IPv4 on my public-facing SSH reduced the attack traffic to zero.

IPv4 is shit.

SchmidtGenetics ,

IPv6 was just found to have a critical exploit, and the solution is to disable it.

powerofm ,

I’m pretty sure that vulnerability only affected windows machines. Surely you’re not running a homelab with windows server?

9point6 ,

en.wikipedia.org/wiki/Windows_Home_Server

:D

seaQueue ,
@seaQueue@lemmy.world avatar

The only windows machine on my home network is the backup Windows laptop that I only boot when I need to run something like Odin to flash a tablet or some niche Nintendo switch management software.

BearOfaTime ,

IP4 is shit

Lol, right, right. It’s only run the internet for what, 40 years now?

Guess you missed the recent gaping hole in IP6 on Windows?

IP6 is only really useful in large (i.e. enterprise) environments . It offers no practical benefit to small networks at the moment.

And even enterprise will only switch as they build out new infrastructure. The cost to switch is very high, and the risk is far more concerning than any potential benefit.

towerful ,

How many people are running public facing windows servers in their homelab/self-hosted environment?

And just because “it’s worked so far” isn’t a great reason to ignore new technology.
IPv6 is useful for public facing services. You don’t need a single proxy that covers all your http/s services.
It’s also significantly better for P2P applications, as you no longer need to rely on NAT traversal bodges or insecure uPTP type protocols.

If you are unlucky enough to be on IPv4 CGNAT but have IPv6 available, then you are no longer sharing reputation with everyone else on the same public IPv4 address. Also, IPv6 means you can get public access instead of having to rely on some RPoVPN solution.

Sunny ,

Personally keep it very simple using same username and password for my services. But I also don’t host anything of value, just messing around with a few different projects I come across. Yes it’s not good practice, but nothing is exposed works well for me.

catloaf ,

SSO

eager_eagle ,
@eager_eagle@lemmy.world avatar

random credentials + password manager

douglasg14b ,
@douglasg14b@lemmy.world avatar

Never not

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • [email protected]
  • random
  • lifeLocal
  • goranko
  • All magazines
    •