46
Is webmin safe to have accesible over the web (sh.itjust.works)
submitted 1 week ago by to c/selfhosted@lemmy.world
46 comments fedilink hide all child comments
 

As the title says ive started running webmin. And i wanna know if its safe for me to reverse proxy (with 2fa) or should i just use tailscale or ssh to access it.

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 1 week ago (9 children)

Is tail scale really that much more secure than reverse proxy and auth control?

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] 5 points 1 week ago

    Tailscale and wire guard, it's underlying vpn application, have a big stake in being secure. Webmin not as much more focused on providing features and being secure. There is much more surface areas for a web application over a simple vpn service. And self hosted you probably aren't implementing intrusion monitoring as serious as tailscale web services would.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 week ago* (last edited 1 week ago) (4 children)

    Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible. This is fundamentally different than for example a web interface, which needs to present "the Web page" to allow the user to log in, which might involve multiple individual parts that can already have a 0-day.

    As a more direct comparison: look into historic vulnerabilities between ipsec VPN and SSL VPN. The former is the older technology, the second is more "web like". The number of serious CVEs for the latter over just some manufacturers (Cisco, fortinet, ...) in one year probably beats the number for ipsec in is entire life time.

    Going back to Tailscale (or netbird, ...): it is one very secure layer which then secures everything. You can have 1 service or 20, same security. If you expose individual services, c you also expose every possible vulnerability of all of them, so all 20 services if that's what you run.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 week ago

    I disagree.

    Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible.

    VPN service is... a service. Of course it is. Tailscale has been around for a few years, Apache was there since shortly after the dinosaurs roamed earth. It survived a bunch more battles than any VPN. The only authentication happening at the network level would be 802.1x or such, but this connects to radius (clearly a classic service) and other components. Auth in VPNs is just the same.

    So no, a properly secured reverse proxy is all the same. I recommend mtls for ease of use and brute-force resistance. Chose a proper private key :p

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 1 week ago (2 children)

    Makes sense. Its unfortunate though that it presents a hurdle for end users. My users need to hit a webpage and acesss stuff, asking them to connect to a VPN client is too much.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 1 week ago (1 child)

    It's all a matter of what you consider reasonable risk. I also run some specific services exposed where it makes sense (they are designed to do this, think things like home assistant or next cloud or jellyfin), but would never put anything that is used to do server administration public facing (Webmin, Termix, proxmox, that sort of thing). If the purpose of the tool is to perform or allow elevated actions, I run it behind a VPN (yes for me that includes ssh).

    There's also a difference between being randomly port scanned and/or probed, or being actively and personally targeted for some reason. If the second is ever a reasonable threat, that changes what is acceptable dramatically as well.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •