▲ 46 ▼ Is webmin safe to have accesible over the web (sh.itjust.works) submitted 1 week ago by DrunkAnRoot@sh.itjust.works to c/selfhosted@lemmy.world 46 comments fedilink hide all child comments As the title says ive started running webmin. And i wanna know if its safe for me to reverse proxy (with 2fa) or should i just use tailscale or ssh to access it.
[–] funkajunk@lemmy.world 1 point 1 week ago (4 children) So setup a VPN permalink fedilink source parent hideshow 4 child comments replies: [–] ITGuyLevi@programming.dev 1 point 1 week ago (3 children) Hmm... Where I work setting up a VPN on my work machine would not only break my workflow, it would probably cost me my job. Plus I'm not a big fan of giving computers I don't control access to the internals of my network. Reverse proxies were invented for a reason, no reason not to use one. permalink fedilink source parent hideshow 3 child comments replies: [–] asap@lemmy.world 1 point 1 week ago* (2 children) I think you might be drastically misunderstanding what a reverse proxy does. Reverse proxy: Gives EVERY computer a direct connection to your network if you make it public, which it certainly sounds like you mean. VPN: gives only you access to your internals. In terms of connecting from work and not allowing some untrusted computer, there's a hundred different options, even running portable QEMU from a USB and using that trusted virtual machine to connect. permalink fedilink source parent hideshow 2 child comments replies: [–] ITGuyLevi@programming.dev 1 point 1 week ago (1 child) USB's are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it's essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ. VPNs allow you to become part of a virtual network (like one you aren't physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy). permalink fedilink source parent hideshow 1 child comment replies: [–] asap@lemmy.world 0 points 1 week ago The context of this entire discussion is connecting to internal services; the kind you wouldn't have in your DMZ, as that has no privileged access to your network. Anyhoo, you do you, but I certainly wouldn't make public a reverse proxy with access to my internals. permalink fedilink source parent
[–] ITGuyLevi@programming.dev 1 point 1 week ago (3 children) Hmm... Where I work setting up a VPN on my work machine would not only break my workflow, it would probably cost me my job. Plus I'm not a big fan of giving computers I don't control access to the internals of my network. Reverse proxies were invented for a reason, no reason not to use one. permalink fedilink source parent hideshow 3 child comments replies: [–] asap@lemmy.world 1 point 1 week ago* (2 children) I think you might be drastically misunderstanding what a reverse proxy does. Reverse proxy: Gives EVERY computer a direct connection to your network if you make it public, which it certainly sounds like you mean. VPN: gives only you access to your internals. In terms of connecting from work and not allowing some untrusted computer, there's a hundred different options, even running portable QEMU from a USB and using that trusted virtual machine to connect. permalink fedilink source parent hideshow 2 child comments replies: [–] ITGuyLevi@programming.dev 1 point 1 week ago (1 child) USB's are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it's essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ. VPNs allow you to become part of a virtual network (like one you aren't physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy). permalink fedilink source parent hideshow 1 child comment replies: [–] asap@lemmy.world 0 points 1 week ago The context of this entire discussion is connecting to internal services; the kind you wouldn't have in your DMZ, as that has no privileged access to your network. Anyhoo, you do you, but I certainly wouldn't make public a reverse proxy with access to my internals. permalink fedilink source parent
[–] asap@lemmy.world 1 point 1 week ago* (2 children) I think you might be drastically misunderstanding what a reverse proxy does. Reverse proxy: Gives EVERY computer a direct connection to your network if you make it public, which it certainly sounds like you mean. VPN: gives only you access to your internals. In terms of connecting from work and not allowing some untrusted computer, there's a hundred different options, even running portable QEMU from a USB and using that trusted virtual machine to connect. permalink fedilink source parent hideshow 2 child comments replies: [–] ITGuyLevi@programming.dev 1 point 1 week ago (1 child) USB's are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it's essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ. VPNs allow you to become part of a virtual network (like one you aren't physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy). permalink fedilink source parent hideshow 1 child comment replies: [–] asap@lemmy.world 0 points 1 week ago The context of this entire discussion is connecting to internal services; the kind you wouldn't have in your DMZ, as that has no privileged access to your network. Anyhoo, you do you, but I certainly wouldn't make public a reverse proxy with access to my internals. permalink fedilink source parent
[–] ITGuyLevi@programming.dev 1 point 1 week ago (1 child) USB's are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it's essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ. VPNs allow you to become part of a virtual network (like one you aren't physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy). permalink fedilink source parent hideshow 1 child comment replies: [–] asap@lemmy.world 0 points 1 week ago The context of this entire discussion is connecting to internal services; the kind you wouldn't have in your DMZ, as that has no privileged access to your network. Anyhoo, you do you, but I certainly wouldn't make public a reverse proxy with access to my internals. permalink fedilink source parent
[–] asap@lemmy.world 0 points 1 week ago The context of this entire discussion is connecting to internal services; the kind you wouldn't have in your DMZ, as that has no privileged access to your network. Anyhoo, you do you, but I certainly wouldn't make public a reverse proxy with access to my internals. permalink fedilink source parent