46
Is webmin safe to have accesible over the web (sh.itjust.works)
submitted 1 week ago by to c/selfhosted@lemmy.world
46 comments fedilink hide all child comments
 

As the title says ive started running webmin. And i wanna know if its safe for me to reverse proxy (with 2fa) or should i just use tailscale or ssh to access it.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 week ago (3 children)

Hmm... Where I work setting up a VPN on my work machine would not only break my workflow, it would probably cost me my job. Plus I'm not a big fan of giving computers I don't control access to the internals of my network. Reverse proxies were invented for a reason, no reason not to use one.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 week ago* (2 children)

    I think you might be drastically misunderstanding what a reverse proxy does.

    Reverse proxy: Gives EVERY computer a direct connection to your network if you make it public, which it certainly sounds like you mean.

    VPN: gives only you access to your internals.

    In terms of connecting from work and not allowing some untrusted computer, there's a hundred different options, even running portable QEMU from a USB and using that trusted virtual machine to connect.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 week ago (1 child)

    USB's are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it's essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ.

    VPNs allow you to become part of a virtual network (like one you aren't physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 1 week ago

    The context of this entire discussion is connecting to internal services; the kind you wouldn't have in your DMZ, as that has no privileged access to your network.

    Anyhoo, you do you, but I certainly wouldn't make public a reverse proxy with access to my internals.

  • permalink
  • fedilink
  • source
  • parent