Considering the vulnerabilities that have been found just this past year, I sure wouldn't. Use a VPN.
post
It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale.
replies:
Never in a million years would I do this
Let me check what’s your IP?
Short answer: No.
Long answer: Hell, no!
Webmin is still around‽
replies:
I would never do something like that. It’s actually a sad story: I had a server that had to be exposed to the public, and not long ago, it was compromised by the latest PHP vulnerability. Fortunately, the damage wasn’t too severe. Since then, my policy has been to only expose services to the public that must be accessible to strangers, and I never expose administrative access points to the public internet. SSH access is restricted to key-based authentication, and the admin panel is accessible only from the internal network or via VPN. Two-factor authentication protects against password guessing, but it cannot prevent vulnerabilities that can be exploited before the login process even begins.
replies:
Is tail scale really that much more secure than reverse proxy and auth control?
replies:
Why would you want to expose it to the web in the first place? In a homelab scenario, you're the only one who needs access, so putting it behind a VPN comes at zero convenience or monetary cost.
replies:
If you like being compromised then yes
I had it exposed for maybe ten years (mostly so that users could manage their accounts), nothing bass happened, but i have shut down that server about a year before the ai security disaster, so ymmv
Jamie is a cool guy. He's also super smart. But he's not infallible, and so I must secure this and only run it from the internal admin network. Because that's best-practice.
I probably wouldn't expose it, while I don't think it's been a problem in the past, with LLMs being used to find vulnerabilities so much in the past few months it seems prudent to do everything you can reasonably do to secure things.
Tailscale is so easy to use it seems worth the bit of extra hassle.
I guess that depends: are you okay with literally anyone accessing this computer? If so, change nothing.
If you're trying to just give yourself access to your own computer, stop forwarding ports and download Tailscale.
I don't think it's ever been considered safe to be publicly accessible.
all 46 comments