As the title says ive started running webmin. And i wanna know if its safe for me to reverse proxy (with 2fa) or should i just use tailscale or ssh to access it.
You must log in or register to comment.
It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale.OK, but if your threat landscape is someone burning 2 zero days (one tail scale, one webmin) you aren’t likely to be posting here for answers you will have security people on call.
Geofencing is always a good option for remote access, no point in allowing someone from Spain to login when you are in Germany.
@slazer2au I’m just pointing out that tailscale isn’t immune to security issues either. Maybe sticking webmin behind tailscale is the correct way to go, or maybe it’s better to set up a heavily-restricted reverse proxy and keep the webmin user(s) off of the OP’s private tailscale network.
Not an RCE tho
Never in a million years would I do this
Short answer: No.
Long answer: Hell, no!
Webmin is still around‽
Why would you want to expose it to the web in the first place? In a homelab scenario, you’re the only one who needs access, so putting it behind a VPN comes at zero convenience or monetary cost.
My homelab stuff I like to be able to access from places that take all my free time (like work), making things accessible is a bit of a requirement for me.
You could set up Parsec with 2fa to access a node on your home network.
But you really don’t want anything public facing, and even if you did, it should be on a different VLAN.
But, why?
That’s fair, but I still can’t see how a VPN connection makes your stuff less accessible - at least to you.
Just by making it so I can’t access from a system I don’t control. Like say I need to retrieve a document from my house, but I’m in a SCIF, or a waiting room, or anywhere else I wouldn’t have my personal device, it’s super useful to just connect to something like Nextcloud and pull it down.
I didn’t say you should put your Nextcloud instance behind a VPN. Mine is public too.
I’m saying you should put your administrative access behind a VPN. SSH, reverse proxy admin panel, you name it. You need not do administrative stuff from work.
Oh yeah, I 100% agree with that, honestly two VPNs are better given you wouldn’t want your normal VPN to terminate into your management vlan (nor should you want your management vlan to have access to the internet). I thought we were just discussing normal homelab stuff, all administrative stuff should really be oob.
So setup a VPN
Hmm… Where I work setting up a VPN on my work machine would not only break my workflow, it would probably cost me my job. Plus I’m not a big fan of giving computers I don’t control access to the internals of my network. Reverse proxies were invented for a reason, no reason not to use one.
I think you might be drastically misunderstanding what a reverse proxy does.
Reverse proxy: Gives EVERY computer a direct connection to your network if you make it public, which it certainly sounds like you mean.
VPN: gives only you access to your internals.
In terms of connecting from work and not allowing some untrusted computer, there’s a hundred different options, even running portable QEMU from a USB and using that trusted virtual machine to connect.
USB’s are another really big no-no where I work, and running a different OS on my work network would 100% throw a lot of flags in our SOC as it’s essentially plugging a rogue device into the network. In my understanding, a reverse proxy allows access to specific resources, if configured properly it only allows access to your DMZ.
VPNs allow you to become part of a virtual network (like one you aren’t physically connected to), frequently providing access as though you are directly connected to the whole network. I could set up a VPN to my DMZ I suppose, but that just feels weird as hell as the whole point of a DMZ is to be an area you allow the public internet to reach (sometimes requiring authenticating to the reverse proxy).
The context of this entire discussion is connecting to internal services; the kind you wouldn’t have in your DMZ, as that has no privileged access to your network.
Anyhoo, you do you, but I certainly wouldn’t make public a reverse proxy with access to my internals.
I would never do something like that. It’s actually a sad story: I had a server that had to be exposed to the public, and not long ago, it was compromised by the latest PHP vulnerability. Fortunately, the damage wasn’t too severe. Since then, my policy has been to only expose services to the public that must be accessible to strangers, and I never expose administrative access points to the public internet. SSH access is restricted to key-based authentication, and the admin panel is accessible only from the internal network or via VPN. Two-factor authentication protects against password guessing, but it cannot prevent vulnerabilities that can be exploited before the login process even begins.
If you like being compromised then yes
I had it exposed for maybe ten years (mostly so that users could manage their accounts), nothing bass happened, but i have shut down that server about a year before the ai security disaster, so ymmv
I guess that depends: are you okay with literally anyone accessing this computer? If so, change nothing.
If you’re trying to just give yourself access to your own computer, stop forwarding ports and download Tailscale.
I don’t think it’s ever been considered safe to be publicly accessible.
I probably wouldn’t expose it, while I don’t think it’s been a problem in the past, with LLMs being used to find vulnerabilities so much in the past few months it seems prudent to do everything you can reasonably do to secure things.
Tailscale is so easy to use it seems worth the bit of extra hassle.
