4 ms·

Does anybody actually expose their Home Assistant installation directly on the Internet these days? Just use WireGuard!

by darkwater 6y ago

SparkyMcUnicorn 6y ago
This. And if someone has full access to my internal network, then I've got bigger problems than my TV being stolen.
- oarsinsync 6y ago
  This is a really interesting view. If someone has broken into my home, I have much bigger problems than if they've managed to break into my wifi or VPN gateway from the internet.
  - sgt 6y ago
    He probably has a cache of Bitcoins
  - twicetwice 6y ago
    I think the idea was that if an attacker sophisticated enough to overcome your reasonable defenses protecting your local network and potentially hack your Home Assistant installation or whatever else, then they're probably sophisticated enough to do something much more damaging in the long term than unlock your front door and steal your TV or whatever—eg hack your laptop/NAS/etc and clear out your bank account or steal your identity or similar. Though I just realized that I'm privileged enough to live in an area with a low violent crime rate, so physical violence isn't part of my threat model... if someone has broken into your home and you are home at the same time, you're right, the security of your local network is probably the least of your concerns.
sgt 6y ago
Nginx proxy exposed on ports 80 and 443, passing requests to HA running internally. What is wrong with that?
- alias_neo 6y ago
  You're exposing it directly to the internet. It's an attack vector because it's accessible. If a vulnerability is found in HA, you can be hacked. The secure solution is to not allow remote access and use a VPN to connect to your local network (such as WireGuard) as the commenter you replied to suggested.
- oarsinsync 6y ago
  If you're depending on HA's built-in auth, you're at risk of bugs in that code. If you throw up HTTP basic auth on your HTTPS front end, you've now moved your risk away from bugs in HA's code, to bugs in nginx's (or whatever HTTP server you use) implementation of HTTP basic auth AND bugs in HA's code (odds of this being a real event just got smaller) If you throw a VPN in front of all that as well, you've now moved your risk away from bugs in nginx's code, to bugs in your VPN implementation AND bugs in nginx's code AND bugs in HA's code (odds are now really small). This is also known as defence in depth.
  - sgt 6y ago
    I realize that but if you don't, then HA won't be accessible to you if you are somewhere where WireGuard is not possible. Does HA have an exceptionally bad security record? I think one just needs to define one's own acceptance criteria.
    - oarsinsync 6y ago
      Hence the suggestion of at least throw up a second level of HTTP basic auth from nginx in front. > HA won't be accessible to you if you are somewhere where WireGuard is not possible At that point, you also really want OTP (along with nginx HTTP basic auth), as if you're connecting from a device you don't control, it's not a bad plan to assume a keylogger may be operational. Can you help me understand a situation where you have to get into your HA instance, and none of your own personal devices are able to get online? EDIT: > Does HA have an exceptionally bad security record? Is a lack of regular security fixes needed evidence of good code, or due to lack of inspection / identification of vulnerabilities? HTTP basic auth is like a seat belt. It's a minor inconvenience that adds a layer of security. I haven't had a car crash, nor has my infra been exploited to the best of my knowledge. I still use both HTTP basic auth and seat belts every day.
matthewfelgate 6y ago
How does WiredGuard work? Would I install it on the Raspberry PI I have Home Assistant on? And they how would I remote into it over the internet?
- lostlogin 6y ago
  Install it on a machine in your network, it doesn’t have to be the same one HA is on. Once I had seen how you add a client (correct word?) to the VPN via the ssh QR code thing, my mind was a little blown and I very much felt I was in the future. Then you use the app on phone or laptop to connect to your home lan. It all runs in Docker, and a mini warning - the internal networking of the WG install was a little finicky for this first timer.
- ownagefool 6y ago
  Wireguard listens on UDP. So on regular home network with NAT you'd port forward it's UDP port from your router to which ever device is running it. This could indeed be the same Raspberry Pi. The main points are: Wireguard uses fairly strong and trusted encryption; this is basically shown by the fact it managed to be mainlined. It's basically foolproof, you don't have a myriad of options to choose from that can lead to insecure configuration. It's faster than OpenVPN and less complicated then IPSec. It's easy to tunnel all traffic or just a subset through the VPN. It should deal with roaming IP addresses fairly well (so works on a train as well as your net will). Basically, if the only open port from the internet to your LAN is wireguard, you're probably not going to be breached by someone coming in the front door. Obviously, if you open a cat.jpeg.exe when on you're network, your inbound firewall security is no longer going to be helping you, however there are also ways around this. I.E. you could segregate your desktop and phones from the main network, etc. But then a rouge IOT device that does need to connect to your homeassistant could cause problems, and you probably want some access too, so you probably want to setup some kind of auth... Yeah, I guess it can get convoluted if you're not happy with some risk / work...

Does anybody actually expose their Home Assistant installation directly on the Internet these days? Just use WireGuard!

SparkyMcUnicorn 6y ago

This. And if someone has full access to my internal network, then I've got bigger problems than my TV being stolen.

oarsinsync 6y ago
This is a really interesting view. If someone has broken into my home, I have much bigger problems than if they've managed to break into my wifi or VPN gateway from the internet.
- sgt 6y ago
  He probably has a cache of Bitcoins
- twicetwice 6y ago
  I think the idea was that if an attacker sophisticated enough to overcome your reasonable defenses protecting your local network and potentially hack your Home Assistant installation or whatever else, then they're probably sophisticated enough to do something much more damaging in the long term than unlock your front door and steal your TV or whatever—eg hack your laptop/NAS/etc and clear out your bank account or steal your identity or similar. Though I just realized that I'm privileged enough to live in an area with a low violent crime rate, so physical violence isn't part of my threat model... if someone has broken into your home and you are home at the same time, you're right, the security of your local network is probably the least of your concerns.

sgt 6y ago

Nginx proxy exposed on ports 80 and 443, passing requests to HA running internally. What is wrong with that?

alias_neo 6y ago
You're exposing it directly to the internet. It's an attack vector because it's accessible. If a vulnerability is found in HA, you can be hacked. The secure solution is to not allow remote access and use a VPN to connect to your local network (such as WireGuard) as the commenter you replied to suggested.
oarsinsync 6y ago
If you're depending on HA's built-in auth, you're at risk of bugs in that code. If you throw up HTTP basic auth on your HTTPS front end, you've now moved your risk away from bugs in HA's code, to bugs in nginx's (or whatever HTTP server you use) implementation of HTTP basic auth AND bugs in HA's code (odds of this being a real event just got smaller) If you throw a VPN in front of all that as well, you've now moved your risk away from bugs in nginx's code, to bugs in your VPN implementation AND bugs in nginx's code AND bugs in HA's code (odds are now really small). This is also known as defence in depth.
- sgt 6y ago
  I realize that but if you don't, then HA won't be accessible to you if you are somewhere where WireGuard is not possible. Does HA have an exceptionally bad security record? I think one just needs to define one's own acceptance criteria.
  - oarsinsync 6y ago
    Hence the suggestion of at least throw up a second level of HTTP basic auth from nginx in front. > HA won't be accessible to you if you are somewhere where WireGuard is not possible At that point, you also really want OTP (along with nginx HTTP basic auth), as if you're connecting from a device you don't control, it's not a bad plan to assume a keylogger may be operational. Can you help me understand a situation where you have to get into your HA instance, and none of your own personal devices are able to get online? EDIT: > Does HA have an exceptionally bad security record? Is a lack of regular security fixes needed evidence of good code, or due to lack of inspection / identification of vulnerabilities? HTTP basic auth is like a seat belt. It's a minor inconvenience that adds a layer of security. I haven't had a car crash, nor has my infra been exploited to the best of my knowledge. I still use both HTTP basic auth and seat belts every day.

matthewfelgate 6y ago

How does WiredGuard work? Would I install it on the Raspberry PI I have Home Assistant on? And they how would I remote into it over the internet?

lostlogin 6y ago
Install it on a machine in your network, it doesn’t have to be the same one HA is on. Once I had seen how you add a client (correct word?) to the VPN via the ssh QR code thing, my mind was a little blown and I very much felt I was in the future. Then you use the app on phone or laptop to connect to your home lan. It all runs in Docker, and a mini warning - the internal networking of the WG install was a little finicky for this first timer.
ownagefool 6y ago
Wireguard listens on UDP. So on regular home network with NAT you'd port forward it's UDP port from your router to which ever device is running it. This could indeed be the same Raspberry Pi. The main points are: Wireguard uses fairly strong and trusted encryption; this is basically shown by the fact it managed to be mainlined. It's basically foolproof, you don't have a myriad of options to choose from that can lead to insecure configuration. It's faster than OpenVPN and less complicated then IPSec. It's easy to tunnel all traffic or just a subset through the VPN. It should deal with roaming IP addresses fairly well (so works on a train as well as your net will). Basically, if the only open port from the internet to your LAN is wireguard, you're probably not going to be breached by someone coming in the front door. Obviously, if you open a cat.jpeg.exe when on you're network, your inbound firewall security is no longer going to be helping you, however there are also ways around this. I.E. you could segregate your desktop and phones from the main network, etc. But then a rouge IOT device that does need to connect to your homeassistant could cause problems, and you probably want some access too, so you probably want to setup some kind of auth... Yeah, I guess it can get convoluted if you're not happy with some risk / work...