4 ms·
Using it mainly because of the paranoia of just exposing RDP to the internet. Http(s) is very convenient to add more layers of security, in my case via NGINX (b
by buybackoff 5y ago
Using it mainly because of the paranoia of just exposing RDP to the internet. Http(s) is very convenient to add more layers of security, in my case via NGINX (both as LXC containers in Proxmox). I'm using a wildcard domain *.myhome.tld pointed to my static IP. Guacamole is hosted at try_guess_me.myhome.tld, with NGINX basic auth same for all subdomains (further protected by fail2ban). So in total 3 tokens are required (subdomain and basic auth username and password) just to get to the Guacamole login page, where additional username/password + 2FA are required. I used to expose RDP directly for years, but after a chat with a colleague before vacations and a purchase of a NUC for a homelab server decided to strengthen the security slightly.
RDP is still much better user experience, so once when I needed a longer session I used Guacamole to access my router admin interface and temporarily expose RDP directly via a random port and a very strong password. I'm still not convinced that the latter combination is not enough, but it's better to be safe than sorry.
- xen2xen1 5y agoThere is an IP ban / fail2ban app for windows and RDP, nice extra layer.
- ncrmro 5y agoFor a lot of my stuff, the devices domain is only resolvable on my Wireguard’s dns and access allowed only from Wireguard’s subtnet.
- buybackoff 5y agoI wanted to avoid VPN both for my main working/dev machine and clients. What if VPN does not go up after hard reboot due to some weird loading order while I'm not logged in (e.g. electricity failure)? Both that machine and Guacamole/NGINX host are configured to autostart after powering off. This is the first thing I tested. For clients, I do not want to have VPN on each of them. And what if I need to use a random machine? Multi-layer opaque https endpoint seems safe enough.
- ncrmro 5y agoFair point, I have a pi 4 running pihole and wireguard so starts up and runs everything on power. Also boot disk is on zfs so scrubs each week incase of microsd corruption. The Wireguard in Docker automatically generates new client configs from ENVS.
- iudqnolq 5y agoI'm about to leave a system running on a pi 4 for a few months. Any details on your advice? Based on cursory googling [1] your setup looks non-trivial> [1]: https://forums.raspberrypi.com/viewtopic.php?t=284991 https://forums.raspberrypi.com/viewtopic.php?t=284991
- ncrmro 5y agoIt was actually pretty easy, I’ve used these guides for zfs on most of my Linux infra. https://openzfs.github.io/openzfs-docs/Getting%20Started/Ubuntu/Ubuntu%2020.04%20Root%20on%20ZFS%20for%20Raspberry%20Pi.html https://openzfs.github.io/openzfs-docs/Getting%20Started/Ubu...
- cm2187 5y agoYou might also consider an IP whitelist. The firewall is still probably the best place to stop any unwanted connection attempt. Also gives you good protection against zero days. Have a central location for what IPs are allowed to connect (like aws s3) and the server downloading it every 5min, and applying it to the firewall if it changed.
- buybackoff 5y agoIn most cases I use it via my smartphone with dynamic IPv6. A whitelist fir a train trip is impossible.
- cm2187 5y agoBut don't you keep the same IP as you roam by train? All you need is a way to whitelist your new IP easily (I created a website that has just a button for that), and wait less than 5 minutes that the server picks up the new list.
- buybackoff 5y agoI've just checked before replying above, IP changes on every reconnect while being in the same room. It would be really bad usability with a whitelist. In my setup only 2FA cannot be saved in a browser, and login session is valid for a long time, so I do not have to re-login on every reconnect.