4 ms·
this kind of stuff shouldn't be exposed to the open internet. use an internal network with vpn or at the very least look at something like Cloudflare Access.
by riffic 5y ago
this kind of stuff shouldn't be exposed to the open internet. use an internal network with vpn or at the very least look at something like Cloudflare Access.
- KronisLV 5y agoWhy not just something like basicauth (or mTLS for all i care) at the reverse proxy web server level, at least for relatively low value assets? It seems like security related functionality always has flaws or there are other RCEs that pop their heads up every now and then, another one in recent memory was an exiftool problem in GitLab: https://nvd.nist.gov/vuln/detail/CVE-2021-22205 https://nvd.nist.gov/vuln/detail/CVE-2021-22205 So why not introduce software with a better track record, like web servers as an additional security layer (at least against automated attacks). In my eyes, that's a good middle ground between needing a VPN and having everything open, because zero trust doesn't work well when you don't constantly keep track of CVEs for the software etc. and have the resources to mitigate those almost immediately. So, why would that fail, apart from basicauth not being the best solution technically?