9 ms·

I’m looking for a secure authentication/proxy application to put in front of the webservers that have to be exposed to the internet. The application will authen

by aborsy 3y ago

I’m looking for a secure authentication/proxy application to put in front of the webservers that have to be exposed to the internet. The application will authenticate the user with SSO or hardware key, before forwarding the traffic to the right internal address. Cloudflare Tunnels are great, but CF doesn’t allow the TLS pass through. CF man in the middles and decrypts the traffic. So far I have looked into Teleport, authelia, authentik, and keycloak, perhaps combined with Traefik. Any feedback on the level of security of these tools for being exposed to the public internet?

lukax 3y ago
If your auth provider supports is OAuth 2 OIDC you should check oauth2-proxy. It's just one binary or a container sidecar. https://github.com/oauth2-proxy/oauth2-proxy https://github.com/oauth2-proxy/oauth2-proxy
deleted 3y ago
[deleted]
FuriouslyAdrift 3y ago
Granted we are a Microsoft-based shop, but Microsoft Entra Application Proxy has worked out great for exposing our internal web based apps to the outside for mobile/home workers. https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy https://learn.microsoft.com/en-us/entra/identity/app-proxy/a...
- aborsy 3y ago
  This seems to be very similar to the Cloudflare tunnels. They are reverse proxies in the cloud, with TLS termination. The traffic is terminated and scanned in the cloud. https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-security https://learn.microsoft.com/en-us/entra/identity/app-proxy/a... A version with end to end encryption will be great!