3 ms·

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse prox

by mmcnl 3y ago

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns. [0] https://github.com/lldap/lldap https://github.com/lldap/lldap [1] https://www.authelia.com/integration/proxies/caddy/ https://www.authelia.com/integration/proxies/caddy/

ciceryadam 3y ago
Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia https://aur.archlinux.org/packages/authelia
- enasterosophes 3y ago
  That's not a new release of authelia. Authelia's releases are at https://github.com/authelia/authelia/releases https://github.com/authelia/authelia/releases The updates to the AUR package were not about new releases since 2022: aur/authelia $ git log ad4e6ca^..HEAD 2c5029d (2023-10-09) Amir Zarrinkafsh ECDB8EF9E77E4EBF (HEAD -> authelia, origin/authelia) Fix frozek lockfile issue with pnpm 246d77c (2023-01-22) Amir Zarrinkafsh ECDB8EF9E77E4EBF Utilise pnpm instead of yarn ad4e6ca (2022-12-21) Amir Zarrinkafsh Update to v4.37.5
  - ciceryadam 3y ago
    I stand corrected, thanks!
- james_d_elliott 3y ago
  If you'd like a newer build of the pre-release they are available. Feel free to reach out on GitHub Discussions (may not see it here but see how we go).
c-hendricks 3y ago
> My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns. I'm a bit concerned about that too. When setting it up, I found a lot of their docs on github mentioned they have `template` and `expand-env` "configuration filters", then it took me entirely too long to realize that while the 4.38 pre-release notes, posted in January 2023, say it's "just around the corner", it's still being worked on. Having said that, there still seems to be somewhat active development. It may just be one person at this point. https://hub.docker.com/layers/authelia/authelia/v4.38.0-beta3/images/sha256-406769c856f68c837ea6bf648c416c5185235d9c030c98ad86f30584df387a86?context=explore https://hub.docker.com/layers/authelia/authelia/v4.38.0-beta... https://github.com/authelia/authelia/commits/v4.38.0-beta3/ https://github.com/authelia/authelia/commits/v4.38.0-beta3/
- james_d_elliott 3y ago
  It's me and two others though I'm definitely the most active. We put a lot of effort into security best practices and one of my co-developers is currently reviewing the 4.38.0 release. It's a fairly major release with a lot of important code paths that have been improved for the future. Our official docs can be found at https://www.authelia.com https://www.authelia.com and you can find docs for a particular PR in the relevant PR. We've also linked the pre-release docs in the pre-release discussions which can be found here: https://github.com/authelia/authelia/discussions/categories/pre-release-feedback https://github.com/authelia/authelia/discussions/categories/...
james_d_elliott 3y ago
Hey one of the Authelia developers here. We're very actively working on a very large release (it's just going through the peer review process and it should be good to go) and we currently have a pre-release for users to dive into. I can understand the security concerns but we are regularly taking measures to ensure no zero-day vulnerabilities exist, there are no known vulnerabilities with Authelia at the present time either directly or via the code-paths of dependencies we actually use.
- mmcnl 3y ago
  That's great to hear, I have no plans on moving away from Authelia. I love its simplicity.

by mmcnl 3y ago

ciceryadam 3y ago

Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia https://aur.archlinux.org/packages/authelia

enasterosophes 3y ago
That's not a new release of authelia. Authelia's releases are at https://github.com/authelia/authelia/releases https://github.com/authelia/authelia/releases The updates to the AUR package were not about new releases since 2022: aur/authelia $ git log ad4e6ca^..HEAD 2c5029d (2023-10-09) Amir Zarrinkafsh ECDB8EF9E77E4EBF (HEAD -> authelia, origin/authelia) Fix frozek lockfile issue with pnpm 246d77c (2023-01-22) Amir Zarrinkafsh ECDB8EF9E77E4EBF Utilise pnpm instead of yarn ad4e6ca (2022-12-21) Amir Zarrinkafsh Update to v4.37.5
- ciceryadam 3y ago
  I stand corrected, thanks!
james_d_elliott 3y ago
If you'd like a newer build of the pre-release they are available. Feel free to reach out on GitHub Discussions (may not see it here but see how we go).

c-hendricks 3y ago

> My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns. I'm a bit concerned about that too. When setting it up, I found a lot of their docs on github mentioned they have `template` and `expand-env` "configuration filters", then it took me entirely too long to realize that while the 4.38 pre-release notes, posted in January 2023, say it's "just around the corner", it's still being worked on. Having said that, there still seems to be somewhat active development. It may just be one person at this point. https://hub.docker.com/layers/authelia/authelia/v4.38.0-beta3/images/sha256-406769c856f68c837ea6bf648c416c5185235d9c030c98ad86f30584df387a86?context=explore https://hub.docker.com/layers/authelia/authelia/v4.38.0-beta... https://github.com/authelia/authelia/commits/v4.38.0-beta3/ https://github.com/authelia/authelia/commits/v4.38.0-beta3/

james_d_elliott 3y ago
It's me and two others though I'm definitely the most active. We put a lot of effort into security best practices and one of my co-developers is currently reviewing the 4.38.0 release. It's a fairly major release with a lot of important code paths that have been improved for the future. Our official docs can be found at https://www.authelia.com https://www.authelia.com and you can find docs for a particular PR in the relevant PR. We've also linked the pre-release docs in the pre-release discussions which can be found here: https://github.com/authelia/authelia/discussions/categories/pre-release-feedback https://github.com/authelia/authelia/discussions/categories/...

james_d_elliott 3y ago

Hey one of the Authelia developers here. We're very actively working on a very large release (it's just going through the peer review process and it should be good to go) and we currently have a pre-release for users to dive into. I can understand the security concerns but we are regularly taking measures to ensure no zero-day vulnerabilities exist, there are no known vulnerabilities with Authelia at the present time either directly or via the code-paths of dependencies we actually use.

mmcnl 3y ago
That's great to hear, I have no plans on moving away from Authelia. I love its simplicity.