As the title says ive started running webmin. And i wanna know if its safe for me to reverse proxy (with 2fa) or should i just use tailscale or ssh to access it.
I had it exposed for maybe ten years (mostly so that users could manage their accounts), nothing bass happened, but i have shut down that server about a year before the ai security disaster, so ymmv
Let me check what’s your IP?
Why would you want to expose it to the web in the first place? In a homelab scenario, you’re the only one who needs access, so putting it behind a VPN comes at zero convenience or monetary cost.
My homelab stuff I like to be able to access from places that take all my free time (like work), making things accessible is a bit of a requirement for me.
That’s fair, but I still can’t see how a VPN connection makes your stuff less accessible - at least to you.
Just by making it so I can’t access from a system I don’t control. Like say I need to retrieve a document from my house, but I’m in a SCIF, or a waiting room, or anywhere else I wouldn’t have my personal device, it’s super useful to just connect to something like Nextcloud and pull it down.
I didn’t say you should put your Nextcloud instance behind a VPN. Mine is public too.
I’m saying you should put your administrative access behind a VPN. SSH, reverse proxy admin panel, you name it. You need not do administrative stuff from work.
Oh yeah, I 100% agree with that, honestly two VPNs are better given you wouldn’t want your normal VPN to terminate into your management vlan (nor should you want your management vlan to have access to the internet). I thought we were just discussing normal homelab stuff, all administrative stuff should really be oob.
So setup a VPN
Hmm… Where I work setting up a VPN on my work machine would not only break my workflow, it would probably cost me my job. Plus I’m not a big fan of giving computers I don’t control access to the internals of my network. Reverse proxies were invented for a reason, no reason not to use one.
I would never do something like that. It’s actually a sad story: I had a server that had to be exposed to the public, and not long ago, it was compromised by the latest PHP vulnerability. Fortunately, the damage wasn’t too severe. Since then, my policy has been to only expose services to the public that must be accessible to strangers, and I never expose administrative access points to the public internet. SSH access is restricted to key-based authentication, and the admin panel is accessible only from the internal network or via VPN. Two-factor authentication protects against password guessing, but it cannot prevent vulnerabilities that can be exploited before the login process even begins.
If you actually got pwned by the latest PHP vuln, you need to talk to the security researchers who are running all these honeypots and only managed to capture unsuccessful exploitation attempts.
An actual working exploit in the wild is real news
Jamie is a cool guy. He’s also super smart. But he’s not infallible, and so I must secure this and only run it from the internal admin network. Because that’s best-practice.
It is almost always a bad idea to place a management interface on the internet. No level of strong password and multifactor auth will protect against an unauthenticated RCE which every language will get, including Perl.
Absolutely stick it behind tailscale.OK, but if your threat landscape is someone burning 2 zero days (one tail scale, one webmin) you aren’t likely to be posting here for answers you will have security people on call.
Geofencing is always a good option for remote access, no point in allowing someone from Spain to login when you are in Germany.
@slazer2au I’m just pointing out that tailscale isn’t immune to security issues either. Maybe sticking webmin behind tailscale is the correct way to go, or maybe it’s better to set up a heavily-restricted reverse proxy and keep the webmin user(s) off of the OP’s private tailscale network.
Not an RCE tho
Never in a million years would I do this
Considering the vulnerabilities that have been found just this past year, I sure wouldn’t. Use a VPN.
Webmin is still around‽
Yes, and it’s very useful. Cockpit, too.
I would never expose either of them to the internet.
I use cockpit, but via the client. They have a flatpak client that gives you cockpit’s features, connects over ssh (and reuses your ssh config), and doesn’t require anything to be installed on the host/server you are managing (besides ssh ofc).
This sounds very handy.
What’s it good for? I mean, beyond good ol SSH?
ssh is probably fine for 99% of things. I use ssh exclusively mostly
The features I load cockpit up for is:
- easier viewing of systemd/journalctl logs. You can click on services and see logs, search them, and so on.
- Partitioning a disk. Nothing too crazy, but I can format a disk, wipe them, via the GUI
- Networking configuration. If you are using networkmanager, cockpit will test the changes, attempt to connect, and then revert the changes if the connection fails (in like 15-30 seconds). This is legitimately insanely useful, I can change the ip address or something, connect via cockpit again, and only have the change stick if it’s actually good. (See also,
netplan tryfrom the netplan configuration framework.)
Cockpit also offers a GUI for managing virtual machines (via libvirt) or podman contaniers. So someone else might want that, although I don’t really use that. (virtual machines can be managed remotely via virt-manager over ssh by connecting to
qemu+ssh://user@remote-host/system, I manage podman via the terminal).Sometimes I don’t want to use command line. Sometimes I just want to use a mouse.
If you like being compromised then yes
Is tail scale really that much more secure than reverse proxy and auth control?
Tailscale and wire guard, it’s underlying vpn application, have a big stake in being secure. Webmin not as much more focused on providing features and being secure. There is much more surface areas for a web application over a simple vpn service. And self hosted you probably aren’t implementing intrusion monitoring as serious as tailscale web services would.
Tailscale is just wireguard with a central management console.
Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible. This is fundamentally different than for example a web interface, which needs to present “the Web page” to allow the user to log in, which might involve multiple individual parts that can already have a 0-day.
As a more direct comparison: look into historic vulnerabilities between ipsec VPN and SSL VPN. The former is the older technology, the second is more “web like”. The number of serious CVEs for the latter over just some manufacturers (Cisco, fortinet, …) in one year probably beats the number for ipsec in is entire life time.
Going back to Tailscale (or netbird, …): it is one very secure layer which then secures everything. You can have 1 service or 20, same security. If you expose individual services, c you also expose every possible vulnerability of all of them, so all 20 services if that’s what you run.
I disagree.
Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible.
VPN service is… a service. Of course it is. Tailscale has been around for a few years, Apache was there since shortly after the dinosaurs roamed earth. It survived a bunch more battles than any VPN. The only authentication happening at the network level would be 802.1x or such, but this connects to radius (clearly a classic service) and other components. Auth in VPNs is just the same.
So no, a properly secured reverse proxy is all the same. I recommend mtls for ease of use and brute-force resistance. Chose a proper private key :p
Makes sense. Its unfortunate though that it presents a hurdle for end users. My users need to hit a webpage and acesss stuff, asking them to connect to a VPN client is too much.
It’s all a matter of what you consider reasonable risk. I also run some specific services exposed where it makes sense (they are designed to do this, think things like home assistant or next cloud or jellyfin), but would never put anything that is used to do server administration public facing (Webmin, Termix, proxmox, that sort of thing). If the purpose of the tool is to perform or allow elevated actions, I run it behind a VPN (yes for me that includes ssh).
There’s also a difference between being randomly port scanned and/or probed, or being actively and personally targeted for some reason. If the second is ever a reasonable threat, that changes what is acceptable dramatically as well.
All good thoughts, thank you
Ive been looking at headscale dont know if its better as im not well versed in vpn or tailscale or any of it but it seems better
Not necessarily. But it’s one service, compared to multiple, which could each have their own vulnerabilities. It’s about reduction of risk.
Short answer: No.
Long answer: Hell, no!
