7mo ago

What do you guys do about usernames / passwords for your local services?

Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn't really think about it when I started. I make a half-assed effort at security where I don't use "admin" or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I'm running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what's the threat model? Is there an easier way?

82 comments

random credentials + password manager
- Never not
- Exactly, the same way I handle all my credentials.

Public-facing: Password generator, stored in a password manager.
Internal LAN: Everything gets the same re-used, low-effort password.
Nobody is going to hack my CUPS server.
- Yes, basically on internal LAN I put admin admin to everything.
- But if they do, they have every password for all your stuff. hopefutlly you have Ipv6 disabled
  
  Just because each device has a globally routable IP address doesn't mean they can be accessed from outside your LAN. You still have to add a firewall rule to open a port to the device.
  
  IPv6 should not be disabled under any circumstances.
  In fact, many devices in my house have IPv4 disabled. Disabling IPv4 on my public-facing SSH reduced the attack traffic to zero.
  IPv4 is shit.
  
  Is ipv6 that bad.
  I keep hearing there is no real benefit and risk to it?

hunter2
- All I see is
- Wait, how do you know my password?
  
  I put on my robe and wizard hat
- Correct horse battery staple
  Need to pad those passwords.

Everything gets a different, long random password. It's not a hassle because my password manager handles everything. It's bitwarden for whatever I may need to access elsewhere, few admin logins there, keepass everything else.

Nice try FBI 😏😁
- Not today, CIA!
- Feds@fbi.gov
  Jan6wasaninsidejob

All my local services follow the same rules as any other service. I have no idea what the passwords are, they are all random and long as fuck in my password manager. 2FA with a hardware key where allowed, TOTP if not.
What possible reason would anyone have to "relax" or security on local services? That would mean having 2 streamlines which only adds friction.
I strongly suggest you move all your credentials out of your browsers and into a password manager.

Apps: SSO via Authentik where I can, unique user/pass combo via Bitwarden where I can't (or, more realistically, don't want to).
General infra: Unique RSA keys, sometimes Ed25519
Core infra: Yubikey
This is overkill for most, but I'm a systems engineer with a homelab, so it works well for me.
If you're wanting to practice good security hygiene, the bare minimum would be using unique cred pairs (or at least unique passwords) per app/service, auto-filled via a proper password manager with a browser extension (like KeePassXC or Bitwarden).
Edit: On the network side, if your goal is to just do some basic internal self-hosting, there's nothing wrong with keeping your topo mostly flat (with the exception of a separate VLAN for IoT, if applicable). Outside of that, making good use of firewalls will help you keep things pretty tight. The networking rabbit hole is a deep one, not always worth the dive unless you're truly wanting to learn for the sake of a cert/job/etc.

Unify them.
I use a container that runs an AD in Samba4: https://nowsci.com/samba-domain
LDAP from that is used for services like Nexcloud, etc.
I then run Keycloak to add OIDC to the AD: https://www.keycloak.org/
This is for other services like Outline that only support Oauth/OIDC
And lastly, I use Oauth2-proxy to support everything else by adding OIDC to my nginx proxy: https://oauth2-proxy.github.io/oauth2-proxy/
This supports systems like SearNGX with no native login that I want to limit to my users.
Now I have a full FOSS Active Directory for SSO logging into computers and services that supports 2FA where desired.

- What self-hosted services did you set up passkeys on? How did setting it up go?

Keycloak to provide OIDC, although in hindsight I should have gone with ~~Authelia~~ Authentik

I’ve been looking into some kind of simple SSO to handle this. I’m tired of entering passwords (even if it’s all done by the password manager) a single authentication point with a single user would be great.
Keycloak and friend are way too complex. Ideally I would like to have something in my nginx reverse proxies that would handle authentication at that level and tell the final app what user is logged on in some safe way.
- any oauth (I use kanidm) and oauth2-proxy solves that and now you can easily use passkeys to log into your intranet resources.
- Never tried Authelia or Authentik but I've heard good things about them. I'm sure one of them will integrate with a reverse proxy.
  
  Those solutions are still way too complex and corporate to my likes. :(
- Is there a passkey setup that's easy to self host? I think passkeys with a backup would be best.
  
  I’ve been looking at https://github.com/stonith404/pocket-id?ref=selfh.st
  
  Hmm this is actually interesting, passkeys would indeed make things simpler.

Since I'm already using Bitwarden, generating and storing passwords is easy. I use my name as the username, though that user doesn't have admin privileges.

Same way I do at work. Different accounts and passwords for each service internally. Any service exposed to the net (game and email servers mostly) is on a segregated network and each machine has unique credentials to help prevent lateral movement. Self hosted Bitwarden tracks it all.
I do it for the same reason I require outbound firewall rules for almost everything on my home network - I’m a masochist.

Like several people here, I've also been interested in setting up an SSO solution for my home network, but I'm struggling to understand how it would actually work.
Lets say I set up an LDAP server. I log into my PC, and now my PC "knows" my identity from the LDAP server. Then I navigate to the web UI for one of my network switches. How does SSO work in this case? The way I see it, there are two possible solutions.
The switch has some built-in authentication mechanism that can authenticate with the LDAP server or something like Keycloak. I don't see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
I log into and authenticate with an HTTP forwarding server that then supplies the username/password to the switch. This seems clunky but could be reasonably secure as long as the username/password is sufficiently complex.
I generally understand how SSO works within a curated ecosystem like a Windows-based corporate network that uses primarily Microsoft software for everything. I have various Linux systems, Windows, a bunch of random software that needs authentication, and probably 10 different brands of networking equipment. What's the solution here?
- Your confusion is confusing me lol
  I don't see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
  Wdym? That's not a thing, you can have some devices on LDAP some with local logins and some with OIDC or any other combination. Authentication is generally an application layer thing and switches operate at layer 2 maybe 3 if it's doing some routing. As long as your network has a functioning DHCP server the web UI of the switch will be able to communicate with the LDAP server that you configure it to
  
  I think I'm misunderstanding how LDAP works. It's probably obvious, but I've never used it.
  If my switch is expecting a username and password for login, how does it go from expecting a web login to "the LDAP server recognizes this person, and they have permissions to access network devices, so I'll let them in."?
  Also, to be clear, I'm referring to the process of logging in and configuring the switch itself, not L2 switching or L3 routing.

Personally keep it very simple using same username and password for my services. But I also don't host anything of value, just messing around with a few different projects I come across. Yes it's not good practice, but nothing is exposed works well for me.

My goal is to have all my services being a reverse proxy, even on LAN, and use passwordless authentication via passkeys/webauthn. I haven’t yet tried it but have been eyeing this: https://github.com/stonith404/pocket-id?ref=selfh.st
- I am very much looking for feedback on this self-proclaimed simple oidc. Authentik is not as bad as Keycloak, but from what I reckon theres still room for improvement! -fingers crossed-

Don't remember the tool, maybe someone here does, but there's some web service out there that boasts a "no storage" approach. You provide some URI and some other value (maybe username) and it makes a password for you, but it's always the same for a given combination. Basically it's a purely functional generator.
Downside would be forgetting a minor detail (Did it end with a slash or not? What was the username?) or the site going down. You can achieve the same thing yourself with a hash calculator but those passwords are a bitch to type in.
tl;dr just use KeePass

I have a local instance of Vaultwarden that I use to generate and store the credentials for my local services, and I use normal cloud-hosted Bitwarden for all my other passwords.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters	More Letters
CGNAT	Carrier-Grade NAT
DHCP	Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
IP	Internet Protocol
IoT	Internet of Things for device controllers
NAT	Network Address Translation
SSH	Secure Shell for remote terminal access
SSO	Single Sign-On
nginx	Popular HTTP server

[Thread #927 for this sub, first seen 20th Aug 2024, 14:45] [FAQ] [Full list] [Contact] [Source code]

Currently I have terrible local password rules.
Once I get my Vaultwarden reinstalled, everything will use properly managed passwords, with 2FA for things like servers/services/admin accounts (routers, DNS, etc).

Maybe ldap? I might do that for my setup.

I use anzo and as password an empty string. It's never been guessed :p

82 comments