It’s basically two-way TLS. It’s not only your server providing a certificate to prove it’s the real thing and not just some men-in-the-middle device or your connection for redirected, but the other side of the connection using the certificate, too, to show they are actually the devices allowed to communicate.
So this basically revert the security. You are no longer trying to filter out access attempts when they show questionable behavior, but completely reject anything unless it’s explicitly authorized. Which of course only works when you or (a small number you can manually manage of) others access that stuff from fixed devices that you can set up properly.
PS: For me fail2ban does basically something similiar. I have several web interfaces exposed via reverse proxy. But I barely ever use those interfaces manually; normally it’s via apps that access the services via that web interface. So things like failed authentifications or misstyped passwords don’t happen (unless when setting up something new maybe and then I’m there to unban a device manually if I screwed up). So fail2ban is set up to aggressively bans IPs for hours just for a single failed attempt.
That’s keeping all those spammy bots looking for easy targets away very effectively, yet completely invisible for my legitimate use. After all that’s always the core issue: security vs. convenience. You build the best possible security that also doesn’t overly interferes with your normal use. Also the reason there is no on-size-fits-all solution because it’s about your use-case.
tell me more
It’s basically two-way TLS. It’s not only your server providing a certificate to prove it’s the real thing and not just some men-in-the-middle device or your connection for redirected, but the other side of the connection using the certificate, too, to show they are actually the devices allowed to communicate.
So this basically revert the security. You are no longer trying to filter out access attempts when they show questionable behavior, but completely reject anything unless it’s explicitly authorized. Which of course only works when you or (a small number you can manually manage of) others access that stuff from fixed devices that you can set up properly.
PS: For me fail2ban does basically something similiar. I have several web interfaces exposed via reverse proxy. But I barely ever use those interfaces manually; normally it’s via apps that access the services via that web interface. So things like failed authentifications or misstyped passwords don’t happen (unless when setting up something new maybe and then I’m there to unban a device manually if I screwed up). So fail2ban is set up to aggressively bans IPs for hours just for a single failed attempt.
That’s keeping all those spammy bots looking for easy targets away very effectively, yet completely invisible for my legitimate use. After all that’s always the core issue: security vs. convenience. You build the best possible security that also doesn’t overly interferes with your normal use. Also the reason there is no on-size-fits-all solution because it’s about your use-case.
nameisnotimportant@sh.itjust.works 3 weeks ago
Thanks for the writeup, do you know a way to implement implement this into a homelab?