Comment on Is Authelia enough without fail2ban or crowdsec?

Arda@piefed.social ⁨16⁩ ⁨hours⁩ ago

• Ooops@feddit.org ⁨16⁩ ⁨hours⁩ ago

  It’s basically two-way TLS. It’s not only your server providing a certificate to prove it’s the real thing and not just some men-in-the-middle device or your connection for redirected, but the other side of the connection using the certificate, too, to show they are actually the devices allowed to communicate.

  So this basically revert the security. You are no longer trying to filter out access attempts when they show questionable behavior, but completely reject anything unless it’s explicitly authorized. Which of course only works when you or (a small number you can manually manage of) others access that stuff from fixed devices that you can set up properly.

  PS: For me fail2ban does basically something similiar. I have several web interfaces exposed via reverse proxy. But I barely ever use those interfaces manually; normally it’s via apps that access the services via that web interface. So things like failed authentifications or misstyped passwords don’t happen (unless when setting up something new maybe and then I’m there to unban a device manually if I screwed up). So fail2ban is set up to aggressively bans IPs for hours just for a single failed attempt.

  That’s keeping all those spammy bots looking for easy targets away very effectively, yet completely invisible for my legitimate use. After all that’s always the core issue: security vs. convenience. You build the best possible security that also doesn’t overly interferes with your normal use. Also the reason there is no on-size-fits-all solution because it’s about your use-case.

  original

  • nameisnotimportant@sh.itjust.works ⁨11⁩ ⁨hours⁩ ago

    Thanks for the writeup, do you know a way to implement implement this into a homelab?

    original
  • ArseAssassin@sopuli.xyz ⁨16⁩ ⁨hours⁩ ago

    Fair enough. I didn’t settle for fail2ban though because I wanted to weed out possible automated attacks against software with known vulnerabilities. As a bonus it gives me a simple way to look through the logs and see which one of my friends and family are actually using the services I’ve set up.

    original