Tailscale and wire guard, it’s underlying vpn application, have a big stake in being secure. Webmin not as much more focused on providing features and being secure. There is much more surface areas for a web application over a simple vpn service. And self hosted you probably aren’t implementing intrusion monitoring as serious as tailscale web services would.
Comment on Is webmin safe to hsve accesible over the web
crandall@lemmy.today 3 hours ago
Is tail scale really that much more secure than reverse proxy and auth control?
epyon22@sh.itjust.works 2 hours ago
lka1988@lemmy.dbzer0.com 2 hours ago
Tailscale is just wireguard with a central management console.
DrunkAnRoot@sh.itjust.works 3 hours ago Ive been looking at headscale dont know if its better as im not well versed in vpn or tailscale or any of it but it seems better
frongt@lemmy.zip 3 hours ago
Not necessarily. But it’s one service, compared to multiple, which could each have their own vulnerabilities. It’s about reduction of risk.
Creat@discuss.tchncs.de 2 hours ago
Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible. This is fundamentally different than for example a web interface, which needs to present “the Web page” to allow the user to log in, which might involve multiple individual parts that can already have a 0-day.
As a more direct comparison: look into historic vulnerabilities between ipsec VPN and SSL VPN. The former is the older technology, the second is more “web like”. The number of serious CVEs for the latter over just some manufacturers (Cisco, fortinet, …) in one year probably beats the number for ipsec in is entire life time.
crandall@lemmy.today 1 hour ago
Makes sense. Its unfortunate though that it presents a hurdle for end users. My users need to hit a webpage and acesss stuff, asking them to connect to a VPN client is too much.
Creat@discuss.tchncs.de 1 hour ago
It’s all a matter of what you consider reasonable risk. I also run some specific services exposed where it makes sense (they are designed to do this, think things like home assistant or next cloud or jellyfin), but would never put anything that is used to do server administration public facing (Webmin, Termix, proxmox, that sort of thing). If the purpose of the tool is to perform or allow elevated actions, I run it behind a VPN (yes for me that includes ssh).
There’s also a difference between being randomly port scanned and/or probed, or being actively and personally targeted for some reason. If the second is ever a reasonable threat, that changes what is acceptable dramatically as well.
crandall@lemmy.today 1 hour ago
All good thoughts, thank you