Self-Hosters Wrestling Auth & Secrets
Users are grappling with the complexities and anxieties of securing self-hosted applications and data. This involves managing authentication, encryption, backups, and dealing with evolving security requirements, often leading to frustration and a desire for simpler, more reliable solutions. The need for robust, self-managed security is paramount.
SOURCES (60)
“I'm curious to know how different developers save their API keys, tokens and anything that is used in their web apps and projects, do you store them in notepad like me or have a more elegant way to do things? :) submitted by /u/Cool_Prismo [link]…”
“one thing i'd change: that management machine is effectively the root of the whole network. if it gets phished, the VLANs stop helping because its IP can reach everything. i'd put admin access on a separate account or small admin VM, restrict its firewall rule to management ports instead of any-any, and keep normal browsing/email off it. also test the deny rules from a random Main and IoT client after every firewall change - a policy you never test tends to drift.”
“Use a VM and take snapshots in case if something goes wrong to restore it and call it a day”
“Yes, basically, that is it. In NextExplorer I also used admin groups so as long as you keep the group ‘name’ the same as in Authentik, that also works.”
“Its selfhosted but i build the Encryption with Claude. Its fully workin on my own Server no API or something else.”
“I only mentioned Mealie as an example, in your case it could be Authentik users who added their games to Romm or files to NextExplorer. So you simply recreated the users manually in Pocket ID and updated the OIDC configuration and that was it? The apps were able to recognize the re-established users and their games/files etc. just fine as if you still used Authentik?”
“Exactly. “User keeps keys” is useful info, but it is not the full threat model. I want to know the maximum damage allowed by the permission.”
“Yeah, I started writing this myself and gave up because I know how in depth this argument can go. RC4 has cryptographic weaknesses that aren't relevant to its usage in Active Directory. A 64 bit key is considered small enough to be easily broken in cryptographic circles, but it's on no way possible to attack in a sensible timeframe. If you do any CTFs, I run hashcat on GPUs against large wordlists and then will brute force up to 8 characters. After that it becomes a multi day affair.”
“Hello, I'm asking for your help, my homelab growthed a lot, and I now use Vaultwarden as my password manager. Before that I was using a Keepass synced like that : Windows (or Linux) < - > homelab < - > Android phone but I've had a lot of conflict because sometimes syncthing didn't sync etc... Now, with Vaultwarden accessible only via VPN I'm free of all thoses problems. But, I'm a bit paranoid, and when it comes to backup, and moreover backup of my PASSWORD, Passk”
Best way to automate credential syncing between self-hosted dev and prod n8n instances?
“This is only true if you are using apps that require no communication with a server. Otherwise it's constant forced updates, and basing security on the version number of the installed app is a moot point since you can't guarantee the server will send the same replies to 2 different users.I can't parse the part about e2e not making sense for webpages.”
“Parsec phones home for login, and this should be independent of an external authenticator.”
“There's no point distinguishing between apps for use in the tunnels based on authentication since you can use auth on the tunnels anyway which would be much more secure since it blocks unauthorised traffic before it can even reach your services, in fact you might as well disable auth on the apps themselves instead of dealing with a bunch of extra passwords (where possible). The comment about trust is because Cloudflare becomes a man in the middle when you use tunnels, and you've chosen t”
“Thanks for the clarification. We're pretty inclusive so some methods e.g. TAP are available for all users. The button to add the auth method is still greyed-out.”
“Hey! I have a constraint. I need to access this this qcow2 image and I could boot it, but I am launched into restricted app. The whole image is a restricted app. Ideally, I'd like to create a user and then ssh into the guest. What's the best way to do this? libguestoolsfs seem like the best choice, but don't know what invocation I would use? submitted by /u/Due_Battle_9890 [link] [comments]”
“Have a bit of a weird one, I’m onboarding a new client into some of our tools and it’s giving me issues. Basically I OAuth log in from these tools (email filter and ZTNA app) to sync over users and register the apps in their tenant, but both are failing. Sign in logs either show success or interrupted with status code 50097. I’ve triple checked every CA policy we have and I’m sure nothing there is blocking me but it really looks like that’s the case, and my tool vendors say that’s what it looks”
“I must've googled this for weeks, read countless reddit posts, how-to documents, and gone around in god-knows how many circles, but I've finally found the solution that works (for me at least)... Issue: Installing cloudflared with zero-trust access policies is reasonably secure, and (relatively) painless. But some use cases require direct access to an app, and can't authenticate using a web-interface / certificate system. Example: AudioBookShelf... Self-Hosting your own audio-book li”
“Until yesterday (assuming you updated) tailscale ssh -i would log someone in as root even if the ACLs prevented it. Until last month, tailscale ssh 0@host would do the same. But even if there hadn't been these vulnerabilities, the idea of replacing battle-tested openssh with something new like this should at least be done with the knowledge that it's probably less secure.”
“Right right. My tailnet (and I assume most people are too) is closed to me and me only. No one else. So risk is relatively low unless somehow someone breach all my accounts and tailnet at the same with with all the 2FA. But at point I might as well give up cause hehe it’s over for a lot of things. Tailnet would be least of my concern.”
This is exactly why I swithed to AGH, but does Technitium do the same?
“Like what ? Are you referring to people not configuring their ACLs or even with ACLs?”
“The current SSH vulnerabilties I've seen (ie. the ones that have been discovered) rely on a user being in your tailnet. Anyone in your tailnet could have run tailscale ssh -i@host or tailscale ssh 0@host and login as root. So if there is nobody else in your tailnet, and there are no other vulnerabilities in services you might use (tailscale serve, tailscale funnel, tailscale itself) you're fine. As long as you didn't use an account @gmail.com to sign up before May 2025, because befor”
I got tired of switching back to console and typing `aws sso login --profile WHICH ONE WAS IT AGAIN` every time my session expired. So I made a little tool that listens…
“Meows is an Android app I wrote to watch my own servers over plain SSH. You add a server's IP and a login (password or private key), and you get CPU, memory, disk and network for that box. Nothing gets installed on the server. Why it exists: most monitoring setups want an agent on every machine. Install a daemon, open a port, send your data through someone's cloud. I run a handful of small VPSes. They're tight on RAM, and I didn't want to set that up on each one. I just wanted to”
“Don't spend thousands on a penetration test, or enterprise solutions. Here's a list of DIY tools. If they are beyond your technical ability, then let an AI guide you, or use an inexpensive monitoring service (hosted automated scanning). DIY Tools: https://scanreview.io/open-source”
“We switched to Passkey sign in, it's required by conditional access and the system preferred method. 100+ users still have phone sign-in methods from when we were MFA. We've now set up cross-tenant synchronization and all of these users are being skipped because their "Identity" in Entra is listed as "phone". These users' only other authentication method is the passkey, which you can't set as default for some reason. So the users have a stuck authentication me”
“Oh had that one covered. The trusts between domains as well. We reset and updated every account to AES 256, removed RC4, NTLM was disabled. PKI and DNS in full force for SSL and Kerberos auth instead. Thing was when resetting each account against the 2016 KDC, a certain number of them no longer worked against 2025 KDCs later without manually having the password reset for the hashes to to regenerate against the 2025 KDC. I did this project originally as an MSP for multiple customers and again for”
“Have you ever gone to log into a server or some random service with an admin account, and before you even realize what you're doing, your fingers type the admin password from a company you haven't worked at in 15 years? I think I need a vacation. submitted by /u/MegaSuplexMaster [link] [comments]”
“Sharing a PoC, a set of creds, or a log with a teammate usually means trusting whatever pastebin you used not to read it. CloakBin removes that trust: everything is encrypted client-side (AES-256-GCM via Web Crypto) before it hits the server, and the key lives in the URL fragment ( /{id}#{key} ), which browsers never send upstream. The server only ever holds ciphertext, so even a full DB compromise leaks nothing readable. Burn-after-reading (paste self-destructs on first view) Optional password”
“i doubt. with the access token, you need to connect databases individually from the Share settings, I believe.”
“While making some changes to the route53 plugin of Certbot I recently discovered that ACME challenges might be cached, are reusable and an export of the account keys lead to impersonation by a malicious actor by issuing new certificates, even after DNS credentials have been rotared. I personally always assumed that a new challenge is raised on every renewal and was negatively surprised that: Account keys can not be restored via a new challenge DNS challenge authorizations can be reused DNS chall”
“If I'm following you, by having that managed by us, and they login, it should prompt before being stopped by conditional access phishing resistant rule? Or would they need a Tap to login first”
“TXT TTL isn’t causing intermittent auth failures. Compare a failed message’s source IP, Return-Path, DKIM selector, and signing domain against a successful one; this usually exposes a secondary sending path or broken selector. Run the domain through a Domain Health Checker , then post the exact Microsoft NDR code.”
“You could create local accounts that are named for each person or you could implement centralized account management by deploying Active Directory, Entra ID, or some other centralized authN solution. Each account should be assigned to one user and they should not have a shared password because if someone commits fraud or does something wrong or illegal they can used shared passwords as a defense.”
“You are completely right to target this immediately. As an incoming admin, moving away from a shared, built-in "Administrator" account is one of the most critical security improvements you can make. To fix this without breaking existing infrastructure, you have to move carefully! It is very common for legacy setups to have backup scripts, database connections, or scheduled tasks secretly tied to that built-in admin account. My best advice would be to audit your system before you change”
“for internet-facing stuff, i would separate this into two layers instead of trying to make every app perfect. first layer: only expose one entry point, usually a reverse proxy, and put auth/rate limiting/https there. authelia/authentik in front is good for normal web apps, but be careful with apps that have mobile clients or APIs because they may not understand the extra login wall. second layer: assume one app has a bug. run each app as its own user/container, no broad host mounts, separate dat”
“Anything Web Based can use Proxy Auth with Immich. If you need API access for applications and don't want to expose it to the internet directly, you can use mTLS. Every device just needs to install the proper certificate, no VPN connection needed.”
“The point of a Yubikey is having a physical device as second factor. One thing you know (your password) plus something you have (the token). It's to prevent people from phishing your password and logging in from somewhere else - can't steal a Yubikey online. The PIN really doesn't add too much security in this scenario anyway - not unless this is an industry where you're afraid of having employees directly targeted by pickpockets. As for alternatives... TOTP still is an option th”
“I think your solution here wouldn't be at a plug-in level. Plug-ins can change the functionality of the app, but not magically make the app be able to control your phones' wireless communication hardware. You would probably need a file sharing app in your phone that can transfer files, maybe over Bluetooth.”
“Hi everyone!I am a big privacy activist and I strongly believe privacy is a fundamental human right.Lately, things have been quite frustrating to say the least. We have Meta removing end-to-end encryption over the past months, the continuing debate around EU Chat Control, and major technology companies collecting enormous amounts of data while building their own AI systems.The most popular messengers are convenient because everyone already uses them. But most of them are not truly privacy-first.”
“jellyfin ldap is fairly annoying oh well is authentik actually worth it as i would only have two more services worth exposes navidrome and immich this is a experiment after all”
“Absolutely totally safe. Right. Yet, one doesn’t want to make a mistake. Sign it as Cisco first and provide valid Hash.. :/ P.S I literally have degree in Security. ;)”
“You can force complex pins, id recommend looking into YubiProvision and YubiEnroll to make your life easier. Similar to another comment, having a simple pin isn’t directly a risk since you still physically need the key, not a massive difference to having a simple pin to unlock a personal phone for MS Auth etc, which will defo be the case for some users.”
“Newer keys are blocking simple pins. You could always go bio series. I’ve recently wrote a guide for similar https://www.theictguy.co.uk/secure-online-accounts/”
“That's a good callout. Currently from the encryption side, nothing is sent to the server as its all 100% front end encrypted. From the readers side, I suppose it would be all the normal things that are sent with http requests. But none of the actual sensitive data is transmitted, just the main symetric key (which is always in a sealed envelope too). I like the suggestion of being able to verify the sender. I could quickly add fields for extra meta data but to truly verify them I'd think”
“the metadata question is good one. IP and user agent always hit the server on any request, so that part is basically unavoidable unless you sit behind tor or vpn the sender verification part is trickier with this kind of setup. without some kind of pre-shared key or identity baked in, the link itself is the only proof. maybe a optional passphrase that gets checked on open could help but then you losing some of the simplicity overall clean execution though, I like how the raw text just stays in b”
“Is this standard? Are they gonna steal important info? Does it have anything to do with palantr? Would it be able to make a backdoor? submitted by /u/Most_Builder913 [link] [comments]”
“Is this standard? Are they gonna steal important info? Does it have anything to do with palantr? Would it be able to make a backdoor? submitted by /u/Most_Builder913 [link] [comments]”
There should be an OF app for people leaking the credentials 🙂
“Started a few years ago at a small company (< 50) and inherited an environment where only a KeePass file existed with a few credentials. It's a cloud first environment with only a little network infrastructure on-prem, and basically just boring office IT, nothing really special. Had to figure out everything by myself, and after all those years I still find shadow IT from time to time. Since then I have taken care of the environment and the users. I will leave in a few months, and I want t”
“Spent way too long chasing this, hopefully it saves someone else the trip. I was mounting a remote Linux box over SSHFS on Windows (sshfs-win / WinFsp) to edit files directly instead of doing everything over a terminal session. Every file I wrote through that mount showed up on the Windows side as a normal -rw-r--r-- (644) when I checked it. Looked completely fine. Except on the server itself, every one of those files was actually 0700, owner-only, nobody else could read them. Nginx couldn't”
“You could create a service that runs in the background and auto commits and pushes to GitHub every 20 minutes and save yourself some tokens”
“I am setting up sparkyfitness on my basic homelab. The app requires https, so I figured I could set that up real quick. Should be easy since I have an external facing domain, right? The idea is that I'd use nginx and pihole local dns records to do local subdomains with my publicfacing domain. fitness.domain.com would redirect to my local sparkyfitness instance on my own network (with tailscale helping remotely). Got an SSL token from cloudflare, added it into nginx certificate with *.domain.”
“I have been beating my head against MS licensing and ChatGPT/Claude trying to figure this out, so ended up thinking I'd just ask the hive mind. I am trying to set up a M365 Exchange tenant to replace our current non-Microsoft solution. I'm an M365 neophyte (at best), but I have the email set up and working just fine. No problems there whatsoever. What I'm looking for now is, what do I need (at a minimum) to allow for automatic "encryption" of outbound emails that trigger ba”
And how many of these thousand and one break mobile/TV clients?