this post was submitted on 17 Apr 2025
3 points (100.0% liked)

Selfhosted

60366 readers
747 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
3
Is it normal to not have any malicious login attempts? (reddthat.com)
submitted 1 year ago by hit_the_rails@reddthat.com to c/selfhosted@lemmy.world
17 comments fedilink hide all child comments
 

cross-posted from: https://reddthat.com/post/39309359

I've been running Home Assistant for three years. It's port forwarded on default port 8123 via a reverse proxy in a dedicated VM serving it over HTTPS and is accessible over ipv4 and ipv6. All user accounts have MFA enabled.

I see a notification every time there's a failed login attempt, but every single one is either me or someone in my house. I've never seen a notification for any other attempts from the internet. Not a single one.

Is this normal? Or am I missing something? I expected it to be hammered with random failed logins.

you are viewing a single comment's thread
view the rest of the comments
[–] Shimitar@downonthestreet.eu 1 points 1 year ago (2 children)

Yes. The fearmongering of the security freaks is not necessarily true. We selfhosters are not big targets and nobody cares about our files or our devices.

Of course, until you get hacked.

But beside SMTP and ssh and known services like WordPress or PrestaShop there is little actual brute force bots trying hard.

[–] greyfox@lemmy.world 1 points 1 year ago

Agreed. The nonstandard port helps too. Most script kiddies aren't going to know your service even exists.

Take it another step further and remove the default backend on your reverse proxy so that requests to anything but the correct DNS name are dropped (bots just are probing IPs) and you basically don't have to worry at all. Just make sure to keep your reverse proxy up to date.

The reverse proxy ends up enabling security through obscurity, which shouldn't be your only line of defence, but it is an effective first line of defence especially for anyone who isn't a target of foreign government level of attacks.

Adding basic auth to your reverse proxy endpoints extends that a whole lot further. Form based logins on your apps might be a lot prettier, but it's a lot harder to probe for what's running behind your proxy when every single URI just returns 401. I trust my reverse proxy doing basic auth a lot more than I trust some php login form.

I always see posters on Lemmy about setting up elaborate VPN setups for as the only way to access internal services, but it seems like awful overkill to me.

VPN still needed for some things that are inherently insecure or just should never be exposed to the outside, but if it is a web service with authentication required a reverse proxy is plenty of security for a home lab.

[–] Vendetta9076@sh.itjust.works 1 points 1 year ago (1 children)

I had three thoughts in rapid succession.

  1. that's a dangerous line of thinking
  2. I wonder who these security freaks are
  3. looks at honeypot Oh no IM the security freak.

That being said fearmongering is bad. Give people actual facts and let them decide for themselves.

[–] Shimitar@downonthestreet.eu 1 points 1 year ago

LOL you madre me laugh...

Anyway being security conscious is important, and better be safe than sorry...