this post was submitted on 20 Aug 2024
64 points (97.1% liked)

Selfhosted

60253 readers
432 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
64
What do you guys do about usernames / passwords for your local services? (lemmy.world)
submitted 2 years ago by AMillionMonkeys@lemmy.world to c/selfhosted@lemmy.world
82 comments fedilink hide all child comments
 

Basically every local service is accessed via a web interface, and every interface wants a username and password. Assuming none of these services are exposed to the internet, how much effort do you put into security here?
Personally, I didn't really think about it when I started. I make a half-assed effort at security where I don't use "admin" or anything obvious as the username, and I use a decent-but-not-industrial password - but I started reusing the u/p as the number of services I'm running grew. I have my browsers remember the u/ps.
Should one go farther than this? And if so, what's the threat model? Is there an easier way?

you are viewing a single comment's thread
view the rest of the comments
[–] corroded@lemmy.world 5 points 2 years ago (1 children)

Like several people here, I've also been interested in setting up an SSO solution for my home network, but I'm struggling to understand how it would actually work.

Lets say I set up an LDAP server. I log into my PC, and now my PC "knows" my identity from the LDAP server. Then I navigate to the web UI for one of my network switches. How does SSO work in this case? The way I see it, there are two possible solutions.

  • The switch has some built-in authentication mechanism that can authenticate with the LDAP server or something like Keycloak. I don't see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
  • I log into and authenticate with an HTTP forwarding server that then supplies the username/password to the switch. This seems clunky but could be reasonably secure as long as the username/password is sufficiently complex.

I generally understand how SSO works within a curated ecosystem like a Windows-based corporate network that uses primarily Microsoft software for everything. I have various Linux systems, Windows, a bunch of random software that needs authentication, and probably 10 different brands of networking equipment. What's the solution here?

[–] cm0002@lemmy.world 1 points 2 years ago (1 children)

Your confusion is confusing me lol

I don't see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.

Wdym? That's not a thing, you can have some devices on LDAP some with local logins and some with OIDC or any other combination. Authentication is generally an application layer thing and switches operate at layer 2 maybe 3 if it's doing some routing. As long as your network has a functioning DHCP server the web UI of the switch will be able to communicate with the LDAP server that you configure it to

[–] corroded@lemmy.world 1 points 2 years ago* (last edited 2 years ago) (1 children)

I think I'm misunderstanding how LDAP works. It's probably obvious, but I've never used it.

If my switch is expecting a username and password for login, how does it go from expecting a web login to "the LDAP server recognizes this person, and they have permissions to access network devices, so I'll let them in."?

Also, to be clear, I'm referring to the process of logging in and configuring the switch itself, not L2 switching or L3 routing.

[–] cm0002@lemmy.world 2 points 2 years ago* (last edited 2 years ago)

If the switch supports it, you login with local credentials first, navigate to its config page and configure LDAP under there. You'll tell it the IP address of the LDAP server as well as give it its client side configuration. You give it a bind account credentials (a dedicated service account with as minimal permissions as needed) that it uses to lookup the users on the server as well as Organization Unit paths and such

When a user goes to login the switch will query the provided credentials against the LDAP server, if it's valid the LDAP server will respond with a success and the switch will log the user in

Generally there is always a local account fallback in the event that the LDAP server is unavailable for whatever reason