random credentials + password manager

hunter2

Everything gets a different, long random password. It’s not a hassle because my password manager handles everything. It’s bitwarden for whatever I may need to access elsewhere, few admin logins there, keepass everything else.

Nice try FBI 😏😁

All my local services follow the same rules as any other service. I have no idea what the passwords are, they are all random and long as fuck in my password manager. 2FA with a hardware key where allowed, TOTP if not.

What possible reason would anyone have to “relax” or security on local services? That would mean having 2 streamlines which only adds friction.

I strongly suggest you move all your credentials out of your browsers and into a password manager.

Apps: SSO via Authentik where I can, unique user/pass combo via Bitwarden where I can’t (or, more realistically, don’t want to).

General infra: Unique RSA keys, sometimes Ed25519

Core infra: Yubikey

This is overkill for most, but I’m a systems engineer with a homelab, so it works well for me.

If you’re wanting to practice good security hygiene, the bare minimum would be using unique cred pairs (or at least unique passwords) per app/service, auto-filled via a proper password manager with a browser extension (like KeePassXC or Bitwarden).

Edit: On the network side, if your goal is to just do some basic internal self-hosting, there’s nothing wrong with keeping your topo mostly flat (with the exception of a separate VLAN for IoT, if applicable). Outside of that, making good use of firewalls will help you keep things pretty tight. The networking rabbit hole is a deep one, not always worth the dive unless you’re truly wanting to learn for the sake of a cert/job/etc.

SSO

deleted by creator

Personally keep it very simple using same username and password for my services. But I also don’t host anything of value, just messing around with a few different projects I come across. Yes it’s not good practice, but nothing is exposed works well for me.

Unify them.

• I use a container that runs an AD in Samba4: https://nowsci.com/samba-domain
• LDAP from that is used for services like Nexcloud, etc.
• I then run Keycloak to add OIDC to the AD: https://www.keycloak.org/
• This is for other services like Outline that only support Oauth/OIDC
• And lastly, I use Oauth2-proxy to support everything else by adding OIDC to my nginx proxy: https://oauth2-proxy.github.io/oauth2-proxy/
• This supports systems like SearNGX with no native login that I want to limit to my users.

Now I have a full FOSS Active Directory for SSO logging into computers and services that supports 2FA where desired.

Since I’m already using Bitwarden, generating and storing passwords is easy. I use my name as the username, though that user doesn’t have admin privileges.

Same way I do at work. Different accounts and passwords for each service internally. Any service exposed to the net (game and email servers mostly) is on a segregated network and each machine has unique credentials to help prevent lateral movement. Self hosted Bitwarden tracks it all.

I do it for the same reason I require outbound firewall rules for almost everything on my home network - I’m a masochist.

Like several people here, I’ve also been interested in setting up an SSO solution for my home network, but I’m struggling to understand how it would actually work.

Lets say I set up an LDAP server. I log into my PC, and now my PC “knows” my identity from the LDAP server. Then I navigate to the web UI for one of my network switches. How does SSO work in this case? The way I see it, there are two possible solutions.

• The switch has some built-in authentication mechanism that can authenticate with the LDAP server or something like Keycloak. I don’t see how this would work as it relies upon every single device on the network supporting a particular authentication mechanism.
• I log into and authenticate with an HTTP forwarding server that then supplies the username/password to the switch. This seems clunky but could be reasonably secure as long as the username/password is sufficiently complex.

I generally understand how SSO works within a curated ecosystem like a Windows-based corporate network that uses primarily Microsoft software for everything. I have various Linux systems, Windows, a bunch of random software that needs authentication, and probably 10 different brands of networking equipment. What’s the solution here?

My goal is to have all my services being a reverse proxy, even on LAN, and use passwordless authentication via passkeys/webauthn. I haven’t yet tried it but have been eyeing this: https://github.com/stonith404/pocket-id?ref=selfh.st

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

[Thread #927 for this sub, first seen 20th Aug 2024, 14:45] [FAQ] [Full list] [Contact] [Source code]