this post was submitted on 08 Aug 2024

503 points (99.0% liked)

Selfhosted

selfhosted@lemmy.world

61,126 readers

6,559 active

472 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

moderators

ruud@lemmy.world

Loki@lemmy.world

CannaVet@lemmy.world

devve@lemmy.world

ayyy@sh.itjust.works

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

ICANN approves use of .internal domain for your network (www.theregister.com)

submitted 2 years ago by thehatfox@lemmy.world to c/selfhosted@lemmy.world

147 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] solrize@lemmy.world 49 points 2 years ago (9 children)

Browsers barf at non https now. What are we supposed to do about certificates?

hideshow 18 child comments

[–] lemmyvore@feddit.nl 27 points 2 years ago (1 child)

If you mean properly signed certificates (as opposed to self-signed) you'll need a domain name, and you'll need your LAN DNS server to resolve a made-up subdomain like lan.domain.com. With that you can get a wildcard Let's Encrypt certificate for *.lan.domain.com and all your https://whatever.lan.domain.com URLs will work normally in any browser (for as long as you're on the LAN).

parent

hideshow 2 child comments

[–] solrize@lemmy.world 24 points 2 years ago (4 children)

Right, main point of my comment is that .internal is harder to use that it immediately sounds. I don't even know how to install a new CA root into Android Firefox. Maybe there is a way to do it, but it is pretty limited compared to the desktop version.

parent

hideshow 8 child comments

[–] cereals@lemmy.ml 8 points 2 years ago

You can't install a root CA in Firefox for android.

You have to install the cert in android and set Firefox to use the android truststore.

You have to go in Firefox settings>about Firefox and tap the Firefox logo for a few times. You then have a hidden menu where you can set Firefox to not use its internal trust store.

You then have to live with a permanent warning in androids quick setting that your traffic might be captured because of the root ca you installed.

It does work, but it sucks.

parent

[–] lemmyvore@feddit.nl 6 points 2 years ago

This is not a new problem, .internal is just a new gimmick but people have been using .lan and whatnot for ages.

Certificates are a web-specific problem but there's more to intranets than HTTPS. All devices on my network get a .lan name but not all of them run a web app.

parent

[–] Petter1@lemm.ee 1 point 2 years ago (1 child)

You do not have to install a root CA if you use let’s encrypt, their root certificate is trusted by any system and your requested wildcard Certificate is trusted via chain of trust

parent

hideshow 2 child comments

[–] solrize@lemmy.world 12 points 2 years ago

That's if you have a regular domain instead of.internal unless I'm mixing something. Topic of thread is .internal as if it were something new. Using a regular domain and public CA has always been possible.

parent

[+] lud@lemm.ee 0 points 2 years ago* (last edited 1 year ago) (1 child)

[deleted]

parent

hideshow 2 child comments

[–] fine_sandy_bottom@lemmy.federate.cc 1 point 2 years ago (1 child)

No one is saying it is their job.

Merely that using a TLD like .internal requires some consideration regarding ssl certificates.

parent

hideshow 2 child comments

[+] lud@lemm.ee -1 points 2 years ago* (last edited 1 year ago) (2 children)

[deleted]

parent

hideshow 4 child comments

[–] fine_sandy_bottom@lemmy.federate.cc 2 points 2 years ago

Because people can discuss whatever they like?

If you don't like it just down vote it.

parent

[–] JackbyDev@programming.dev 1 point 2 years ago

People can talk about whatever they want whenever they want. The discussion naturally went to the challenges of getting non-self-signed certificates for this new TLD. That's all.

parent

[–] BlueBockser@programming.dev 21 points 2 years ago

Nothing, this is not about that.

This change gives you the guarantee that .internal domains will never be registered officially, so you can use them without the risk of your stuff breaking should ICANN ever decide to make whatever TLD you're using an official TLD.

That scenario has happened in the past, for example for users of FR!TZBox routers which use fritz.box. .box became available for purchase and someone bought fritz.box, which broke browser UIs. This could've even been used maliciously, but thankfully it wasn't.

parent

[–] egonallanon@lemm.ee 14 points 2 years ago

Either ignore like I do or add a self signed cert to trusted root and use that for your services. Will work fine unless you're letting external folks access your self hosted stuff.

parent

[+] winterschon@mastodon.bsd.cafe 11 points 2 years ago (2 children)

[deleted]

parent

hideshow 4 child comments

[–] JackbyDev@programming.dev 3 points 2 years ago (1 child)

How do you propose to get LetsEncrypt to offer you a certificate for a domain name you do not and cannot control?

parent

hideshow 2 child comments

[–] winterschon@mastodon.bsd.cafe -3 points 2 years ago (1 child)

@JackbyDev Why would that be a question at all? Buy a domain name and take care of your dns records.

that's an odd way to say that you don't own any domains. that's step one, but does it even need to be said?

parent

hideshow 2 child comments

[–] JackbyDev@programming.dev 4 points 2 years ago

You cannot buy .internal domains. That's my point.

parent

[–] Findmysec@infosec.pub 3 points 2 years ago* (last edited 2 years ago)

Private CA is the only way for domains which cannot be resolved on the Internet

parent

[–] rushaction@programming.dev 10 points 2 years ago (2 children)

Quite literally my first thought. Great, but I can't issue certs against that.

One of the major reasons I have a domain name is so that I can issue certs that just work against any and all devices. For resources on my network. Home or work, some thing.

To folks recommending a private CA, that's a quick way to some serious frustration. For some arguably good reasons. On some devices I could easily add a CA to, others are annoying or downright bullshit, and yet others are pretty much impossible. Then that last set that's the most persnickety, guests, where it'd be downright rude!

Being able to issue public certs is easily is great! I don't use .local much because if it's worth naming, it's worth securing.

parent

hideshow 4 child comments

[–] JackbyDev@programming.dev 2 points 2 years ago (1 child)

My Asus router is actually able to get a certificate and use DDNS which is really interesting.

parent

hideshow 2 child comments

[–] ayyy@sh.itjust.works 0 points 2 years ago (1 child)

Makes ya wonder what else it’s doing that for…

parent

hideshow 2 child comments

[–] JackbyDev@programming.dev 3 points 2 years ago

So you can access your router's config page without blasting your password in plaintext or getting certificate warnings. It's an optional feature.

parent

[–] Railing5132@lemmy.world 1 point 2 years ago

Same thing we do with .local - "click here to proceed (unsafe)" :D

Set up my work's network waay back on NT4. 0 as .local cuz I was learning and didn't know any better, has been that way ever since.

parent

[–] exu@feditown.com 6 points 2 years ago (2 children)

You can set up your own CA, sign certs and distribute the root to every one of your devices if you really wanted to.

parent

hideshow 4 child comments

[–] solrize@lemmy.world 24 points 2 years ago

Yeah I know about that, I've done it. It's just a PITA to do it even slightly carefully.

parent

[+] BestBouclettes@jlai.lu -9 points 2 years ago (3 children)

That sounds like a bad idea, you would need your CA and your root certs to be completely air gapped for it to be even remotely safe.

parent

hideshow 6 child comments

[–] vzq@lemmy.blahaj.zone 10 points 2 years ago (1 child)

Why?

That’s a rather absolutist claim when you don’t know the orgs threat model.

parent

hideshow 2 child comments

[–] BestBouclettes@jlai.lu -3 points 2 years ago (2 children)

For self hosting at least, having your own CA is a pain in the ass to make sure everything is safe and that nobody except you has access to your CA root key.
I'm not saying it's not doable, but it's definitely a lot of work and potentially a big security risk if you're not 100% certain of what you're doing.

parent

hideshow 4 child comments

[–] atzanteol@sh.itjust.works 8 points 2 years ago

No worse than protecting your ssh key. Just keep it somewhere safe.

parent

[–] Petter1@lemm.ee 1 point 2 years ago (1 child)

Just use only VPN to access your services behind the reverse proxy, if you want prevent unauthorised connections.

CA certificates are not here to prevent someone accessing a site, they are here, so that you can be sure, that the server you are talking to is really the one belonging to the domain you entered and to establish a tunnel in order to send the API calls (html, css, javascript etc.) and answers encrypted.

parent

hideshow 2 child comments

[–] BestBouclettes@jlai.lu 1 point 2 years ago (1 child)

That's the problem, if anyone somehow gets your root CA key, your encryption is pretty much gone and they can sign whatever they want with your CA.
It's a lot of work to make sure it's safe in a home setup.

parent

hideshow 2 child comments

[–] prime_number_314159@lemmy.world 6 points 2 years ago (1 child)

You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.

parent

hideshow 2 child comments

[–] Petter1@lemm.ee 2 points 2 years ago

And additionally, you can sign intermediate Certificates reducing the risk even more, since you can revoke and re-issue new ones any time.

parent

[–] r00ty@kbin.life 3 points 2 years ago (2 children)

What if I told you, businesses routinely do this to their own machines in order to make a deliberate MitM attack to log what their employees do?

In this case, it'd be a really targetted attack to break into their locally hosted server, to steal the CA key, and also install a forced VPN/reroute in order to service up MitM attacks or similar. And to what end? Maybe if you're a billionaire, I'd suggest not doing this. Otherwise, I'd wonder why you'd (as in the average user) be the target of someone that would need to spend a lot of time and money doing the reconnaissance needed to break in to do anything bad.

parent

hideshow 4 child comments

[–] Findmysec@infosec.pub 2 points 2 years ago* (1 child)

Ah, you mean they put the cert in a transparent proxy which logs all traffic? Neat idea, I should try it at home

parent

hideshow 2 child comments

[–] r00ty@kbin.life 1 point 2 years ago

They (the service that provides both web protection and logging) installs their own root certificate. Then creates certs for sites on demand, and it will route web traffic through their own proxy, yes.

It's why I don't do anything personal at all on the work laptop. I know they have logs of everything everyone does.

parent

[–] BestBouclettes@jlai.lu 0 points 2 years ago (1 child)

I'm talking about home hosting and private keys. Not businesses with people whose full time job is to make sure everything runs fine.
I'm a nobody and I regularly have people/bots testing my router. I'm not monitoring my whole setup yet and if someone gets in I would probably not notice until it's too late.
So hosting my own CA is a hassle and a security risk I'm not willing to put work into.

parent

hideshow 2 child comments

[–] Findmysec@infosec.pub 1 point 2 years ago

Yeah that's your situation. Some people are fine with it

parent

[–] lemmyvore@feddit.nl 1 point 2 years ago (1 child)

As opposed to what, the domain certificate? Which can't be air-gapped because it needs to be used by services and reverse proxies.

parent

hideshow 2 child comments

[–] BestBouclettes@jlai.lu 1 point 2 years ago

The domain certificate is public and its key is private? That's basically it, if anyone gets access to your key, they can sign with your name and generate certificates without your knowledge. That's my opinion and the main reason why I wouldn't have a self hosted CA, maybe I'm wrong or misled, but it's a lot of work to ensure everything is safe, only for a self hosted setup.

parent

[–] state_electrician@discuss.tchncs.de 4 points 2 years ago (1 child)

I found options like .local and now .internal way too long for my private stuff. So I managed to get a two-letter domain from some obscure TLD and with Cloudflare as DNS I can use Caddy to get Let's Encrypt certs for hosts that resolve to 10.0.0.0/8 IPs. Caddy has plugins for other DNS providers, if you don't want to go with Cloudflare.

parent

hideshow 2 child comments

[–] kudos@lemmy.ml 3 points 2 years ago (1 child)

Might be an idea to not use any public A records and just use it for cert issuance, and Stick with private resolvers for private use.

parent

hideshow 2 child comments

[–] state_electrician@discuss.tchncs.de 3 points 2 years ago (1 child)

It's a domain with hosts that all resolve to private IP addresses. I don't care if someone manages to see hosts like vaultwarden, cloud, docs or photos through enumeration if they all resolve to 10.0.0.0/8 addresses. Setting up a private resolver and private PKI is just too much of a bother.

parent

hideshow 2 child comments

[–] fine_sandy_bottom@lemmy.federate.cc 1 point 2 years ago

My set up is similar to this but I'm using wildcards.

So all my containers are on 10.0.0.0/8, and public dns server resolves *.sub.domain.com to 10.0.0.2, which is a reverse proxy for the containers.

parent

[–] possiblylinux127@lemmy.zip 3 points 2 years ago

Accept them

parent

[–] wolo@lemmy.blahaj.zone 3 points 2 years ago* (1 child)

Maybe browsers could be configured to automatically accept the first certificate they see for a given .internal domain, and then raise a warning if it ever changes, probably with a special banner to teach the user what an .internal name means the first time they see one

parent

hideshow 2 child comments

[–] ayyy@sh.itjust.works 1 point 2 years ago

The main reason this will never happen is that the browser vendors make massive revenue and profit margins off of The Cloud and would really prefer that the core concept of a LAN just dies so you pay your rent to them.

parent