this post was submitted on 18 Oct 2023
1 points (100.0% liked)
Self-Hosted Main
515 readers
1 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
For Example
- Service: Dropbox - Alternative: Nextcloud
- Service: Google Reader - Alternative: Tiny Tiny RSS
- Service: Blogger - Alternative: WordPress
We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.
Useful Lists
- Awesome-Selfhosted List of Software
- Awesome-Sysadmin List of Software
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Depending on how sensitive your docs are, you could configure the server to only be usable when accessed via a VPN connection.
I’m not asking from a knowledgeable position, so bear with me if it’s a dumb question: Why don’t people use client certificates for this and restrict access to only clients with the certificate? It seems about as a VPN, and also is revocable, and a time expiry can be put on (I suppose that’s the case with VPNs too). They seem like rather similar solutions but I only see VPNs suggested
The difference is that the client certificates are usually implemented as part of the web server. If there is a issue with either configuration, or bug in the web server, you potentially immediately can bypass the certificate requirement. On the other hand a VPN is often a completely separate piece of software, that is operating at the network layer.
Another thing. If you run a simple port scan against the Internet it is easy to find http/https servers. Some VPN protocols that have been strongly configured will be more or less invisible to any kind of port scans. This eliminates a lot of the scanning and probing get for basically thing that is visible on the Internet.
Not saying client certs don't have their place. Just not sure I would choose them, when I think a VPN provides stronger protection, and is potentially pretty easy to implement for a selfhosted environment.
What I meant, and perhaps I have a misunderstanding, is that I was under the impression that SSL could be configured such that it behaves in the way that's widely known - either a website is "trusted" because an authority has verified that the true owner owns it within a certain period of time - but also as second method more akin to SSH keys, wherein the server has one certificate, the client has a signed cert, and you can only access the server if you're in possession of a signed certificate on the device being used to access the site. This digicert description matches mine, so I don't think I'm too far off but I'm missing something
Yes, I understand what you mean, and you don't seem to be misunderstanding how TLS client certificates function.
But my point was, that usually it is web server is that accepts and validates the client certificate. A web server is externally visible, and so it is potentially something that can be attacked even if the attacker doesn't have a valid client certificate.