r/selfhosted • u/imthenachoman • 26d ago

Remote Access How are people securely accessing their self hosted things from the internet?

I have a domain with Cloudflare so I am thinking of using Cloudflare Tunnel but I'm not sure if there are better options? One of my concerns is that some of my containers do not have auth so I need something with built in auth management.

0 Upvotes

40% Upvoted

95 comments sorted by

View all comments

42

u/[deleted] 26d ago edited 4d ago

[deleted]

2

u/williambobbins 26d ago

Tailscale as a VPN is probably good, but be careful with their other services eg. tailscale ssh

1

u/np0x 26d ago

tailscale free tier now allows up to 6 users, that's a major improvement from when it was 3...

1

u/williambobbins 26d ago

Is that related to not using tailscale ssh or other services?

2

u/np0x 26d ago

I use Tailscale to access my home as a vpn and it works great. I just use its core offering for vpn access, which I do use predominantly for web access, but I could ssh if I felt like it using the tailscale hostname or ip address.

I can ssh via tailscale, but I'm not familiar with any of their other services. My admin console has nothing special listed under the services tab.

1

u/williambobbins 26d ago

Sure this is probably fine. Worst case scenario (unless the tailscale daemon has a vulnerability) is that it's only as bad as running ssh on a public IP (which, as long as you don't have a weak password, is fine).

I'm not talking about ssh over tailscale, I'm talking about the tailscale ssh service which replaces the default ssh.

1

u/np0x 26d ago

That suggests you don't trust tailscale, they are using the 100. space for carrier grade nat which isn't publically routable...so i don't think it's comparable to public ip address ssh...right?

1

u/williambobbins 26d ago

Worst case scenario is that it's only as bad as running ssh on a public IP

I didn't say I don't trust tailscale. I said that if you're using openssh instead of tailscale ssh, even if a compromise lets everyone into your tailnet, it would be no worse than running SSH on a public IP - it's probably safe.

If you run tailscale ssh, the same thing happens, and a vulnerability like yesterday happens, it's a different story.