If admin login is using weak credentials, it is by definition not a secure backend. Password/credential management and mandatory MFA are ALWAYS part of security due diligence for suppliers.

Except if it is awscli creds, then of course there is no MFA.

This has been a concern for me for a while, but it's possible to use aws cli with mfa by throwing an IdP in front of it.

The work flow we used was AWS Vault -> Okta -> short lived AWS creds.

What do you mean? Awscli supports key tokens from your 2fa device if your access keys are configured to require it

There are way to limit the scope of those. One set of credentials per environment for example. You can also limit the use of the these credentials by policy.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...

Exactly, no workflow for terraform or CLI if you have U2F (Yubikey) 2FA.

That's not true. You can use AWS SSO with the CLI/SDKs (therefore including stuff like Terraform) with webauthn.

It briefly pops you out to a browser to authenticate and caches a short lived token locally

If you use federated auth, then you can do whatever you want; 10 UDF keys and a video of a special dance if you so desire

There's AssumeRoleWithSAML so you can use any IdP

There's tools like aws-okta that can advantage of that to supply short lived credentials which require 2FA

You could also write a service that requires whatever authentication you want and returns the results of STS AssumeRole

I really want to like U2F, but it’s use cases seem so limited.

AWS STS solves this problem.

For their UniFi line, at least, you don't have to use their cloud controller. You can self-host.

Yep, I have my controller running on a Synology 720+ NAS that has zero ‘wide area network’ access. Everything is local to my home.

I am deeply saddened by Ubiquiti’s fall from grace... they were so good.

Can you go into more detail about your setup? I have 920+ and am in the market for a new router (controller? Still learning the terminology).

The cloud controller is a (surprisingly heavyweight) service that manages a network of unifi devices. It can run on a raspberry pi, or an x86 container / vm.

If I wanted to run it all the time, I’d try putting it in a docker container on my synology.

Instead, I have an sd card for my raspberry pi that has nothing but the controller installed. The main downsides to this are that it is easy to lose the sd card, and that the controller gathers bandwidth/usage/wifi connection reliability stats, but only when it is running. I don’t get those unless I boot up the RPi to diagnose some network issue (this has never been an issue in practice).

One advantage of the RPi setup over a synology container is that it has both a ethernet jack and a wifi adaptor. This is surprisingly helpful when bootstrapping complicated mesh topologies.

Yep, I put it in a Docker container on the Synology. Fairly straight forward. I followed a guide like this:

https://lazyadmin.nl/home-network/unifi-controller-on-a-syno...

I have a UDMpro which self-hosts a controller, thou personally if i knew it couldn't be joined to another controller i'd have gotten something else so i could throw it in docker (which runs on a NUC with the storage off a synology)

Yes. I run the controller on a raspberry pi 4. Local only.

I too am disappointed in UniFi’s direction.

I used to recommend them. I don’t now.

What do you use/recommend now?

Gosh. I wish I knew. This thread is rife with alternatives, so other's guess is as good as mine. The unifi wifis I have running are still good and work extremely well. So my suggestion is to keep using them, but only if you host the controller software on your own hardware (I'm using RPi 4 as stated) and only if you avoid their cloud solution(s). (This IMO).

I am still looking for alternatives when the time comes to replace mine. Which I'll be forced to replace once/if they completely nerf the self hosted on self hardware options.

Is that true on the UDM-Pro?

I couldn’t see an option on setup.

I might try block it from internet and see what happens.

Yes, this is true. You can access the Unifi controller on the local internal IP.

This is what I do. I host a controller in AWS on an EC2 instance in my account. It works great.

Out of interest, why wouldn't you host it on something like a raspberry pi?

Having your local network depend on an external network makes my old school sysadmin bones tingle for some reason.

The Ubiquiti controller is not needed for general operation, unless you're using a guest hotspot. Otherwise if it's offline you just lose ability to do configuration and it's data/stats logging.

It's also needed if you want to have any control over SSID's such as enabling/disabling on a schedule, bandwidth limiting and so on.

Hah, that's a dream world where enabling/disabling SSID's ever worked properly.

They have a good UI, good hardware but the software seems half baked.

Originally with the switch to the "new settings", the schedules were switched between the AP's and the UDM, not sure about a dedicated cloud controller.

Great product, poor QA I think.

Laziness? I can just set it up with a couple of clicks and pay almost nothing (it runs on a t2).

Still lots of pitfalls with just MFA. Text/email being the worst and TOTP being somewhat better but not great. A lot of password vaults support storing the TOTP secret so they can generate time based codes which seems reasonable when the vault is 2-3 factor protected (some do IP heuristics, passwords, tokens, PINs, etc). Unfortunately if someone gets access to the vault in it's unencrypted state you're in for a world of hurt.

From a couple years back, https://arstechnica.com/information-technology/2016/04/how-h... (the hackers got remote access to a sysadmins desktop then waited til he mounted TrueCrypt and stole the entire contents)

Even with hardware tokens, if someone gets access to your machine while you're using it they can wait til you authenticate then use the creds proxying requests through your machine so they look legit

> their screw-up was not doing MFA

So you're saying it was both not trustworthy and not adequately secured?

I never onboard anybody without MFA. Turning it off is a firing offense.

I run a local controller with no remote access for unifi - i would never use any networking hardware that needed a cloud controller/connection for breaches exactly like this.

> their screw-up was not doing MFA on their admin accounts

MFA is not a silver bullet. You can still login with stolen cookies and 'replay' the session without signing in.

Same here. I don’t need remote access to manage my network. I work from home and spend a majority of my time there.