You might also consider an IP whitelist. The firewall is still probably the best place to stop any unwanted connection attempt. Also gives you good protection against zero days. Have a central location for what IPs are allowed to connect (like aws s3) and the server downloading it every 5min, and applying it to the firewall if it changed.
Re:Apache Guacamole
by buybackoff on Sunday December 05, 2021 @05:10AM
(#29448124)
In most cases I use it via my smartphone with dynamic IPv6. A whitelist fir a train trip is impossible.
But don't you keep the same IP as you roam by train? All you need is a way to whitelist your new IP easily (I created a website that has just a button for that), and wait less than 5 minutes that the server picks up the new list.
Re:Apache Guacamole
by buybackoff on Sunday December 05, 2021 @05:28AM
(#29448205)
I've just checked before replying above, IP changes on every reconnect while being in the same room. It would be really bad usability with a whitelist. In my setup only 2FA cannot be saved in a browser, and login session is valid for a long time, so I do not have to re-login on every reconnect.
There is an IP ban / fail2ban app for windows and RDP, nice extra layer.
For a lot of my stuff, the devices domain is only resolvable on my Wireguard’s dns and access allowed only from Wireguard’s subtnet.
Re:Apache Guacamole
by buybackoff on Saturday December 04, 2021 @05:10PM
(#29444751)
I wanted to avoid VPN both for my main working/dev machine and clients. What if VPN does not go up after hard reboot due to some weird loading order while I'm not logged in (e.g. electricity failure)? Both that machine and Guacamole/NGINX host are configured to autostart after powering off. This is the first thing I tested. For clients, I do not want to have VPN on each of them. And what if I need to use a random machine? Multi-layer opaque https endpoint seems safe enough.
Fair point, I have a pi 4 running pihole and wireguard so starts up and runs everything on power.
Also boot disk is on zfs so scrubs each week incase of microsd corruption.
The Wireguard in Docker automatically generates new client configs from ENVS.
I'm about to leave a system running on a pi 4 for a few months. Any details on your advice? Based on cursory googling [1] your setup looks non-trivial>
It was actually pretty easy, I’ve used these guides for zfs on most of my Linux infra.
https://openzfs.github.io/openzfs-docs/Getting%20Started/Ubu...
RDP is still much better user experience, so once when I needed a longer session I used Guacamole to access my router admin interface and temporarily expose RDP directly via a random port and a very strong password. I'm still not convinced that the latter combination is not enough, but it's better to be safe than sorry.