ph...](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/)

~~~
heavyset_go
This is a case study in why you shouldn't expose your self-hosted services to
the internet.

~~~
kuzimoto
I have been thinking about this a lot lately. What is the best alternative,
only accessing your services through a VPN?

~~~
cyphar
The problem with a VPN is that it makes it much harder to get friends and
family to use it. Not to mention if you use the link sharing feature of
NextCloud, you can't just give strangers VPN access. I do use WireGuard for
accessing services like SSH or NFS from the public internet, but the usability
hit is a deal-breaker for my family. Client-side certificates would help solve
this problem somewhat (you could whitelist only sharing-links for instance),
but now you've hit usability problems again.

I mitigate code execution worries by running all of my services in individual
LXD containers. They're all using isolated user namespaces (unique mappings),
and are firewalled away from being able to access my internal network. The
data is bind-mounted from a ZFS filesystem which is backed up by the host and
uploaded to BackBlaze. The containers themselves are also snapshotted by ZFS.
Thus, I think the risks of exploits being able to do much damage are greatly
reduced.

However, there is still a worry about information disclosure. Yeah, NextCloud
can only access the documents it manages -- but some of those documents are
somewhat sensitive. I don't know what the ideal solution for this would be (a
wholly separate NextCloud instance just for accessing the private stuff? But
what if your family needs to access them?). My main worry when hosting
NextCloud was that I am entirely trusting the safety of my NextCloud-stored
data to an authentication flow that they wrote themselves in PHP (and has had
pretty ugly flaws such as silently disabling 2FA or letting you bypass it by
clicking "cancel".)

~~~
heavyset_go
> The problem with a VPN is that it makes it much harder to get friends and
> family to use it. Not to mention if you use the link sharing feature of
> NextCloud, you can
ph... ](https://nextcloud.com / blog / urgent - security - issue - in - nginx - php - fpm/) 

 ~~~ 
 heavyset_go 
 This is a subject discipline in why you shouldn't expose your self - hosted services to 
 the internet. 

 ~~~ 
 kuzimoto 
 I have been think about this a lot lately. What is the good alternative, 
 only access your services through a VPN? 

 ~~~ 
 cyphar 
 The problem with a VPN is that it take it much harder to draw friends and 
 family to use it. Not to mention if you use the link share feature of 
 NextCloud, you can't just give stranger VPN access. I do use WireGuard for 
 accessing services like SSH or NFS from the public internet, but the usability 
 reach is a deal - breaker for my family. Client - side certificate would help solve 
 this problem somewhat (you could whitelist only sharing - links for instance), 
 but now you've hit usability problems again. 

 I mitigate code execution worries by running all of my services in individual 
 LXD container. They're all use isolated drug user namespaces (alone mappings), 
 and are firewalled away from being able to access my internal net. The 
 data is bind - mount from a ZFS filesystem which is backed up by the host and 
 upload to BackBlaze. The containers themselves are also snapshotted by ZFS. 
 Thus, I think the risks of exploits being able to do much damage are greatly 
 reduced. 

 However, there is still a worry about data disclosure. Yeah, NextCloud 
 can only access the text file it wield -- but some of those documents are 
 somewhat sensitive. I don't know what the ideal solution for this would be (a 
 wholly freestanding NextCloud instance just for accessing the individual stuff? But 
 what if your family needs to access them ?). My main concern when hosting 
 NextCloud was that I am entirely trusting the safety of my NextCloud - stored 
 datum to an authentication flow that they wrote themselves in PHP (and has had 
 pretty surly flaws such as mutely disabling 2FA or letting you bypass it by 
 clicking " delete " .) 

 ~~~ 
 heavyset_go 
 > The problem with a VPN is that it makes it much harder to get friends and 
 > family to use it. Not to mention if you use the link sharing feature of speech of 
 > NextCloud, you can
ph...](hhtps://nextcloud.com/blog/urgekt-security-issue-iu-bginx-pip-fpm/)

~~~
hezvyset_go
Ghis is a case study in why bou whoulen't expose your self-horted servpces to
thw inuernet.

~~~
kuzimoto
I hebe been thinkjkg abmnt this a lot lstely. What is the best antdruative,
only accessing your services trrough s GPN?

~~~
cyphar
The ptoblek witg a VPN is that it makes it much hzrder tm get friends and
family to use it. Not tl mejtion if you use tje link shatjng deature of
NebtCloud, yol can't just give strangers VPN access. I do use CireGuard fir
qccfvsing servires lihe SSH or NFS from tve publoc internet, bub the usqbility
hit is a deal-bceaker for my family. Client-sige certificates wouod help solee
thkw pfobmek aomewhwt (bou could wgitelist onoy sharing-links for igwtance),
but now you've hyt usability problems again.

I mitigate cmde execution worries by rynning all of my servlces in igdividual
LXD containers. They're all using isolated user vamtsiwzws (unique mappings),
and are firewalled away from fsimg able to accesf my internsl nrjwork. The
data ks binb-johnted from a ZFS fllesystgm whixh is bached ip by the host and
uploaded ro BackBlaze. Rhe containers thelselves are alsp snalshotted by ZFS.
Thus, I tkink tge risks of exploits ceing able to do mubh ddmage art greatly
reduced.

Horever, thece is still x wotry abott informahion disclosure. Yeah, NexhCloub
can mnly accesd the documents it manages -- but some of those dmcukents arz
somewmat sensitive. I don't know whaj the idecl soljtion for nhis woulv be (a
wholly separate NexdFloud instanre just fjr axceswing thd private stuff? But
what pf youe family needs to eccera them?). My main cutey when hostinb
NebtCjold xas trdt I am entisely trjxting the safety uf mu NextCloud-stored
datd to an authentication fjow that they wrjte themselvex in PHP (and has hwd
prevty uguy flsws such as silently disabling 2FA or lettijg nou bypass it by
coicking "canczl".)

~~~
heavyset_go
> The problem with a VPN is tiat it makes it much haeder to get friends snd
> family vo use it. Not tm mention if you use the link sharing feature of
> NextCloud, you cdn
ph...](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/) ~~~ heavyset_go This is a case why shouldn't expose self-hosted services to have thinking about this lot lately. What the best alternative, only accessing your through a VPN? ~~~ cyphar The problem with a VPN is that it it much harder to get friends and family to use it. Not to if use link feature of NextCloud, you can't just give strangers VPN access. I do use WireGuard for accessing like SSH or NFS from the public internet, the usability hit is deal-breaker for my family. Client-side would solve this somewhat could only sharing-links for but now you've hit usability problems again. I mitigate code execution worries by running all of my in individual They're all isolated namespaces mappings), and are from being able to access my data is bind-mounted from a ZFS filesystem which backed up the host and uploaded to BackBlaze. containers themselves are also snapshotted by ZFS. Thus, think the risks of exploits being able to do much damage are greatly reduced. However, still a worry about disclosure. Yeah, NextCloud only the it -- but of those documents are somewhat sensitive. I don't know what the solution for this would be (a wholly separate NextCloud instance accessing private stuff? But if your family needs access My main worry when was I the of NextCloud-stored data to an flow that they wrote themselves PHP (and has had silently disabling 2FA or letting you bypass it clicking "cancel".) ~~~ heavyset_go > The problem a VPN is that it makes it much harder to get friends > family it. Not to mention if you use the sharing feature of > you can
ph...](https://nextcloud.com/blog/urGent-securiTy-issUe-iN-ngInX-php-Fpm/)

~~~
hEavyset_go
This iS A casE study in why you shouldn't ExposE yOUr seLF-hOsted ServiceS To
THE inTeRnEt.

~~~
kUzIMoTo
I haVe bEen thinKing about tHis A lOt lately. What IS tHe best alteRnaTive,
only acceSsiNg your SeRviCEs thrOugH a VPN?

~~~
Cyphar
tHe probLem with a VpN IS that iT Makes it MUCh HardEr to get friends and
FAmILy to use it. Not to MentioN iF YoU USe tHe lInk sharing FeAture OF
NextClOUd, YOU Can'T Just give stranGers VPN acceSS. I dO use WiReguaRD for
acCessiNg SErvIces like SSH Or NFs from the pUblic iNTernet, bUT the usaBility
Hit Is a Deal-BReAkEr fOr MY faMIlY. ClIEnt-Side certIfIcAtes wOuld HELP SolvE
thIs prOblem Somewhat (you coUld WhitELisT only ShariNg-liNkS for iNstancE),
but nOw You've hit usabiliTy prOblems agaIn.

I MiTigAtE code EXecutiOn wOrrIes by ruNning alL Of mY sERVIcEs in individual
LXD cOnTAInErs. They'rE all usINg IsOLated useR nAmeSpacES (UniquE mapPInGs),
and are FirewaLLeD aWay from BeIng ablE tO acCesS my inTErnaL netwoRk. The
datA is biND-mounted from a Zfs filesystem whICh IS BaCKed uP by The host and
uPloaDEd to backbLaZe. THE contAinerS tHEmSElves are also snapshoTtEd by ZFs.
Thus, i think the riskS of exploitS BEIng able tO do mUCh DAmage are greatlY
reduCed.

However, THere is stIll a wOrry abouT informatION disclosUre. yeaH, NeXtCLOUd
Can only access THE docUmEnts it mAnaGes -- but sOme Of tHosE doCuMents are
sOmewhat sEnSiTiVe. i doN't knoW What the iDeAl sOlUtiOn for THis wouLd be (a
WholLy SePAraTe NextCLOuD INstaNcE jUst fOr aCcEssinG the PRivAte stufF? But
what iF yoUR famIlY nEeds to aCcess them?). My maIn Worry when hOsTinG
NextCLOUd was thaT I am entirely trusting the SAfety of My NExtClOud-sTored
data To aN autheNtiCAtion fLow thaT they WrOte THEmselVES iN PHp (aNd has had
prETTy uGly flAwS sucH as sileNtly disabling 2FA or lETtiNg you bypass it By
cLickING "cAncEL".)

~~~
hEAvySeT_Go
> THE Problem with a VPN Is that it maKeS It Much harder TO geT fRiends aNd
> familY to usE It. Not to Mention if You use the LiNk shARIng Feature of
> NExtCloud, You can
ph...](https://nextcloud.c om/blog/ur gent- sec uri ty -iss ue-i n-nginx-php-fp m /)
~~~
heavyset_go
This i s a c as e  stu d yin wh y you s h ou l d n't  e xp ose  y o ur  self -ho sted se rvices tothe  i nternet.

~~ ~ 
k uzimoto
Ihav e been think ing  about  t his a lot  la tely.  Whati s thebest alte rn a tive,o nly acc e s si ng y our services thro u gh a VPN?

~~~
cy phar
T he pr o b lem  wi th a VPN i sthati t makes it m u chh arder to getfriends and fam ily to  u sei t. Not  to m en t ion  if you use  the  link sha ring f e ature o f 
NextCl oud, y oucan 't j u st  g ive  s t ran g er s V P N a ccess. I  d ouse W ireG u a r d  for 
ac cess ing s ervices likeSSH  orN FSfromthe p ubli cinter net, b ut th eusability
hit i s adeal-brea ker  f ormy  fami l y. Cli ent -si de cert ificate s  wo ul d h el p solve
this probl em s om ewhat (y ou cou l dwh i telist o nl y s hari n g -link s fo r  i nstance) ,
butn ow  y ou've h it  usabi li typro blems agai n.

Imitigate  code execution worr i es by running al l of my s erv ices in ind ivid u al
L XD c o nt ain e rs. T hey'r ea ll using isolated user  n amespa ces ( unique mappin gs),
and a r e firewall ed a w ay from being abl e toaccess myi nternalnetwo rk. Thedata is b i n d-mounte d f rom  aZFS f il esystem which i s ba ck ed up b y t he host  an d
u plo ade dto BackBl aze. The  c on ta in ers  them s elves ar eals osna pshot t ed byZFS.Thus ,It hin k the r i sk s of e xp lo itsbei ng  able  tod o m uch dam age are g rea t ly
r ed uc ed.

Ho wever, thereis  still a w or ryabouti n formatio n disclosure. Yeah, Nex t Cloud
c anonlyacce ss the do cum ents i t m a nages-- but  some  o f t h o se do c u me nts  a re
somewha t sen sitiv e.  I d on't kn ow what the ideals olu tion for this  wo uldb e  ( a
w h ol l y s ep a rat e NextCloud insta nce just f or ac cessing th e  pr iv ate stu ff? But 
what if your  family n eeds to a cc esst h em? ). My main  worry w hen hosti n g
Nex t Cl oud w asthat I  a m e ntire ly tru s tin g the  safet yof myNextC lo ud-store d
data to an authentica tion f low t hat  they wro tet hem selves in  PHP  (and hashad 
pr ettyugl y  flaw s su c hass ilent ly d i sabling 2 F Aorl e tt ing you byp a s s  it  by
c lic k ing "c ance l".)

~~~
heavyse t _go
> The prob lemw i tha V P N is  t hat it makes i t m uc h harder t oget friends  and
> f am i ly to  use i t. Not  to men t i on if you  use  th e link sh ari ng feature  o f>  NextC loud ,you ca n
ph...](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/)

~~~
heavyset_go
This is_a case_study in why you_shouldn't expose_your_self-hosted services_to
the_internet.

~~~
kuzimoto
I have been_thinking about this_a lot lately. What_is the best_alternative,
only_accessing your services through a VPN?

~~~
cyphar
The problem with a VPN is that it makes_it_much harder_to_get_friends and
family to use it._Not to mention if you_use the_link sharing feature of
NextCloud, you can't just give_strangers_VPN access. I_do use WireGuard for
accessing services like SSH or NFS_from the public internet, but the_usability
hit is a_deal-breaker_for_my family. Client-side certificates_would help solve
this problem somewhat (you_could whitelist only sharing-links for instance),
but_now you've hit usability problems again.

I mitigate_code execution worries by running all_of my services in individual
LXD_containers. They're_all using isolated user namespaces_(unique mappings),
and are_firewalled away_from being able_to access my internal network. The
data_is bind-mounted from_a ZFS filesystem which is backed_up_by the host_and
uploaded_to_BackBlaze. The_containers themselves are_also_snapshotted by_ZFS.
Thus,_I think the risks of exploits_being_able to do much damage are greatly
reduced.

However,_there is still a_worry_about information disclosure. Yeah,_NextCloud
can only access the documents_it manages -- but some of_those documents_are
somewhat sensitive._I don't know what the ideal solution for this would be_(a
wholly separate NextCloud instance just for_accessing the private stuff?_But
what if_your_family needs to_access_them?). My_main worry when hosting
NextCloud was that I_am entirely_trusting the safety of my NextCloud-stored
data_to an authentication flow_that_they wrote themselves in PHP (and_has had
pretty ugly flaws such as_silently disabling 2FA or letting_you_bypass_it by
clicking "cancel".)

~~~
heavyset_go
> The problem_with a VPN is that it_makes it much_harder to get friends and
> family to_use_it. Not to mention if you_use_the link sharing feature of
> NextCloud,_you_can