Hi guys I was wondering if there is a streamlined way to disable remote acess to a selfhosted service (say at a reverse proxy level) if a published security vunerability is present.

I know, ideally you want to keep all your selfhosted services up to date. However on certain selfhosted service auto updates may not be viable (due to major changes between updates) and you being unavailable 24/7 to respond to vunerabilities.

Curious on your thoughts and suggestions. So far the only middle ground I can find is realying on a vpn wireguard, tailscale, etc.

Page regarding homeassistant remote ui autodisable: https://www.nabucasa.com/config/remote/

  • RegalPotoo@lemmy.worldEnglish
    16·
    6 months ago

    If you figure it out, I know several companies that would be more than willing to drop 7 figures a year to license the tech from you

  • Vendetta9076@sh.itjust.worksEnglish
    61·
    6 months ago

    Thats a really neat idea but I’m not sure its practical. Definitely putting everything you can behind a VPN is the best bet. Only things I dont have behind VPN/local only are things my extended family use and are on a different vlan.

  • MonkderDritte@feddit.deEnglish
    51·
    6 months ago

    I can’t help here, but:

    The title would be less confusing if you didn’t cram everything in one sentence. Potential help might be driven off by this, i was almost too.

  • Decronym@lemmy.decronym.xyzBEnglish
    1·
    6 months ago

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

    Fewer Letters More Letters
    HTTP Hypertext Transfer Protocol, the Web
    VPN Virtual Private Network
    nginx Popular HTTP server

    [Thread #762 for this sub, first seen 27th May 2024, 00:15] [FAQ] [Full list] [Contact] [Source code]

  • tuxec@infosec.pubEnglish
    1·
    6 months ago

    The first thing that comes to mind is a combination between SBOMs generated for your self-hosted services (trivy, syfy, etc) which are pushed to OWASP Dependency-Track and whenever some vulnebrabilies are detected (note: you’ll get lot of notifications if the application is using a lot of libraries), trigger an event (not sure if node red can help here) which would run a script to disabled the vhost. (just a thought. I haven’t seen an actual solution)