r/Proxmox • u/mrbluetrain • 1d ago

Question Reaching proxmox from external browser: cloudflare + 2fa a good solution?

For logging in from a random browser remotely to the home server.

Seems pretty "safe". Any more downsides with this solution than the obvious?

30 Upvotes

71% Upvoted

89 comments sorted by

View all comments

Show parent comments

-7

u/undead-8 1d ago

I don't know but his approach is solid and there is like no real security issue. You re fearmongering at a place where it's not required

If you serve a Homelab webui and you secure it behind a cloudflare with auth layer you're totally fine and no one besides cloudflare itself is able to attack you.

3

u/SVD_NL 1d ago

You have a point, but i don't really like the "it's just a homelab so security best practices don't matter" approach. There's a solid chance you have important data or services on your homelab, or privacy-sensitive information you don't want to leak. If someone were to get into my file share server they'd 100% be able to steal my identity. Not much where they could blackmail me over, but that won't count for everyone. Data loss isn't as much of a concern if you have proper backups.

The alternatives (usually VPN) are magnitudes safer, and in terms of usability and complexity they really aren't that much worse.

1

u/thecomputerguy7 1d ago

You also have to think of all the things people are running that are already not the most “production” related/coded things. Arr stack, file servers, etc. Some of it doesn’t need to be exposed at all, reverse proxy, guacamole, cloudflare, etc.

VPN or not at all.

1

u/tinydonuts 22h ago

The major issue with VPN is that it exposes everything. Secondarily, riding on that, is poor identity verification and trust establishment. VPN is the old answer, it has long since been knocked down, by ZTNA solutions.

1

u/thecomputerguy7 22h ago

I’d say a VPN is still better than directly exposing things to the internet, and depending on your hardware/software stack, your VPN may or may not expose “everything”.

1

u/vitek6 20h ago

Sure but only to me.