Warning: Unraid Servers exposed to the Internet are being hacked


Recommended Posts

Securing a tunnelwithe openvpn or wireguard is nice, but a unsecured door is still an unsecure door...

 

There is a spof in every home, your isp router. Usually, for economic reason, this box are low grade quality, sometimes without firewall or even set with an admin/admin like password never change by the users and can be ( not so easy but feasible ) access through wifi ( as for my neighbours , both of them, with 2 different isp )

 

When done, their network are simply open.

 

At that time, forget your nicely done tunnel.

 

Adding one more security layer like a F2A/fido validation for the sign-in is not so stupid.

 

 

 

 

  • Like 1
Link to comment
  • 3 weeks later...

Thanks for the sharing on security. I often need to access unRaid GUI while I'm out on a trip. I used to use OpenVPN to connect to home and access the management gui from LAN.

 

Now with 6.9.2 I have the port forwarding setup for HTTPS to unRaid and it's the only port I am exposing on the internet. A strong root password has been set and all other services are behind my firewall.

 

So now my question is: Is it equally safe to access my server this way compare to accessing through OpenVPN?

Link to comment
20 minutes ago, aarontry said:

Is it equally safe to access my server this way compare to accessing through OpenVPN?

No, it trades security for convenience. A properly configured VPN means only encryption key configured and credentialed endpoints can gain access instead of only requiring a browser and password.

 

However, in the context of this thread, it seems to be secure enough for the moment, as the hacked servers invariably seemed to have blank root passwords.

Link to comment
1 minute ago, jonathanm said:

No, it trades security for convenience. A properly configured VPN means only encryption key configured and credentialed endpoints can gain access instead of only requiring a browser and password.

 

However, in the context of this thread, it seems to be secure enough for the moment, as the hacked servers invariably seemed to have blank root passwords.

The only vulnerability I can think of regarding the security of unRaid Server in this context is there might be undiscovered security issues that allow attackers to bypass the form based login and gain access to other services.  

Link to comment
10 hours ago, aarontry said:

I often need to access unRaid GUI while I'm out on a trip.

Very easy to do this, just setup WireGuard. I can access my whole LAN that way. WireGuard is builtin to Unraid.

 

Then, you will have the situation where

10 hours ago, jonathanm said:

only encryption key configured and credentialed endpoints can gain access

 

Link to comment
17 hours ago, trurl said:

Very easy to do this, just setup WireGuard. I can access my whole LAN that way. WireGuard is builtin to Unraid.

 

Then, you will have the situation where

 

What's the purpose of the new plugin (unraid.net) if VPN is the preferred way of accessing unRaid? I already have the VPN setup and I am considering switching to the plugin instead. 

Link to comment
1 hour ago, aarontry said:

What's the purpose of the new plugin (unraid.net) if VPN is the preferred way of accessing unRaid? I already have the VPN setup and I am considering switching to the plugin instead. 

 

The remote access feature of the plugin may not be quite as secure as using a VPN but it is much easier (and thus less error prone) for the naïve user to set up.   The plugin does, however, have other features that you can use even if you do not intend to use the remote access feature.

Link to comment
On 4/17/2021 at 9:16 AM, tech_rkn said:

I saw the F2A for the forum. Nice.

How about F2A for unRAID himself ?

I am using my yubikey on almost every accounts/services I have, except my own unRAID...

 

 

+1 to this. TOTP 2FA code implementation would be a welcome feature addition. 

  • Like 2
Link to comment
  • 3 months later...

As far as I know, a DMZ is actually not meant to be a forward to all thing, but it just happens to be implemented that way on cheap routers that you'd get from an ISP.  So the advise is sound for that segment.  If however you had a proper firewall, like Opnsense/PFSense and many others, putting something in the DMZ doesn't automatically forward all ports there.  It's just meant to be a place which protects your internal network from the private by having the private limit where it connects and the same of the public.  These days, networks are so complicated the branding of a DMZ I assume has mostly gone out the window, but the concept continues to be used and these cheap routers keep it as a free for all to get things going when people don't fully understand what they're doing.  That's my 2c anyway - just wanted to throw a bit of education along with the 'don't do

 statement.

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.