Question about port and security on Unraid

[xav_hs]

Hello Unraid Community!

 

From what I understand, having any port open is dangerous, but I currently have port 443 port forward to 1443 for my nextcloud server.

Although my nextcloud accounts are secured with a very strong password, how big of a security risk is this and is there a better way to do this? 
 

I ask this as I have recently noticed “LAN access from remote” on my wifi logs which reference the port 1443 and I don’t recall the ip’s (image attached).

Am I doing something stupid here that I don’t properly understand?

 

I mostly followed space invaders tutorial for this but with a few steps missing related to duck dns from what I remember but I did get it all working.

 

Edited March 2, 2023 by xav_hs
Image edit

[itimpi]

The simple way to express it that the security on a port is as good as that of the application handling that port.   Therefore in your case that is the security capabilities of NextCloud.  Also, since you are presumably running NextCloud in a docker container then when setting up the volume mapping for the NextCloud container you should not give it any access to more of the Unraid server's filestore than it needs to operate correctly.

[xav_hs]

Thats a great way of explaining it, thanks @itimpi.

 

Would you say the logs in my screenshot seem concerning and should anything be done about it in your opinion?

[itimpi]

52 minutes ago, xav_hs said:

Would you say the logs in my screenshot seem concerning and should anything be done about it in your opinion?

Cannot really say as the screenshot is cut off at the left

 

However the moment you open a post to the internet expect to see attacks being automatically mounted against that port (within minutes typically) so in that sense it depends on the NextCloud to be defending against them.   You can probably get better protection if you enforce the use of SSL or a VPN but not sure how that would work in conjunction with NextCloud.

[xav_hs]

Good to know, thank you for your help!

incase this image helps for the cut off part, here it is:

[itimpi]

oK.  Was not obvious from your first screenshot but it just looks as if you have told the router to log everything it can around possible intrusion attempts.