Camera Uploading to Unraid Server Securely

[Jlarimore]

Let me explain my setup: My family has a cabin in Colorado. It is in a very remote location and is prone to bear breakins, floods, fires, etc. We need to surveil the place to make ensure it's still standing and not burning through propane due to broken windows/doors etc. We recently got internet access at the cabin and installed a Reolink camera. I have an Unraid server at my place in California. I would love to have the camera FTP its footage to my Unraid server where it can be assessed and easily distributed to all the interested parties.

 

I keep reading that exposing Unraid to the greater internet via an FTP server would be a BAD idea. So, I'm definitely sold on doing this securely. I believe the camera can FTP or SFTP the footage out. But, I'm not sure how I can get Unraid to securely receive the data. I am only familiar with ProFTPd in Unraid and while there seem to be some old guides about how to get ProFTPd to use SFTP, they have deprecated warnings all over them and I am concerned that would be heading down the wrong path.

 

How would you get these files from this camera in Colorado to an Unraid server in California securely? Technically there is also a Beaglebone in Colorado that could operate as an intermediary if this cannot be done directly due to the limited abilities of the camera.

[Jlarimore]

Alright, my current thinking is FTP the videos to the Beaglebone and send them or pull them via a Wireguard VPN tunnel from the Beaglebone to the Unraid server. Does that sound like a good approach?

[apandey]

Yes, pulling where the connections are initiated from your end is a more secure setup than allowing the remote end to directly connect to you. There is a higher chance that someone can get physical control of remote end than the local one, and you don't want a way where they can connect back in directly

 

Even better would be for the remote end to upload to a cloud service from where you can pull. That service then becomes a controlled interface with it's own security layer

[Jlarimore]

3 hours ago, apandey said:

Yes, pulling where the connections are initiated from your end is a more secure setup than allowing the remote end to directly connect to you. There is a higher chance that someone can get physical control of remote end than the local one, and you don't want a way where they can connect back in directly

 

Even better would be for the remote end to upload to a cloud service from where you can pull. That service then becomes a controlled interface with it's own security layer

I do have Nextcloud running on the Unraid server and intend to spread any important videos to interested parties by sharing them via Nextcloud. The plan was to relay the files from Camera > Beaglebone > Unraid > Nextcloud (via nextcloud external mount). But, if you are saying it's better to push the files straight to a Nextcloud share via some kind of command line magic as Nextcloud has a bunch of security layers built in, that sounds like a good idea to me. How do you send something to Nextcloud without a GUI? Just mount the nextcloud share via webdav and create a script to move all the files over periodically?

[Jlarimore]

It worked! The camera FTPs the videos to the Beaglebone. The Beaglebone mounts the Nextcloud drive and transfers the files via WebDAV.