[thesorrow]

FYI : If you have a NextCloud or Owncloud installation. The recommended nginx configuration is vulnerable [1]

[1] https://nextcloud.com/blog/urgent-security-issue-in-nginx-ph...

[swiley]

I wish there was a webdav server that wasn't a huge PHP thing and had decent authentication/authorization.

Almost everything has SFTP built in anyway now though, it's only a matter of time before OSes other than Linux based ones integrate it into the shells and then webdav won't matter so much.

[Lorkki]

Seafile has been working for me as a personal Dropbox replacement, with s3ql for mass storage. It's very light in relation to Nextcloud/Owncloud (a primary criterion for me trying to cheap out on servers), supports WebDAV, role-based access and a bunch of SSO options. The biggest possible drawback I can think of is that it doesn't store files in the plain, so you can't trivially tie in SFTP or serve files from the storage directly.

[xienze]

Do you just want WebDAV and nothing else? There’s plenty of Docker images for that and most of them are just Apache with the relevant plugin and config.

[jacquesm]

Or something that includes NextCloud or Owncloud even if you do not use them, such as Mailinabox.

[jeremija]

Thanks for the link! The example in the link does not contain the

   set $path_info $fastcgi_path_info;

line after the `fastcgi_split_path_info` directive.

My old configuration used the `$fastcgi_path_info`, and the new one uses the `$path_info` variable, so I got the following error while starting nginx:

    nginx emerg unknown "path_info" variable

Might be worth checking out the sample from the Nextcloud Admin Manual[1]

[1]: https://docs.nextcloud.com/server/17/admin_manual/installati...

[ralala]

The production-fpm docker image has not yet received any updates - correct?

[heavyset_go]

This is a case study in why you shouldn't expose your self-hosted services to the internet.

[nominated1]

It’s more evidence that you should assume everything is vulnerable and layer protection.

For a home network simple multi-port knocking should be enough (combined with --ctstate NEW even better). If port knocking or SPA is too cumbersome then at least consider limiting access based on GeoIP, block tor exit nodes, etc (ipset is pretty amazing).

This can be applied to any service on your network btw, including Wireguard. I like knowing that a portscan of my network shows nothing open. I don’t end up on a list that gets used in the next ‘spray and pray’ attack.

Disclaimer: I’m not advocating this for serious use due to replay attacks and IP spoofing via a VPS. This is for home network protection (a boring Class C non target).

[UnoriginalGuy]

Google has gone the opposite direction.

I feel like throwing everything behind a VPN and pretending it is secure is a crux.

Several famous break-ins over the last ten years have hypothetically been on the inside of that wall.

Better to isolate services from each other limiting cross service jumping, than to build security around a single point of failure.

[noja]

No it's not.

[kuzimoto]

I have been thinking about this a lot lately. What is the best alternative, only accessing your services through a VPN?

[dvfjsdhgfv]

No, it was definitely not true in the past and is not true now. First, technically there is no much difference between a given app self-hosted by you and hosted by a company charging you for that except that in theory they should worry about these things instead of you. In practice, your experience will vary - companies happen to be as vulnerable as you, and for various reasons their reaction time might be longer.

Second, bugs are found every day, and your best bet is to use automatic security updates provided by your distro. Yes, if you host anything, you need to be a bit of a security guy and a small amount of paranoia won't hurt. But to say you must not self-host for security reasons is a gross oversimplification.