Selfhosting a Website and using Samba locally. Is it safe?
Posted by nosleeptilllegoland@reddit | linuxadmin | View on Reddit | 9 comments
Hi,
I recently got into Web Development and bought a Raspberry Pi Zero 2W going by my profs advice to host my portfolio. It uses the 32 bit Raspberry Debian OS
I wanted to frequently update the files that the Website pulls from and so looked into local file sharing which is how I heard about Samba.
I managed to set it up now and it opened two ports locally I think for devices in my network. I tried to check for open ports with online tools but they all said there are no open ports so with my beginner-conclusion I think that these ports are only open for internal traffic.
But after doing that and looking for further steps I came across a lot of posts where people warned about self-hosting websites and where samba in the context of forwarded ports which I believe is different from what I did(?) was also warned against and so to feel better about making a webserver on my Pi for just the website and not the local file sharing I wanted to ask for advice from more seasoned Networking enthusiasts if I can go ahead or if I am about to implode if I take a step further.
For context, my plans for next steps are using NGINX or Pingora and Cloudflare to host the website.
Thank you in Advance!
wiseguy77192@reddit
You don’t want to forward ports for outside users, but you can pull data from samba/nfs on the same internal network. Personally I’d put your site on docker container, forward with haproxy or nginx and pull any static data from nfs. I wouldn’t use smb/cifs for anything outside a trusted network.
LushLimitArdor@reddit
Yeah this is the key bit: Samba is fine on your LAN, you just really do not want it exposed to the internet.
If you’re behind a normal home router and you didn’t set up port forwarding for the Samba ports, then those shares are only available inside your network. That’s why the online port scanners don’t see anything.
Typical setup people use is kind of what the other commenter said
Pi runs nginx (or whatever) to serve the website to the outside
Samba/NFS is just how you move/edit files on the Pi from your laptop, all internal
Just double check your router’s port forwarding page and only forward 80/443 (or whatever Cloudflare tunnel / reverse proxy needs), and leave the Samba ports alone. Then you’re fine to keep messing with it without imploding.
nosleeptilllegoland@reddit (OP)
thanks )
I see. Ill look into Dockers. I dont understand all the workings but I heard it works like a Virtual Machine in isolating parts of the computer to contain damages which sounds like something I would want.
Jwblant@reddit
If your website is essentially serving those SMB files via HTTP then it might not be a massive issue as long as you have your .htaccess configured correctly. But if you open the ports on your firewall to point directly to your SMB server, then you are probably already in trouble.
Typically, you are just going to have a subdirectory in your project, something like /var/www/static where you can add different files to share. From there, you can enable SMB on the Pi to that directory so you can edit it from the network if needed.
If you wanted to get fancy, you could expire S3 storage and CDN so that you aren’t even hosting the files anymore. It would also be a good exercise for a real world app.
nosleeptilllegoland@reddit (OP)
I see. I think I understood what you said.
So its not an issue if the smb server only serves to move my files locally to then be transported outside my network with the web server through ports 80 and 443 but would be an issue if i was routing some external place through my network to my smb server for which two more dangerous ports would be open.
And about S3 and CDN I havent heard of them yet but AWS comes up when I look for it so Ill look more into the whole topic. Thank you! 😄
dataexception@reddit
S3 is where you would store the data, and probably also your static website. The AWS cdn is Cloudfront, which is more about delivery in the appropriate geolocation.
You can configure a WAF to restrict the access by various methods, which at my org, we use for IP range restrictions and geoblocking. This can be somewhat accomplished to a lesser degree with bucket policies.
I don't have as much experience with this area, as that's more for the devs and security to deal with. I've had to help them fix it in the past, though.
To your original question, as long as you know exactly what is exposed to the Internet, and you have your webserver hosted in a DMZ on a separate network segment, you should be fine.
As long as it's not able to reach into your internal network directly, (i.e. file access is push model vs pull), you monitor that host via Prometheus/Alertmanager or your favorite alternative, and keep it up to date on security patches, you're going to be fine.
If this is your first deployment of this type, it will be a great opportunity to learn how it all works. If it's just a learning project to understand how it works, and don't have sensitive data at risk, then don't worry about it. Just, the whole separate network segment in a DMZ is important to know.
Have fun! I used to love doing that.
nosleeptilllegoland@reddit (OP)
Thank you 😄 Its my first time getting into working with a terminal much and its really fun digging through the internet to find 10 ways to do sth and then at the end 9 of them didnt work but then I know a bunch more stuff from that.
And thanks for the input and explanations!
Im feeling from all the comments that theres a lot to learn still before I can even understand all the help and advise Im given but now I know some points to look into next. :\^)
dataexception@reddit
You're going about it the right way. Learn by doing. Breaking things, then having to figure out how to fix it is one of the best teachers. The more severe the problem, the more memorable the lesson. 😆
Enjoy your journey. It's addictive.
dodexahedron@reddit
If that is the use case, that's what SMBoQUIC was actually designed for, as part of MS's push to get everyone in the cloud. It was demanded ao much that they went ahead and enabled it for on-prem servers too, eventually.
Does Samba iimplement that?