LibrePortal
Sponsor
Install

Hardening

What is hardened on every install, and what you can tighten yourself: trusted places, WebUI and SSH limits, VPN-only admin and extra firewall rules.

On this page
  1. Hardened on every install
  2. Tighten who can reach things
  3. Tighten sign-in
  4. Add your own firewall rules
  5. Keep watching

Safety lists what LibrePortal does without being asked. This page is for the next step: what is locked by default, and the settings an administrator can use to lock more. Everything here works on a plain http://ip:port address. None of it needs a domain.

Hardened on every install#

  • The firewall is on, and Private apps answer only your trusted places.
  • Docker runs without root. Each app's container has a process ceiling and a memory ceiling and can't gain rights, and many have Linux's extra powers taken away.
  • Apps that don't need the Docker control socket don't have it.
  • Passwords are random and kept in files only LibrePortal can read. No app starts with a default password.
  • Sign-ins are rate-limited, for the WebUI, the Authelia portal and phone pairing.
  • The control panel can't be framed by another site.
  • Images are pinned to an exact version.
  • Logs are short and quiet. See Privacy.

Settings you already had are not changed behind your back. When an update brings a safer default, it's added to the apps you already have only where that changes nothing you chose. Some container settings apply the next time an app is recreated, by an update or a saved change.

Tighten who can reach things#

Trusted places. One list of where you're willing to be reached from: your home network, addresses you add, and VPN devices with the Admin right. It drives every Private app and, if you choose, the WebUI. Set it on Admin → Tools → Access. See Who can reach what.

Make Private the start. Choose Private as the answer a new app starts with. A new install starts that way already.

Limit the WebUI. In Admin page on the Access page, choose Trusted places only, or Only my devices to allow nothing but VPN devices with the Admin right. Then strangers can't even see the sign-in page, and your password becomes a second lock. LibrePortal only lets you pick a setting from a connection that will still work afterwards.

The ten-minute undo

Anything that closes access undoes itself after 10 minutes unless you confirm it from the new way in. You can't lock yourself out by accident. See the ten-minute undo.

Limit SSH. On Admin → SSH Access, add your public key and press Require key-only login. You can also limit which places can reach SSH at all, in the SSH section of the Access page.

Use the VPN to get in. The LibrePortal VPN lets you reach private apps and the WebUI from anywhere without opening them to the world.

Tighten sign-in#

Add your own firewall rules#

If you need something LibrePortal's firewall doesn't offer, like SSH only over a WireGuard interface, hand it a rule instead of adding one with ufw by hand. LibrePortal checks the rule can't lock you out, puts it back after every rebuild, and carries it through backups and restores. See Extra firewall rules.

Keep watching#

  • Keep the operating system up to date. LibrePortal updates your apps, not Debian or Ubuntu.
  • Install CrowdSec and Trivy, which finds known problems in the images your apps run.
  • Keep app updates on Automatic, and keep each backup location's repository password somewhere safe.
  • Run libreportal verify now and then. It says whether the installed files still match the signed release.

Next steps

PrivacyLibrePortal keeps as little as security needs and no more.Who can reach whatMake each app and the WebUI public or private, in one place.The VPNYour server's own VPN, for reaching private apps from anywhere.