Safety

Updates you can trust#

Every LibrePortal release is signed by the project. Your server checks the signature and the checksum before it uses a download, and refuses anything that doesn't match. The small file that says which version is current is signed too. It carries an issue time and an end date, so an old or copied one is turned away.

Apps are pinned to an exact version of their image, not just a name like latest. A fresh install gets the same software everywhere, and an app changes only when you update it. Before each app update LibrePortal takes a backup, and it puts the app back if the update goes wrong. See Updates.

A firewall that is already on#

The firewall is switched on during the install, after SSH and the WebUI have been let through so you don't lose your connection. After that, nothing gets in unless something asked for it. An app marked Private can only be reached from your trusted places. New installs start new apps as Private. Who can reach what has the details.

Attackers get blocked#

CrowdSec watches your server for the behaviour of an attack, like hundreds of wrong SSH passwords, and bans that address at the firewall. A ban lasts four hours. If you use Traefik, CrowdSec reads its short log of failed web requests too, so probing of your apps is caught as well. CrowdSec also shares a blocklist of addresses that are attacking servers right now, so you can block them before they try anything on yours. It's one of the apps the setup wizard suggests.

Limits on signing in#

Guessing passwords is the most common attack there is, so every sign-in has a brake on it.

• The WebUI counts wrong passwords by address and by account. A burst of tries sent all at once counts the same as tries sent one at a time. Past the limit, that address has to wait, and the wait grows each time it keeps trying.
• Phone codes and pairing codes are counted by the address that is really connecting, so changing a header on the request doesn't reset the count.
• The Authelia sign-in page limits how many password checks one address can make at once and how fast. The page itself is not limited, so it still loads quickly. Checking a password is the expensive part, and that's where the limit sits.
• Two-step sign-in is on by default for Authelia, and each WebUI account can turn it on too. See Two-step sign-in.

Nobody has a default password, and nobody can claim an app by getting there first. Security explains that rule.

Authelia in front of your apps#

Authelia gives apps with a weak login, or none, a proper sign-in page. People then sign in once for many apps. Authelia's sessions last up to 12 hours, and end after two hours of doing nothing. See Sign-in explained.

Containers are boxed in#

Docker runs in rootless mode, as an ordinary user, so an app that was broken into would not find itself in charge of the machine. On top of that, every app's container is held in:

• It can't gain extra rights by running a program that asks for them.
• It has a ceiling on how many processes and how much memory it may use, so one runaway app can't take the whole server down.
• Apps that have been tested without Linux's extra powers have them taken away.
• Only Traefik, the WebUI and Trivy can reach the Docker engine's control socket. Eighteen apps used to carry it for no reason, and now they don't.
• The data folders of apps that hold secrets, like your password manager and your mail, are closed to other accounts on the machine.

The web page of the control panel can't be shown inside another website's page, which stops a trick called clickjacking. Hardening has more.

Backups, and getting them back safely#

Backups run every night and are encrypted before they leave the server, so a stolen disk or a cloud copy is useless without your repository password. A Backup Server can keep a copy that your install can't change or delete.

Restoring is careful too. LibrePortal checks the backup is really there and readable before it touches your app. It checks each file went back whole. If any part fails, it stops and says so instead of starting an empty app. A backup is treated as something that might have been tampered with: the part of LibrePortal that runs as root only reads from inside the restore area, and refuses a link that points anywhere else. A backup or storage location name that could run commands is refused when you type it. See Backups and restore.