Security

What a new install already does#

You don't have to switch any of this on.

The firewall is on. LibrePortal turns on the machine's firewall (ufw) during the install, after letting SSH and the WebUI through, so you don't lose your connection. From then on nothing gets in unless something has asked for it. When you install an app, its ports are opened according to who you said can reach it: to anyone for a Public app, and only to your trusted places for a Private one. Who can reach what explains that choice.

Apps don't run as root. Docker, which runs your apps, is installed in rootless mode under its own ordinary user, dockerinstall. If an app were ever broken into, the attacker would find themselves as that user, not in charge of the whole machine.

LibrePortal itself has limited rights. It runs as the libreportal user, which isn't in the sudo group. It can only run a short list of LibrePortal's own root helpers and a few system tools it needs, like the firewall.

The WebUI sits on a random port, picked between 3000 and 9999 when you install. Bots knock on the well-known ports; one they'd have to hunt for is one fewer thing for them to find.

Passwords are kept apart. The passwords LibrePortal generates for your apps are stored in files only LibrePortal can read, rather than in the settings files, and they're masked in logs.

A Backup Server can only read. If you let a Backup Server pull your backups, the account it uses can do that and nothing else, and it can't see the WebUI's login secrets. See what a Backup Server can reach, and The Backup Server for the machine at the other end.

The sign-in gate can't be walked around. An app behind the Authelia sign-in no longer also answers on its direct ip:port address.

No default passwords#

Plenty of apps, installed by hand, start life with a well-known login like admin/admin, or with a setup page where whoever turns up first becomes the admin. Bots know every one of those defaults, and they look for fresh setup pages. So LibrePortal has one rule for every app in its catalogue: no app ever runs with a default password, or can be claimed by the first visitor, even for a moment.

In practice that means:

• Every password an app needs is made up by LibrePortal, long and random, when the app is installed. That includes the ones you never type, like the password between an app and its database.
• The admin account is made during the install, and its login is on the app's Login Details card, shown when the install finishes. Press Welcome on the app's page to see it again.
• Apps that can't be handed an admin before they start are kept out of reach until they have one. They're reachable from the server only while the install sets them up, and they open up once the new login has been checked. If that can't be done, they stay closed and the install says so. Installing apps has the details.
• Sign-ups start closed on apps where anyone could otherwise make an account, such as Mastodon and Vikunja. You add people with the app's Tools tab, or open sign-ups yourself if you want them.

A handful of apps have no accounts at all by design, like IT-Tools or PairDrop. There's nothing to claim in those, but anyone who can reach them can use them, which is one more reason to keep apps private unless they need to be public.

Releases are signed#

Every LibrePortal release is signed by the project. The installer and libreportal update both check each download against its published checksum and its signature before using it, and refuse to install anything that doesn't match. So nobody can slip you a modified LibrePortal by tampering with the download on the way.

You can check the installed files at any time. Integrity on the Admin Dashboard says Verified when every file matches the signed release, and Modified if anything has been changed. The same check from the command line:

sudo -u libreportal libreportal verify

The WebUI's sign-in#

The WebUI can have several accounts, each with a rank. Passwords are stored only as hashes, the way websites store them, and a sign-in lasts 12 hours. After ten wrong passwords from the same address within 15 minutes, that address has to wait at least 15 minutes before trying again, and longer each time it keeps trying. Each account is also slowed down after five wrong tries, from wherever they come. See Accounts and people.

Each account can turn on two-step sign-in, a code from an authenticator app after the password, and you can require it for a whole rank. Limiting who can even see the sign-in page is still worth doing: set it to Trusted places only or Only my devices on Admin → Access. Then the password is a second lock rather than the only one. See Who can open the WebUI.

You start with one account, the Owner, with a random username and password, which you can keep as they are. To choose your own, change them on Admin → People (your own row) or on My account in the top bar. Changing your password signs out your other devices. The old WebUI Username and WebUI Password fields no longer appear on Admin → Config → WebUI. The server keeps them only to make the first Owner on a fresh install and for the recovery commands below. Sign in with Authelia for the control panel is now on Admin → Tools → Single sign-on.

To see the current login, or to have a fresh random one made:

sudo -u libreportal libreportal webui login show
sudo -u libreportal libreportal webui login reset

reset makes a new random username and password, restarts the WebUI, and shows you the new ones. webui login apply makes the login in the config the one the WebUI accepts, which is only needed on an older install where a login was saved but never applied; login show won't print a login the WebUI hasn't actually taken. Either way, keep whatever you use in a password manager.

Things worth doing yourself#

These take a few minutes each, and they're what makes the biggest difference.

Keep apps private unless they need to be public. A private app can't be attacked by strangers at all, however good or bad its own login page is. Choose Private as where a new app starts, and use the VPN to reach your apps when you're out.

Limit who can see the WebUI, as above.

Turn on two-step sign-in for your own login, and for anyone you add. See Two-step sign-in.

Use keys for SSH. On Admin → SSH Access, paste your computer's public key (a line starting ssh-ed25519 or ssh-rsa) and press Authorize key. Once you've checked you can log in with it, press Require key-only login, so SSH stops accepting passwords at all. LibrePortal won't do that until at least one key is added, and it checks the new setting is valid before applying it, so a mistake can't leave SSH broken. You can also limit who can reach SSH at all, in the SSH section of Admin → Access.

Keep the operating system up to date. LibrePortal updates your apps, and brings the system up to date when it installs, but after that it doesn't install Debian or Ubuntu updates for you. Run sudo apt update && sudo apt upgrade now and then, or turn on the system's own automatic security updates (the unattended-upgrades package).

Keep app updates on Automatic. Most security fixes arrive as app updates, and LibrePortal takes a backup before each one and puts it back if anything goes wrong. See Updates.

Optional apps that add more#

The setup wizard suggests the first two, ticked, on its Recommended step. You can install any of them from the App Center at any time.

CrowdSec#

CrowdSec watches your server's logs for behaviour that looks like an attack, like someone trying hundreds of SSH passwords, and blocks that address at the firewall. It's installed on the server itself rather than as a container, because it needs to see the whole machine.

It also uses CrowdSec's community blocklist, a shared list of addresses attacking servers everywhere, so it can block them before they've tried anything on yours. That works both ways: your server reports the attacks it sees to CrowdSec, which is how the list is built. You can switch the blocklist off in CrowdSec's settings. To check: CrowdSec's blocklist and console settings are only applied when it's installed; confirm whether changing them later needs a reinstall

When you have a domain, CrowdSec also checks visitors to your apps through Traefik. Addresses on your home network are never blocked there, so you can't lock yourself out by mistyping a password at home.

Trivy#

Trivy checks the images your apps run for known security problems (CVEs). The results show on App Center → Overview, as the number of known problems across your apps, and on the Updates tab, where the Security filter shows the apps affected. Usually the fix is an update of the app; when there isn't one yet, it's worth knowing which apps to keep private.

Authelia#

Authelia puts a proper sign-in page in front of apps you choose, which is useful for apps that have a weak login or none at all. It needs a domain and Traefik. Once it's installed, tick Authelia Integration in an app's settings to put that app behind it. Authelia can also ask for a code from an authenticator app, and a new install asks for one by default. See Two-step sign-in.