Selfhosted

63543 readers

425 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

224

PSA: Update your Tailscale! (lemdro.id)

submitted 6 days ago by stratself@lemdro.id to c/selfhosted@lemmy.world

19 comments fedilink hide all child comments

Just a quick notice for anyone using this software in their homelab. Tailscale has released v1.104.4 to address a series of prominent vulnerabilities disclosed last week. These vulns affect the Tailscale Serve and Tailscale SSH functionalities of the software, and allow already-authorized attackers to gain further privileges erroneously. Kindly update to that version or higher, especially if you are using one of the SSH/Serve features.

For headscale selfhosters that also use Tailscale SSH, consider setting TS_SSH_DISABLE_FORWARDING=1 on all clients, as headscale does not have a way to force turning off SSH forwarding (one of the attack vectors). Headscale also has a relevant disclosed vulnerability affecting node registration, and an in-progress patch for that which is trackable here.

Finally, do give your SSH grants/access control list a review again. You may also disable these ssh/serve features if you don't need them (and even compile the binary without them if you know how), and consider traditional alternatives such as OpenSSH + normal reverse proxy.

Further links:

Tailscale's blogpost on findings and fixes, with security recommendations
Tailscale's security bulletin for more info on the vulnerabilities (see TS-2026-014 to TS-2026-017)
Their prior investigation notes here

you are viewing a single comment's thread
view the rest of the comments

[–] xthexder@l.sw0.com 1 points 4 days ago

In my configuration I have a server with a public IP that manages incoming connections, and my home network connects to that server via a keepalive connection, so it's actually operating in the same client-server mode you described going through my NAT. This also solves the dynamic IP issues.

When I'm at home, my phone can route directly over my LAN, and when I leave the house it proxies through my public server back to my house (or out to the web depending on what I'm accessing).