submitted 1 year ago* (last edited 1 year ago) by RandomLegend@lemmy.dbzer0.com to c/opensource@lemmy.ml

50 comments fedilink hide all child comments

I currently use Authy on my android and my Linux system.

It syncs every new authenticator between my devices but I dont want to trust companies with my security anymore.

I host a nextcloud instance on my homelab. Does anyone know a good FOSS authenticator that can use my nextcloud to sync between Linux and android? Provided that it is available on both of course.

Thanks for any input!

you are viewing a single comment's thread
view the rest of the comments

[-] SGG@lemmy.world 13 points 1 year ago

I use vaultwarden (open source implementation of bitwarden server). Yes it's a seperate service to manage, but it's a dedicated password/secrets manager that can do otp codes.

I've been running the docker container for a few years now and it's been rock solid.

[-] RandomLegend@lemmy.dbzer0.com 6 points 1 year ago

Interesting... I found the idea of hosting my own password manager daunting. What if I mess up, lose access, etc... But now a days I believe to have a solid setup, more understanding... Guess I could go that route

[-] russjr08@outpost.zeuslink.net 4 points 1 year ago

The bitwarden clients themselves do keep a cached version of the database every time there is a successful sync to the server, so if you were to take the server offline you could still view / export the data thankfully! You cannot make changes to the database according to that page and my own experience, though others have reported that they are able to. Additionally, it looks like this cache does expire (30 days on desktop, 90 on mobile).

Just make sure to not log out completely (this is not the same as locking the vault, which is fine), this wipes the cache immediately.

[-] SGG@lemmy.world 3 points 1 year ago* (last edited 1 year ago)

Losing things is one of the risks of any setup. With paid for services you are putting trust that the provider has put in place methods to prevent downtime/data loss. Self-hosting means the onus is on you. Make sure you document things, make sure you have some kind of backup in place, and update things regularly (but maybe not straight away, just in case).

Also expect to occasionally run into weird issues that you need to figure out a fix for. I am 99% sure it was for my NextCloud-AIO setup a year or so ago, but there was an update to it that broke the setup if you had created the containers previousy at a certian time. You needed to run a particular command inside one of the containers to fix it up.

There was also the time where I migrated things off a physical server to a VM, but missed the script that was doing my certbot DNS challenge renewal. I had not documented things back then and a few months later all my services stopped working, that took a bit to re-do.

I do make sure to keep backups of my VM's, and for the VPS I run I pay a bit extra for vultr to keep backups/snapshots there. Along with actual documentation of how I did the setup, I've got things stable for the most part.

Here's my Heimdall homepage to give an example of different services I run, as well as some links to other websites. Blanked out a few things for privacy and eyepatch reasons (not sure if that's allowed here).

[-] RandomLegend@lemmy.dbzer0.com 1 points 1 year ago

Yeah i had some issues once when i ran all my services inside a VM on TrueNAS. Some config prohibited it from using too much of the CPU and it locked up the Ubuntu install all the time... fun times.

Now i have 3 physical servers and run 36 services and what not...nothing of this is critical for my security though. As there is more to it than just making sure you keep your servers running and accessible. I know how to fix most of the stuff that could go wrong. I don't know how to stop a malicious actor that wants to fuck with me...and there is my dilemma. A big company (in my case 1password) has teams full of security specialists. They are more hard to crack than i could ever be... but since they're big they are also a bigger target. And with their team-size the risk of social engineering also goes up. It's a dilemma^^

Btw. are you the SGG from Garuda-Linux?