Security concerns port forwarding 8123 to HA OS on RP4

[webshaun (Shaun Rieman)]

To start, here’s my configuration:
Ubiquity UDM
Raspberry Pi 4
Home Assistant OS flashed from Raspberry Pi Imager

User account has a long unique generated password configured with 2fa enabled.

Port 80 and Port 8123 are forwarded to RP4 w/ HAOS

Letsencrypt installed and set to load on start. Domain is configured and SSL is functional.
Mosquitto broker installed and configured.

http config:
login_attempts_threshold: 3
ip_ban_enabled: true
ssl_certificate: /ssl/fullchain.pem
ssl_key: /ssl/privkey.pem

My mobile phone connects directly to my RPI instance without VPN through the domain. Port 80 doesn’t respond since Letsencrypt stops itself but needs to be open for http validation. Port 8123 shows the HA login screen.

My question is, did I miss anything on the security side? Should I be looking at any other security configurations or weak points?

[silvrr]

I would confirm why you need port 80 open. If you don’t need it open, I wouldn’t have it open. I think the let encrypt add-on doesn’t require port 80 open and I know the DuckDNS addon (which includes lets encrypt) doesn’t require it.

I tried to compile information on securing a HA instance at the link below. May be worth a read.

Securing Your Home Assistant Instance

I was reading a post about a security issue on another home automation platform and was going to provide a few links in the thread as people often read these threads and look for advice on how to ensure they are secure. I found my own past post on the issue lacking and the HA docs somewhat lacking or the information was really dispersed. This is my attempt to put a guide together and collect the information in one location. Note: I am far from a security expert and I have no formal training …

[WallyR (Wally)]

We are having some discussion about that topic in this thread.

Duck DNS configuration - I don't get it

It seems every VPN Client app requires a lock screen on the phone. For now, I’ve set up port forwarding and I’m using TP-Link’s dynamic DNS which is built into my router. That works fine and I don’t need Duck DNS. I’d like to add SSL but that doesn’t seem dead simple. I’ve cancelled Nabu Casa for now - maybe I’ll try it again someday. I understand at least some of the risk of port forwarding - what can I can do to reduce it?

[WallyR (Wally)]

@silvrr

why you need port 80 open. If you don’t need it open, I wouldn’t have it open. I think th

You need to approve your ownership and control of your domain and http on port 80 is one way.
Duckdns have already approved their ownership of duckdns.com and you just get a subdomain/host on their already approved domain.

[webshaun (Shaun Rieman)]

Thank you!

[Magnus919]

I would not forward directly from UDM Pro to Home Assistant.

The easiest thing to do is just to get a Nabu Casa account and let them handle securely tunneling to your Home Assistant node.

Or you could start getting into intermediate ingress routing between the UDMP and HA machines. NGINX with WAF profile? mod_proxy etc. Traefik? But it’s not enough to just install those things. There’s work to getting them in a good state. And even then… the Nabu Casa route will likely work out better in the end.