WTH: Why is https so difficult to set up?

Month of "What the heck?!"
1

I want to (somewhat) securely access Home Assistant while out of the house. I don’t want to pay a subscription to route traffic through someone else’s server.
I am comfortable enough with port forwarding for remote access to Home Assistant (and can’t get my head around all the edge cases of VPNs), but logging in over the internet using http bothers me.

On 3 separate occasions I’ve tried to increase my security by upgrading to https. All 3 times I failed.

I consider myself a fairly advanced user. I’ve even made an integration that I use every day. But the plethora of necessary integrations/add-ons, external services, router configuration, and app configuration was overwhelming in the extreme.

One time I succeeded in getting remote https to work, but could no-longer access Home Assistant over the local network, with or without loopback, on http or https.

I still don’t know if I would lose local access to Home Assistant if the internet goes down when using https only.

2

I hope you are not port forwarding http. :grimacing:

As you are familiar with port forwarding if you use the DuckDNS App it comes with Lets Encrypt built in. All you have to do is accept the terms of use then https is done.

3

@18107 I agree with Rusty

I understand your concern, but I feel Home Assistant Cloud is very cheap and seamless. For clarity, I use Cloudflare ZeroTrust tunnels, but again that method comes at a cost. IMO, HA has provide a resonable solution to your request, Free options are available, but those will need a better understanding of networking to implement.

4

I have tried LetsEncrypt. Either I have an obscure network setup, or the simple steps are not that simple.

I know that I shouldn’t be port forwarding http, which is why I’ve tried 3 times to get https working, and 2 times to get a VPN working.

I have no problem with paying for Home Assistant cloud, but I don’t want to be reliant on someone else’s server. That’s one of the reasons I started using Home Assistant in the first place.

If Home Assistant already has https support build in for Home Assistant cloud/link, then why can’t I activate it with a button and just use port forwarding?

5

Port Forwarding opens your entire home network(router) to the world and is not a HA specific issue.

Share your basic Home network setup/HA info and we will help as much as possible. There are quite a few network experts here that will definitely jump in to assist!

TailScale and Cloudflared are options to look into beyond LetsEncrypt and DuckDNS

6

From memory (I no longer use it) it was as simple as changing accept_terms: false to accept_terms: true and that was ages ago in yaml. Now all those core (or community repository) apps administered by Frenk have a graphical interface for configuration.

I stopped using it as the open port was a scanner magnet. Constant (unsuccessful) intrusion attempts. Now with Nabu Casa I see maybe 3 or 4 attempts per year.

7

No, it does not.

It opens the service associated with the port that is forwarded.

A port forward of port 80 to the internal HA IP on port 80 only allows communication from the Internet to port 80 of the HA machine.

8

I get what liquid is saying.

You are technically right. Aaaaand so is Liquid.

If I get to your HA box I own ALL your creds. Probably including Amazon, Google, Apple and other identities you connected to. Often for security purposes. (Nest, Ring, Arlo, etc.) It also has LLM inference keys (highly sought after rn)

This is a HIGH Value target. An extremely high value one. I can get things that break security, allow me to make purchases and skim LLM tokens from paid accounts.

Our world in network security changed FUNDAMENTALLY two weeks ago when the AI discovered PhP viln hit. ‘Black October’

Prior to and especially since then I’ve seen increasing automatic attacks against open ports. Things that would have previously been done by ‘script kiddies’ is now being done by AI agents. The difference is a script kiddie used to run a set of known attacks and move on if they didn’t hit it.

Guess what an AI agent does? A well coded one adapts.

Hit port - oh this profiles as Linux, Build root
Probes port - oh this is *insert platform here * run known vulns.
Finds nothing… Adapts other known vulns until successful. (see PhP.)
Fails adapting, BUILDS custom attack attempts based on known code samples and…
Oh they blocked this endpoint? no problem move executed source to another owned endpoint in my zombie network.

And that’s the basic stuff now.

(yeah real-time boutique custom attack vector that doesn’t require an SME nor the resources of a nation state, and it’s the most primitive version of it that will ever exist right now. And that is pretty good.)

AND Its becoming exponentially faster.

So. With that. There’s absolutely, ZERO way Im exposing a machine to the direct internet that includes punching through ANY port without putting it through a security platform that is hardened specially for said attacks and performs SSL termination and stateful inspection… NONE. SSL or otherwise. (SSL only protects your session from being snooped, does nothing to keep the front door locked.)

Im not even interested in doing it the way NC does right now because the auth request makes it to my install. I’ll keep paying to support OHF but I’m not exposing my system like that.

The only viable alternative I see currently is a VPN solution where you must login to even SEE the endpoint. (thus making it impossible to even hit from an ai attack)

Now back to topic… SSL needs specific things to make it work. I could see them (OHF) making it ‘easier’ with some kind of UX for it… That said

Spicy take:

I’d prefer they not because then people will use it to do exactly that ^^ above and expose thier machine thinking oh it’s SSL it’s fine. It most certainly is not anymore. At least using Nabu thier (Nabu’s) machine takes the first punch. Making SSL easier for purposes of direct exposure on the internet rn is a bad idea imho.

(basically a simple open port is not good enough any more even with SSL)

Yes there plenty of other reason to want it but I’d also submit if someone has one of those valid use cases they probably also know how to setup thier own PKI/CA to make it work and for that, the current facility, using YAML is fine.

9

Someone has opened a similar WTH here:

I do think LE and simple cert management even for internal user would be super :slight_smile:

10

What prevents “AI” from compromising the VPN endpoint/service?

11

There is literally no endpoint to connect to from thier perspective they would have to compromise the CLIENT machine connecting to your exposed port and VPN solution first.

Read it’s an order of magnitude harder and if they do that you already have worse problems because you’re part of the bot net.

12

The VPN service is the endpoint. It is open to the Internet to allow connections. “AI” finds a zero day which enables authentication to any account without credentials. Thus everyone using that service is compromised.

At some point, there has to be an open port.

13

No. You’re missing the point. You have to auth first to your VPN service to even GET the connection endpoint. There’s an intermediary telling your client how to find it

Tailscale does not publish an external port like that. Nor does Unifi. Cloudflare can but I think it’s tls mediated.

Also - you can basically also accomplish similar by requiring tls on client (because there’s an auth exchange - hey are you even supposed to be here show me your cert - before the cred.)

That are you even supposed to be here is the key. It casts them off before the attack starts.

In Nabus case they are intercepting the endpoint but them immediately redirect TO YOU for auth.

Basically if your name is not cloudflare and you have an open port on the internet. I am EXTREMELY concerned for you.