Cloudron Forum

I wanted to share some information acquired from the school of hard knocks...

Background: I found that VaultWarden uses PBKDF2-SHA-256 as its default encryption with 600,000 iterations. One thing I discovered from security experts after being one of the many unlucky LastPass customers (victims of a hacking incident) was an added vulnerability in that everyone had the same number of KDF iterations based on default installation values. While VW's 600,000 is far greater (and better because it requires more calculation resources) than my LastPass default setting, it is unfortunately the same for everyone - unless you change that:)

Suggestions:

• Set a random value > 600,000 for the # of KDF iterations - Account Settings | Security | Keys. Setting a value too high can make VW a bit unresponsive, so increase sensibly based on VW's suggested increments.

• OWASP publishes a recommendation on the # iterations for PBKDF2 encryption . Check periodically to make sure your value is equal to or greater than their recommendation.

• Note: Each user will need to change this setting for their account.

Benefits: A random KDF means a hacker has many more possible combinations to try. With any luck they will move on to an easier target. Staying at or above OWASP recommended iterations makes sense as well.

Hope this helps.

As a relatively new member of the Cloudron community (especially compared to @scooke) I can see both points of view. The current collection of apps is very eclectic, spanning both personal and business. And to a certain extent that reflects the wide range of our community - a strength.

I do not envy @girish and team trying to please all of us. It is both thankless and impossible. But one person's "must have" app is another person's "who cares". The danger is losing members if their needs are not met with the applications they need or want.

Perhaps having a simplified installation process would allow more people to customize their Cloudrons as desired. And yes, despite the warnings that you are on your own, I am sure that support questions will arise. And the spirit of the Cloudron team and the community to help will always prevail. As long as these questions are within reasonable limits, perhaps this will allow the platform to grow more valuable without being overwhelmed. I would suggest that custom-installed apps have its own topic area, especially if the results could be hidden from search engines to prevent prospective members getting the wrong impression about Cloudron's reliability per @scooke 's valid concerns.

Finally, I am personally interested in a business-oriented, custom-app platform where Dockerized applications can be hosted in a well-thought out and architected environment like Cloudron. We are exploring several ideas along these lines, including adding some private applications we have created, others we have paid to license, and some that are open source. And these systems would require incremental Cloudrons - helping to grow the revenue stream. In the end, that's the idea, isn't it...

@nebulon @girish I think that user choice would be best with Cloudron recommendation (3 failures in a row) being the default.

@infogulch Looks like you are right. I checked one of my VW backups and searching for the unique KDF iterations revealed that it is in fact stored in the database. So the information I read after the LastPass breach was incorrect suggesting that a random value of similar size provided more protection that just using the default value.

As I recall the default value at that time was 100,000 and OWASP was suggesting a much larger number. In fact some long time users had much smaller KDF iterations, making the hacking effort minimal.

So it looks like OWASP recommendation should be the minimum KDF iterations and to @girish question earlier, perhaps increasing the value based on your own hardware devices in sensible increments.

Thank you @infogulch for correcting my misinformation. But since my random # was higher than 600,000, I'm keeping it:)

@girish Thanks for the suggestion. Sounds like I will need to pursue this idea on an app by app basis, rather than signing on as a Cloudron user. If I am successful, I will share the results so that others can benefit as well.

@Dont-Worry I am experiencing similar thoughts about the potential for using Cloudron in mission-critical situations. In past years I have preferred "buying" services from larger, known organizations rather than "building" it myself. But I have been disappointed on too many occasions by these companies. The Cloudron team and community is incredible and I think my company's needs might be better served here than in other places. To achieve this goal we must also ask what "we" can do to help the Cloudron team (@girish, @nebulon ) get there. Whether money or time or both, we should be prepared to invest in our future!

Final solution: Ventoy + Clonezilla + Anker USB Hub = Tested server restore from USB image!

Future solution(s): Terraform (cattle ranching sounds like fun), NetBoot.xyz, Clonezilla with restore images stored on Amazon S3.

Thanks to everyone for helping me solve this one!

There is a meme going around as follows...

"There are two types of companies: those who have already been hacked, and those that don't know it yet". @3246 I laughed when I saw the source of the article you posted. Perhaps you have also seen that CISA itself has been hacked: CISA Hacked - CNN, March 2024. No one is immune. No one is too safe. No one is invincible.

All of your points are valid. I have also seen insurance companies that sell cyberliability policies offer to store a cookie in your browser and bypass 2FA. I have also seen banks do the same. That said, we should do everything we can to strengthen our authentication systems (including Cloudron) and I agree with @necrevistonnezr that balance is the key. A hard to use security mechanism will cause users to scream for a bypass (like the aforementioned cookie fiascos). And lost or forgotten hardware keys will likely require another alternative - reducing the intended level of security.

I have no doubt that Team Cloudron will consider adding more secure authentication mechanisms in the future and I support that effort wholeheartedly. But in the interim, I would encourage others to consider the risk/reward tradeoff offered by Cloudron. Personally, I have not seen a better platform and not found a better community of colleagues to dialogue about issues such as this.

@andreasdueren FYI, I found this Apple reference and it seems to imply a difference between mac OSX and iOS/iPadOS support... which was more clearly summarized by @fbartels:) And this Microsoft reference on the difference between EAS and EWS.

Plausible is a great platform. We have contributed some (open source) code enhancements and I can say that the two individuals behind Plausible are awesome to work with. We are hosting this on our own infrastructure but continue to maintain a subscription at Plausible.io to support the platform (Note: this is an easy and inexpensive way to test the technology). For those considering "packaging" it, there are multiple docker containers required (5 if my memory is correct on this): database (PostGRES), events (Clickhouse), email, application, geoIP database. And Plausible is GPDR-compliant!

FWIW, I have found the best email delivery using Postmark, a REASONABLE, paid service provider. We have used Mailgun (shared IP) and periodically needed to switch IP addresses once the IP address got "poisoned" by someone else. Dedicated IP works, but is very expensive. If you do not send a large volume of emails, it may be difficult to earn a good reputation.

For all those reasons, we have moved most of our outbound email to Postmark. Deliverability is excellent. You can (and should) establish individual "servers" for different domains/email streams (marketing vs. transactional).
We get confirmation that emails were delivered to the recipient's mail server. That's how we found out that some of our emails were being "blackholed" by a large inbox provider (guess who?)

For an expenditure of $US20/month we can send 10K/month and have delivery records for 90 days. Totally worth it.

@girish 4 if you count me:) I agree with @humptydumpty and @marcusquinn . I have experienced many years of flawless service and support. They were recently purchased by DigiCert, but I have not noticed any changes since then. Hoping that continues.

@adisonverlice2 @necrevistonnezr Thank you both for posting about this. I just returned from an API conference and a presenter from Yubico was advocating for adding passwordless. If/when I received the slidedeck, I will share some resources he mentioned. But I think that Bitwarden is an excellent approach and for most of us, 10,000 users per month will not be an issue. On the other hand, I could buy a lot of Cloudrons and Auth services if I had 10,000 users...

@jdaviescoates I send nowhere near that limit. I use it for business and personal email accounts because of the deliverability issue. The monthly cost is trivial compared to the time wasted trying to troubleshoot issues.

@girish Did Z-Push ever make the final cut for the App Store? Since Zopano stopped supporting this, a new maintainer has emerged (https://kopano.com/blog/z-push-has-a-new-home-and-a-new-maintainer/) and Z-Push appears to have been updated to PHP8+ which is encouraging. @fbartels In searching for z-push I even found an old docker repo you were playing with 9 years ago! This could be a very powerful option for Cloudron email with ActiveSync as an alternative to Exchange/O365. Any interest in pursuing this?

I third this. One of the other benefits of Postmark is being able to make sure that an outbound email is delivered. For some recipients, you will even see an "Open". This is not always reliable as O365 and some systems that "jail" the opening of email for security analysis may report an odd location (not one expected for the recipient). Another option is to extend the length that the log is retained. IMHO, worth the extra $5 per month.

@staff Impressive. < 24 hours after Vaultwarden released an important patch, my Cloudrons are updated. Much appreciated. Wish I could say the same for my other tech vendors(:

@d19dotca We have successfully used Cloudmersive's API. That being said, they dropped the ball on a bug we reported and we had to implement a workaround. But other than that, it has worked well for us. When users upload a file via browser, we quarantine the file and if it scans clean, we move it into a user's personal storage.

Multiple languages are supported with API libraries. We chose to integrate using cURL to reduce dependencies.

@girish I don't know whether a "listener" process could be attached to Cloudron folders when a file was added or updated and then virus scanned via API before allowing user access. But this could get expensive for servers processing lots of files/attachments as only 800 monthly scans are free.

@Dont-Worry Now I appreciate your situation better. I have not tried OpenWebUI but I understand the issue.

Wordpress is the only exception to self-hosting. I would use Cloudron for almost anything else, except PHP websites which we handle differently for a specific reason.

In my opinion, best practice on Wordpress plug-in management is with tooling: backup, update plug-ins, perform pixel inspection on the most common/important web pages, and if outside limits, roll back the update. We have not found a way to do this ourselves and use a 3rd party hosting. We are also testing our own verified backup solution where a backup is restored to an off-server instance to prove that regular backups are good. Again, we have seen backups fail, but if you are relying on that to restore a broken site, you may be in big trouble.

Couldn't think of a better group of tech experts than "Cloudronites" to pose this question to. (The use case is a little unusual as the bare metal server would not be used to host a Cloudron server per se, but the server will be used to provide specialized, custom solutions to Cloudron users).

I need to deploy a disaster recovery solution to a SuperMicro server (multiprocessor w/ hardware RAID1) located in a remote data center running Ubuntu 24.04. I need to be able to restore roughly 20GB of OS and installed software in the event of a corrupted server without skilled engineers to troubleshoot this. Data recovery is not a concern as that is being handled by a separate process. In addition, it is not necessary to constantly refresh the rescue media as Ubuntu APT can easily update the restored server from the older rescue snapshot. [Note: For those thinking "why not go cloud instead, there are special cost reasons in this case to go bare metal and endure the hassle.]

The ideal solution would be simple, open source, and would allow for creation of a rescue USB that could be used with the help of remote "hands" to boot and restore the server and replace corrupted partitions automatically. If the solution created periodic snapshots (nice, but not required), storage at Amazon S3 or equivalent would be ideal.

We have looked at REAR (Relax and Recover), Bacula, and Borg with no clear answers as to what might be best. We are also open to other solutions as well.

Thanks in advance for any and all opinions.