I have a Jellyfin server, NextCloud instance, etc that I share with friends and family. Currently, I serve them over the open-internet using Cloudflare tunnels. Obviously this has some security implications that I don’t love. Also recently one of my domains got flagged as malicious by google and now Chrome browsers won’t go to the site - annoying.

I use Tailscale already to access my server infra remotely, but honestly I don’t see this as a viable option for my non-technical friends and family. Plus, I need to support all kinds of devices like smart tvs. How do you fine folks deal with this issue?

  • Strit
    link
    fedilink
    English
    31 year ago

    I share my Home Assistant with family, Nextcloud and Jellyfin with family and friends and websites/blog with the entire world.

    I do it with a domain and a subdomain for each service. Each website/service has it’s own Let’s Encrypt SSL cert managed by Traefik. So all the family members and friends need is the URL and usernames and passwords. Like any other service. I don’t know what you did to become flagged as malicious by Google, but my services have run for years without such an issue. So maybe it’s just time to switch to a different domain name?

    • lemmyvore
      link
      fedilink
      English
      31 year ago

      I don’t know what you did to become flagged as malicious by Google

      My dynamic public IP recently got flagged by Google and it wouldn’t allow logins to any Google accounts coming from my home, even with multiple correct authentication factors. We could connect though the data plan on our phones without a problem because they got (other) IPs from the mobile carrier, but not through the home ISP. We got security emails asking “is this you?” but confirming did nothing. It went away only when the ISP cycled to another of their public ranges.

      • @Haui@discuss.tchncs.de
        link
        fedilink
        English
        11 year ago

        Might be way off here but have you checked if you actually got hacked and they just didn’t destroy anything?

        • lemmyvore
          link
          fedilink
          English
          11 year ago

          I would entertain the possibility if there was any sign, or if I knew how Google takes these decisions.

          • @Haui@discuss.tchncs.de
            link
            fedilink
            English
            11 year ago

            Honestly, I would just take this as an indicator of something fishy going on. Either google crawled your ip and found things it didn’t like or stuff came out of it to google. Either a scripted action (which looks malicious from the outside) or advertising emails. Your logs should at least tell you if there have been any suspicious logins on any of the exposed services.

            • lemmyvore
              link
              fedilink
              English
              11 year ago

              That’s the thing, the only thing I have open to the Internet is a port forwarded SSH with non-root key authentication, into an up-to-date Debian stable. The logs show no attempts. The odds of someone breaking into public key OpenSSH and getting root, with daily security updates, are rather slim IMHO. The router is also an attack surface but it runs up to date OpenWRT.

                • lemmyvore
                  link
                  fedilink
                  English
                  1
                  edit-2
                  1 year ago

                  No problem, you made a good point.

                  In any case, my main beef was that relying solely on IP is a pretty shitty way to deal with this on Google’s part. They make you jump through hoops and establish over half a dozen ways of proving who you are (user & password, secret question & answer, secondary emails, OTP codes, secondary auth codes, phone SMS, phone confirmation – which are behind phone unlock) and none of that matters when they don’t like your current IP? Then what are they for?

    • @nopersonalspace@lemmy.worldOP
      link
      fedilink
      English
      11 year ago

      I use cloudflare’s firewall for some security rules, one of which was to block “known bots/scrapers”. This was blocking Google from accessing/scraping my site, and my theory is that they flagged it just because of that. I’ve turned it off for know, so we’ll see.