I have a lot of different services which I self host for me and my family like:

  • PeerTube
  • Lemmy
  • Mastodon
  • Synology NAS
  • TTRSS
  • NextCloud
  • Matrix
  • HomeAssistant
  • etc.

Right now every family member needs to create a user on each of those services and have a different password on them, which is OK when you use a Password Manager, but most of my extended family members don’t. And they often forget their password and stop using the service because they can’t figure out how to reset the password with each and every service.

I would like to try to consolidate all of it with a Single Sign-On (SSO) solution but It’s not obvious to me if there is one which is not overly over engineered for hundreds of thousands of users but small and lightweight, perhaps even easy to set up.

I tried OpenLDAP but Jesus that was very involved.

  • nickwitha_k (he/him)
    link
    fedilink
    English
    71 year ago

    I’d suggest something like Keycloak or earning the wizard robe and beard by buckling down and learning OpenLDAP. The biggest suggestion that I have though is to have a disaster recovery plan for even your auth system goes down. Don’t be like Facebook and lock yourself out without any hope of regaining entry (or, if you’re a fan of Russian Roulette, do).

    • Deebster
      link
      fedilink
      English
      11 year ago

      What’s your DR plan? My “plan” is to SSH in and figure out what’s wrong.

      • nickwitha_k (he/him)
        link
        fedilink
        English
        21 year ago

        I’m still trying to cover up with a good one to allow more self-hosting. Probably a SHTF security key kept in a safe that can be used with physical access.

        My “plan” is to SSH in and figure out what’s wrong.

        The problem here being that you have a circular dependency:

        1. SSH auth requires OpenLDAP/Keycloak
        2. SSH access is required to fix broken OpenLDAP/Keycloak
        3. GOTO 1
        • Deebster
          link
          fedilink
          English
          21 year ago

          My SSH auth uses SSH keys stored in authorized_keys, but I see your point. For me, OpenLDAP will be letting users in to the various services and SSH is outside that. I suppose SFTP could be something I want, but I’d be tempted to put a new sshd inside a container and have it more restricted than the system one.

          I think the backup key idea is definitely the most broadly applicable, but there’s physical/KVM for a more old school access route.

          • nickwitha_k (he/him)
            link
            fedilink
            English
            21 year ago

            That makes sense. I like the idea of combining physical key with physical/KVM access so that there is no password auth (at least, not without a second factor).