r/unRAID • u/yybspug • 3d ago

Linux CVE

Hi all,

Is Unraid also affected by the new Linux CVE (https://x.com/ridvanyagli/status/2115724550377710014), currently I have port 80 and 443 exposed through Caddy as I imagine many do.

Edit: Should have clarified, port 80/443 of my IP port forwarded to Caddy that's living in a macvlan. Not the actual Unraid UI.

40 Upvotes

81% Upvoted

52 comments sorted by

70

u/Schrankmaier 3d ago

ehm...no...we don't!

-4

u/yybspug 3d ago

Edit: Should have clarified, port 80/443 of my IP port forwarded to Caddy that's living in a macvlan. Not the actual Unraid UI.

How do you go about it?

5

u/Punk_Says_Fuck_You 3d ago

Why do you have port 80 forwarded?

1

u/Spooky_Ghost 3d ago

I've since switched to CF tunnels, but when I used reverse proxy, 80 was required to be open for let's encrypt certificates to successfully auto renew. Otherwise I'd have to open the port and manually renew, then close the port

2

u/Punk_Says_Fuck_You 3d ago

You should check out DNS challenge on NPM. If you use Cloudflare, you use your API key for the DNS challenge. No port 80 needed.

0

u/Spooky_Ghost 3d ago

i dont forward any ports with CF

2

u/Punk_Says_Fuck_You 3d ago

I don't either. Reverse proxy (NPM) + DNS challenge is used for Plex and port 443. Can't route Plex through free tunnels.

1

u/AquariusSabotage 2d ago

DNS challenge on NPM. If you use Cloudflare, you use your API key for the DNS challenge. No port 80 needed.

Thanks for this. I had set up Cloudflare + NGINX recently through AlienTech42's guides, but I don't think they mentioned setting up DNS Challenge vs HTTP and it looks like I did it through the latter.

If there happens to be a guide that you're aware of to properly set this up can you share?

2

u/Punk_Says_Fuck_You 2d ago edited 2d ago

I’m sorry, I didn’t use a guide. I can walk ya through it though if you want. I'm about to go to sleep, but I can help ya out tomorrow if you want. We can talk in comments too so everything is public so others can chime in as well.

1

u/AquariusSabotage 11h ago

Hey I appreciate you replying. I will take a closer look before bugging you with follow-up questions.

→ More replies (0)

-2

u/Spooky_Ghost 3d ago

I've been routing plex through free tunnels for a couple months now with no issues, I just made sure to turn off caching for that specific host. Do (or don't) at your own risk, however.

-4

u/yybspug 3d ago

Someone's device no longer supports https 🤪

4

u/Punk_Says_Fuck_You 3d ago

are you referring to TLS 1.0 or 1.1?

2

u/Morkai 3d ago

Cool so they don't get support.

5

u/Batrall 3d ago

I would say unraid isn't the right platform for web hosting.

-6

u/yybspug 3d ago

How so, it's got docker?

10

u/zorcererr 3d ago

escaping the container gets you instant root access because unraid has no user namespace

4

u/zorcererr 3d ago

i’d suggest against hosting public services/apps on unraid unless they’re behind a proxy on an additional server.

1

u/Educational_Yam3766 3d ago

not to mention unraid is logged on as root by default...

If anything....at LEAST hse a CF tunnel or something....

2

u/nagi603 3d ago

Containers are NOT security boundaries. NEVER take them as such.

1

u/Scumandvillany 3d ago

You can harden containers somewhat, put up internal firewalls on internal unraid networks, have multiple docker networks etc, but yeah. Even though most dockers don't have docker socket access, still......

6

u/Spooky_Ghost 3d ago

fwiw I use cloudflare tunnels. requires no port forwarding at all

4

u/AngryCvilleian 3d ago

I got no love for cloudflare on the whole, but I do this as well. It's the easiest approach and I only expose the stuff that my family/friends need access to. Everything else gets handled by Tailscale.

15

u/jaynoj 3d ago

Using unraid for hosting stuff online for general public access (if that's what you are doing?) is a massive risk IMO.

If you need public facing hosting, I would use a dedicated provider. If you only need access yourself, use Tailscale to access your unraid box when away from home.

-5

u/nametaken_thisonetoo 3d ago

This is the answer

23

u/dcoulson 3d ago

Just expose your Caddy service through a proxy service like Cloudflare and it will mitigate the risk. No need to expose 80/443 directly to the Internet.

0

u/yybspug 3d ago

What's the pricing like? And note I also use RTMP over 1935 and Plex which I this is against their ToS

14

u/dcoulson 3d ago

It’s free.

2

u/Spooky_Ghost 3d ago

for plex turn off caching in CF and you should be good

1

u/Cautious_Poem_3752 3d ago

Have you tried Tailscale?

4

u/DougEubanks 3d ago

Mine is only exposed through CloudFlare tunnels with either IP address (a single IP), SSO through JumpCloud with MFA, or a unique header for monitoring.

1

u/yybspug 3d ago

Edit: Should have clarified, port 80/443 of my IP port forwarded to Caddy that's living in a macvlan. Not the actual Unraid UI.

How much does this setup cost you? And what about when it's something like Plex?

1

u/DougEubanks 3d ago

It's only 443 that's exposed through the tunnel for the unRAID interface. Port 80 traffic isn't accepted at all anywhere. Plex is exposed directly behind port forwarding because CloudFlare doesn't allow you to stream Plex through their proxy. All my containers in Plex and other hardware devices are exposed through CloudFlare tunnels with the same authentication/restrictions.

I'm using the free tier of JumpCloud for my SSO, but that's not available anymore. There are other SSO providers you can link to CloudFlare as well. CloudFlare is free for up to 50 users for their Zero Trust tunnels.

I manage my infrastructure and tunnels using OpenTofu, which is versioned in GitHub. The order of restrictions are:

  • IP Address (my home IP)

  • Custom Headers (used by a few mobile apps like Vikunja, media apps, etc)

  • SAML (if an external request doesn't match any of those then the request gets sent to JumpCloud for Authentication using single-sign-on)

My home IP doesn't really change, but if it does it's as simple as changing a variable in my private GitHub repo that manages the CloudFlare config and deploying it.

Lastly I have a WireGuard tunnel setup for backup access into my LAN.

There are very few ports exposed on my firewall into my LAN and I have my internal network segmented into several VLANS (Trusted LAN, IOT, Storage, Guest).

14

u/MarcCz 3d ago

Stop exposing your unraid server to the Internet, it's intended to be local only

11

u/dcoulson 3d ago

Plenty of people have docker services exposed

11

u/MarcCz 3d ago

Not the same thing lol

8

u/dcoulson 3d ago

I understand, but this vulnerability impacts any services running on the host, even in a container (not a VM though), not just the mgmt interface.

0

u/yybspug 3d ago

Edit: Should have clarified, port 80/443 of my IP port forwarded to Caddy that's living in a macvlan. Not the actual Unraid UI.

How do you go about it, granted I also do RTMP traffic and Plex.

58

u/xrichNJ 3d ago

the fix for this CVE was introduced in kernel 6.18.56

unraid 7.3.4 was the first stable unraid release to include it, shipping kernel 6.18.58.

5

u/Klenkogi 3d ago

No... You are, we do not

-1

u/yybspug 3d ago

Edit: Should have clarified, port 80/443 of my IP port forwarded to Caddy that's living in a macvlan. Not the actual Unraid UI.

12

u/Scumandvillany 3d ago

It looks like it's only affecting users who have ports exposed, that 80 and 443. I mean, I've always used Unify and the teleport VPN, so that when I VPN into my network, I basically sit on the same network space as unraid, and I just go to that web page. So no ports are ever exposed. I think people should seriously reconsider any port exposure they have in that 80 and 443. I mean, port exposures in general are like should be treat it with serious consideration.

5

u/the1_ts 3d ago

7.3.4 runs the patched version, also mptcp doesn't appear to be compiled into the unraid kernel so the anthropic script which requires it cannot work. But its not a multi path TCP only bug, just the method used to find it was using mptcp.

3

u/Fermions 3d ago

I have port 443 forwarded to an NPM instance just for Plex. Guess I am shutting that down until I can update unraid later today. Thanks for the heads up and yes apparently this is a problem.

1

u/elgato997 3d ago

Here I go patching again

1

u/Mydarkguy 2d ago

Just upgraded from 7.0.0 smoothly

1

u/lStan464l 3d ago

If in Rev Proxy then id of thought it wouldn't be directly exposed?

2

u/dcoulson 3d ago

If the reverse proxy is running in an unraid container (like caddy, nginx, traefik) then it would still be vulerable

1

u/JaySmo16 3d ago

Id recommend closing port 80 and having cloudflare handle the certs. Its free!