from CorrectAlias@piefed.blahaj.zone to selfhosted@lemmy.world on 27 Jun 08:00
https://piefed.blahaj.zone/c/selfhosted/p/838298/vaultwarden-while-allowing-family-emergency-access
Hi everyone.
Given some recent.. issues with Bitwarden’s leadership, I’ve been toying with Vaultwarden. It’s been great, and supports pretty much everything I need.
I currently locally host the vault, but I’m realizing that this could cause problems for my family if something were to happen to me. While not technologically inept, if my server at home crashed they would have no idea how to access it, and they would lose all of the passwords.
I was thinking that a vps might be a better choice for this, possibly with some reboot automation in case of outages. That would allow them enough time to initiate the emergency access and import everything before anything happens to the passwords.
I’ve also got encrypted M-disc backups of the most important passwords with timestamps of when they were last set. I’ve demonstrated and written down instructions on how to decrypt these. Of course I also have other backups, but I doubt they’d be able to retrieve the non-physical copies of the backups.
Anyway, is that what most people here do with Vaultwarden, use a VPS with mTLS or VPN? To add, I would only use a tunnel for this if I go this route, so no open ports.
threaded - newest
I have vaultwarden on my home server and I usually visit it through it’s Webinterface because the bitwarden addon for my browser breaks all the time with my vaultwarden instance.
I also have tailscale and a Headscale server so access should be VPN level secure.
I’m gonna be honest, it’s quite inconvenient sometimes but it’s an ok working setup.
The addon issue gives me the most headaches because it means I have to login like 10 times into the web ui and then search through the passwords every time I am building stuff on my servers.
Interesting, I haven’t had an issue with the browser extension (yet). Have you considered the emergency access to your vault, or are you just letting it ride?
I checked whether I can access the data on my disk with master password and I can, so I just setup periodical disk backups. Good enough for me, idk if that’s what you mean with emergency access though.
A VPS is going to have all the same problems as a local server in terms of inexperienced users, and will also add all the extra hassle of managing and paying for the VPS account.
I would say the best options for emergency access are local backups and documentation, which you already have. You could also consider keeping additional copies of essential passwords (like email accounts etc) in a simpler vault like Keepass. Or even physical copies written down in a security envelope in a safe.
+1 for simple. Something you don’t need to host.
A VPS is like 5 bucks. Which isn’t nothing but when used as a redundancy or place to send (reasonably sized) backups, it’s cheaper than most alternatives. It’s also still a form of “self hosting”, at least for me.
Exporting, maybe on a schedule, to a keepass to keep somewhere, also works of course. But when hosting the only/main instance at home you’ll have at least one single point of failure, most likely many. Internet connection, server, network/switches, …
You are running into the ultimate, and ultimately unavoidable, limitation of self-hosting, which is the self.
You should run a VM on the VPS for Vaultwarden, with no other services in the VM except whatever you need to connect to it remotely. Keep it simple. Run an exact copy of the VM on your local server. Have the VPS instance push its database to the local instance regularly, to keep up with any changes that your users make. Make regular backups of the local instance.
When you need to update the software, freeze an image of the local VM and then update the local VM, then when you’re sure it’s stable, copy the updated local VM to the VPS. If either the local or VPS instance crashes out, you should be able to recover (or reproduce) one from the other.
In the end though, it is functionally impossible to ensure reliability by yourself. Hosting Vaultwarden on a VPS shifts the responsibility for running the underlying server and network connection to the provider, and probably removing the dependence on your residential network connection will be better for your family/users.
You are still the weak point in your system. You need someone else who can log in to your local server, and into the VPS, and perform recovery if needed. There is no technical solution for this. You cannot be the sole admin, and also ensure reliability for other users.
This is gonna sound obvious, but setup periodic exports of your vault. Run everything locally and secure the exports
If you host it on a VPS and stop paying the invoices, it’ll go down anyway. However, AFAIK, Bitwarden client apps cache all passwords - so your family would still be able to access them, but there would be no sync back, of course.
Have you considered using something like a KeePass database on a shared drive? Most modern client apps can sync changes seamlessly and there are browser plugins for all the major browsers.
I run Vaultwarden on a VPS for some family and friends, along with a few other services. The way I have dealt with this is a physical printed out letter that explains the basic setup, where my digital notes/config/dockerfiles are, and most importantly what bills need paid to keep it all running. Next to that is a sealed envelope with recovery passwords to my vault and some other things.
Both of them are kept next to my will in a filing cabinet, so that if I’m hit by a bus my family will have the info on what to do. The system is stable and the bills are on autopay, so they won’t have to immediately deal with it, but the instructions are there when ready. As part of it I have designated a friend as my “digital executor” to follow the instructions.
The general outline of the letter is:
KISS: Just use something that works using files like KeePass and sync it via WebDAV, OneDrive, Floppy disks or whatever.
I’m not sure why anyone - to this day - keeps using these hosted/remote password manager crapware in the first place.
Autofill, easy sync, password generation, browser extension, mobile app, ease of use to name a few.
Cool, cool. Keepass(XC) has exactly the same features.
All my passwords my family would need from me are in the shared org. I have a document that outlines what they should do if something happens to me. It basically says, shut the servers down, and here is where all the money is and here’s my will.
Also included in the document is instructions that they should export their vault from the bitwarden app, create an account on bitwarden.com and import it.
The bitwarden app actually caches the vault. So they should be able to export it even if your server is down.
Honesty you could just write stuff down and put it somewhere safe. Don’t overcomplicate what could be a simple solution.
A well labeled sealed envelope in a small fire safe with short, clear instructions on how to get into everything you want them to. Ideally, simple enough for them to follow, but expect they will ask someone for help. Open it and update it every few years.
I never get this problem..? Download the backup file and encrypt it and be done. Family has the file and/or the password, done.
This really isn't a technical issue, it's more an estate planning issue.
The basic concern is if you die, everyone gets locked out. That is where a will, safety deposit box, and named executor come into play.
Whatever credentials and guides needed can be safely stored and upon death that will activates and the executor hands over the access to whoever you are needing. The safest assumption to make in these scenarios isn't that someone won't know how to access the information, it's that they won't even know that information exists.
You also have to remember that there is a lot of things to do after someone dies and that these people would also be mourning. So, with that consideration in mind, try to make the process as seamless as possible. Off-loading to an executor of the estate (someone who is not family) also lets those people close to you mourn without having that final burden.