Skip to main content

Security Best Practices

Your PCS runs real services on the public internet. This guide covers how to keep it secure.

Authentication & Passwords​

Use Strong Passwords​

Your PCS password protects access to all your apps and data. Make sure it's:

  • At least 12 characters long
  • A mix of letters, numbers, and symbols
  • Not reused from another service

Change your password from the CasaOS dashboard → Account Settings.

SSO (Single Sign-On)​

Your PCS uses Dex as an SSO provider, backed by CasaOS for credentials. This means:

  • One set of credentials for all apps (admin panel, CasaOS, and SSO-enabled apps)
  • Apps protected by AppShield require SSO login before access
  • Unauthenticated apps (like Docusaurus for public documentation) are accessible without login
tip

Review which apps have AppShield enabled. Public-facing apps like documentation sites or blogs don't need it, but admin interfaces and personal data apps should always have it.

SSH Access Management​

Principle of Least Access​

By default, your PCS has one admin SSH account. Follow these rules:

  • Keep support access disabled unless you're actively working with Yundera support. Enable it from Admin Panel → Access only when needed, and disable it when done.
  • Monitor login history regularly from Admin Panel → Access → Recent Login History. Look for unfamiliar IPs or failed login attempts.
  • Use SSH keys instead of passwords when possible. Keys are more secure and can't be brute-forced.

Adding SSH Keys​

To add your own SSH key for passwordless login:

  1. Go to Admin Panel → Terminal and connect.
  2. Add your public key: 
    echo "your-public-key-here" >> ~/.ssh/authorized_keys
  3. Verify the key was added from Admin Panel → Access → Host Accounts & SSH Keys.

Monitoring for Intrusion​

Check the Recent Login History on the Access page regularly. Warning signs:

  • Multiple failed login attempts from the same IP — potential brute-force attack
  • Successful logins from unfamiliar IPs — possible unauthorized access
  • Login attempts at unusual hours — may indicate compromised credentials

Network Security​

HTTPS Everywhere​

Your PCS enforces HTTPS on all connections through Caddy. This means:

  • All traffic between users and your PCS is encrypted
  • HTTP requests are automatically redirected to HTTPS
  • Certificates are managed automatically (Let's Encrypt for sslip.io, internal CA for nsl.sh)

Cloudflare Protection​

If you're using a custom domain, Cloudflare proxy mode (recommended) adds:

  • DDoS protection — Cloudflare absorbs attacks before they reach your PCS
  • IP masking — Your PCS's real IP is hidden from visitors
  • WAF (Web Application Firewall) — Blocks common web attacks
  • Rate limiting — Prevents abuse of your services

See Custom Domain for setup instructions.

Firewall Basics​

Your PCS needs these ports open:

PortProtocolPurpose
22TCPSSH access
80TCPHTTP (redirects to HTTPS)
443TCPHTTPS (all web traffic)

All other ports should be closed. If your PCS is behind a home router, only forward ports 80 and 443. Don't forward port 22 unless you need remote SSH access.

Data Protection​

Regular Backups​

The most important security measure is having recent backups:

  • Create backups from Admin Panel → Apps before any changes
  • Keep offsite copies (see Backup & Restore)
  • Test restoring from backups periodically

App-Level Security​

Each app has its own security considerations:

  • File storage apps (Nextcloud, Seafile) — Enable 2FA if available
  • Media servers (Jellyfin, Plex) — Set up user accounts with appropriate permissions
  • Photo apps (Immich) — Review sharing settings to prevent unintended public access
  • Documentation sites (Docusaurus) — If public, ensure no sensitive information is published

Software Updates​

Keep Your PCS Updated​

Your PCS runs nightly maintenance that checks for updates. Make sure:

  • The nightly schedule is enabled (check Admin Panel → Health)
  • The update channel is set to Stable (recommended)
  • You don't set the schedule to disabled unless you have a specific reason

Update Apps Regularly​

When CasaOS shows update notifications:

  1. Create a backup first from Admin Panel → Apps
  2. Update the app from CasaOS
  3. Verify the app works correctly after updating

Security Checklist​

Run through this checklist periodically:

  • Password is strong and unique
  • Support SSH access is disabled (unless actively needed)
  • Recent Login History shows no suspicious activity
  • Nightly maintenance is running successfully (check Health logs)
  • Update channel is set to Stable
  • Recent backups exist for all important apps
  • Custom domain uses Cloudflare proxy mode (if applicable)
  • No unnecessary ports are forwarded on your router