What type of security should I set up for a domestic webserver?

Question

I have set up a custom webserver hosted on a Raspberry Pi on my home local network. The web app requests a single web page from the server via HTTP, and then sends user commands and receive information via websockets.

For now, I have only used the app within my (cable) local network and there is no security implemented at all, but I want to open the port to the Raspberry in my router to be able to connect from the outside world.

My requirements are that:

1. Commands should not be sent by someone without credentials
2. System information should not be read by someone without credentials

What should I set up to achieve such requirements? Is SSL required? If yes, could I use a self-signed certificate?

Answer 1

Yes, SSL will be necessary (well... technically, you can reimplement all your encryption need in the application layer, but it'll be very, very hard, it'll be much easier and more secure to leave writing the the encryption layer to the experts).

Yes you can use self signed certificate for this purpose since you control both the server and client.

However, server side SSL isn't sufficient for authentication. You'll either need to add authentication (e.g. some sort of Bearer token or HTTP Basic Auth), or use SSL Client certificate (mutual authentication).

Alternatively, you can use a Intranet VPN (not to be confused with Anonymizing VPN) to solve the encryption and authentication problem. Instead of trying to solve the prosblem at the endpoint level, instead you setup your own private VPN Intranet to connect to your LAN remotely.