We are setting up a docker registry server for our company as per these official indications: https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry.
We are evaluation what option to implement:
- More secure, less practical: Put the server in a private net behind a firewall, accessible via
ssh, and then have developers to manually open a tunnel (for example a SSH tunnel) from their homes over the world everytime they want to use it.
- More practical. Question is: More insecure? Placing the docker registry server in a public IP and protected with TLS. Developers just "push" there over a TLS channel. TLS will be build on top of keys/certificates CA'd by Let's Encrypt with a domain-verification.
For this question let's assume there are no home-residential-IP ranges allowed from the home of the developers and let's assume the server being reachable from 0.0.0.0/0
On-topic, Off topic
I already know I can improve the security by firewalling residential-home CIDRs assigned by the ISPs to the remote developers and so. That's not the topic of this question.
I want to focus the question on having a server with private data running in a public IP on a public port, and using TLS over it.
I'm a bit affraid of that. I usually had always all my ports closed to the public except for 80, 443 and 22. To administer we usually allowed SSH from anywhere without problems.
For example if I had a MySQL I had 3306 only "from the inside" and we had to connect first via SSH and then use the SSH tunelling to connect to it.
Putting a MySQL against a public IP and protected "only" with TLS goes against my inctuition. But maybe it's as secure as having the SSH and I didn't know.
I see that properly configured TLS is as secure as SSH (see similar questions here: Is connection established with two way SSL as secure as SSH?).
There is also extensive documentation on the version of TLS and so: https://en.wikipedia.org/wiki/Transport_Layer_Security
The new v1.3 finished on 2018 seems to be "ultra secure": https://www.ietf.org/blog/tls13/ can I blindly rely on it?
The word that scares most me is "properly" configured.
1) How can I know if this combination:
- The latest registry image https://hub.docker.com/_/registry (currently at the time of writing 2.7.1)
- A certificate obtained from let's encrypt with the latest available certbot in "manual mode" running the latest docker image https://hub.docker.com/r/certbot/certbot (currently at the time of writing 1.3.0)
- The instructions of merely adding the TLS certificate in the registry https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry
...how can I know if this combination protects me as much as an SSH connection does?
2) Is TLS 1.3 "Much" better than 1.2?
3) How can I know if my setup is using TLS 1.3?
4) Provided the registry will have users/passwords, setting TLS is "secure enough"?
5) Does this mean that on a hurry, if I had a DB exposed to the public but running on a TLS would it also be as secure as having an SSH there?