5 ESSENTIAL Tips for Security on Home Assistant

[@EverythingSmartHome]

What tips for security have you got I didn't mention here!? 👇

[@jordandeboer-piedt1468]

Another security tip would be using a DNS provider that offers sophisticated protection and firewall rules at the edge, such as cloudflare. I'm in the process of setting up local firewall rules that expect all external traffic to my homeassistant to come from cloudflare or other cloud providers I rely on such as google.

[@EverythingSmartHome]

For sure, cloudflare is excellent if you have your own domain name!

[@simongchadwick]

OpenVPN and DuckDNS (DDNS) for remote access to HA. Also I only buy Tasmota-capable and Zigbee smart devices, so no IoT device is calling a Chinese mothership. Also the Tasmota devices access an NTP server on the HA box to stay in sync. Thanks for the video!

[@EverythingSmartHome]

Good ones also! Thanks

[@kyleylin]

Reverse proxy to provide an additional layer of obfuscation on the entry point (port 80/443). Hide Home Assistant behind a normal-looking blog site for example

[@Neejoh]

+1 for a VLAN deep-dive! Awesome video, like ways. Keep it up man.

[@EverythingSmartHome]

Would love too! The only problem is everyone has different hardware, what platform are you working with?

[@RustyShackelford_]

Unify!

[@try-that]

Another Unifi and pfSense user, I have a VLAN working, but would like to learn more about setting up and using VLANs. I've not found a video that makes feel confident setting them up and your videos always strike me as easy to understand and you still have time to answer questions.

[@EverythingSmartHome]

I think we all need to petition Unifi to send me a gateway for a video 👀😂 and thanks, appreciate it!

[@try-that]

@@EverythingSmartHome Must admit I run the controller on either a PI or as I'm doing now on OMV via a container. Looks as there are a change afoot at Unifi, so you might get one, not sure it's worth it though :(

[@rajmohanjena109]

A detailed video about docker containers...Like what are docker containers..What are the pros and cons of using HA on docker containers..etc..

[@bubokroar5157]

Hey Lewis, would definitely be interested in a VLAN video. Synology user here (no native VLAN setup on my device.. yet), but I think covering it using your personal equipment would get many on the right track for digging into their own equipment. Thanks again for the great content!

[@EverythingSmartHome]

Thank you, will defineitely look into it!

[@WordupG]

@@EverythingSmartHome I agree. Would love to see your take on IOT VLAN structure. Based on your background I think it would be very useful. Thanks

[@guillaumemolter]

@Everything Smart Home I would also love a VLAN setup video.

[@TobyMole]

Was there any VLAN video since this? Would love one (preferably one that doesn't just rely on ubiquity smarts, not all of us are up for that cost!) as I'm not too knowledgeable on networking.

[@ZackBarett]

How long have you been doing this? I am looking at a professional. Great intro, love that you got straight to the point. As always great video!

[@EverythingSmartHome]

Oh man your too kind Zack, I appreciate that! First video was pretty much exactly 6 months ago, first time ever on video and it shows 😂

[@excimer78]

Enable HTTPS would be nice to have an example :D. Great video and thanks for the tips!

[@rob1971]

Thanks for the bonus security suggestions Lewis, I'm much more comfortable about enabling remote access to HA now. 👍🏻

[@rob1971]

I'll need to try and think of something other than 'mypassword' as my password now though 😉

[@EverythingSmartHome]

Your welcome! Glad it helped!

[@scoten]

2:06 Lewis: "Use strong password" 4:06 Lewis: *uses 4 character password* *facepalm*

[@EverythingSmartHome]

Was wondering when someone would notice 👀

[@markgouveia]

Will you do a video on VLAN? And what specific software equipment you personally use?

[@EverythingSmartHome]

I could but yes its very hard to do since everyone has different equipment!

[@janmagnusrkke8815]

Great video with useful tips. Considering Home Assistant itself often contains a lot of sensitive information and access, where would you put it in a VLAN network?

[@J27ODP]

You mentioned IoT at the end of your video, I'm in the process as we speak of setting up my home network after upgrading to omada equipment, router, switch and ap. What devices / device types would you reccomend I assign an IoT subnet address to? Thankyou for all your videos, I'm a Homeassistant semi-novice and you have helped and inspired a lot!

[@ABKimp]

Thank you again for a clear well explained video. Freenum seems not to work as of now. Are there any good alternatives?

[@kreambo1235]

Regarding vlans: where do you think is the best practice to put HA on? your main vlan, IoT one or seperate for itself? I'm looking into buying a Ubiquiti USG-3. Don't like its limited throughput tho with IDS/IPS but yeah, don't think I want to invest more in something like the 4 pro one or, a dream machine for an instance, for my uses. Thanks and btw great video, enabled 2FA which I didn't think is an option on HA.

[@VegascomJeff]

Great tips as a new user. Thank you!

[@EverythingSmartHome]

Thanks for the comment and support, appreciate it!

[@tony113000]

Another great Video - Thanks and keep up the good work

[@EverythingSmartHome]

Cheers Tony!

[@Shaq2k]

Nice one, thanks. But where do I check which IP's have been banned? And possibly lifting some of those bans? Thank you

[@EverythingSmartHome]

Hello! There is an IP_bans file created in the config folder once an IP is banned

[@user-zr7kz4vs7c]

Will you make a part 2 of this kind of security-related topic about Home assistant?

[@EverythingSmartHome]

Perhaps one day sure if there are more things to talk about!

[@zelial3]

Don't expose HA to the Internet. Keep it local and connect to it through a VPN.

[@amagro9495]

I think we all are now interrested to know more about the VLAN tip. You can just do a video with your setup so that we can understand better how all that works. Tks, and congrats for all your work.

[@EverythingSmartHome]

Thank you, I'll get to work on it!

[@PersonXes]

Thanks, looking forward to that. I have been holding off figuring out how to configure my ZyXEL managed switches and my unifi access points to set up vlans. Perhaps based on your example VLAN setup video I will find the courage! Setting up 2FA and IP banning was easy, thanks for the tips.

[@an_R_key]

With security, its never just one thing. The best approach is a layered one :-)

[@spattf3]

Would love to see a good primer on VLAN with Home Assistant.

[@trdsclan9061]

Could you please make a VLAN security management video for Home Assistant? That will really help protect my HA. Thanks in advance!! Best regards, Adi

[@GnobarEl]

Another great video!

[@EverythingSmartHome]

Thank you buddy appreciate it! 🙏

[@lantrosforum8350]

thanks very good job 😀😀😀😀

[@bowinkle143]

Love your videos! I feel like I'm learning from Magneto (Michael fassbinder) you look very similar!🤣 Thanks for your help👍

[@EverythingSmartHome]

Hahaha wish I had the same claim to fame but I'll take all I can get 😂 thanks Shane!

[@richf7148]

I assume that if I am using WireGuard to access from outside my home I should not need to use HTTPS nor DuckDNS, correct?

[@kjjordans]

I would love more info on the VLAN. What is the minimum or suggested hardware. I am thinking of upgrading from an ISP modem/router

[@beprivatecdblind7831]

rather than using vlan's use an enterprise firewall there are a number of free ones for home uses (such as Sophos), and setup all your IoT devices with fixed IP addresses, then you can exclude those devices you don't trust 100% from accessing the WAN. Added benefit of this is you can tell if those devices are trying to phone home. It is a pain to use fixed IP addresses but if you create a network IP address plan for your devices you only ever have to set the IP address once. Using fixed IP addresses also allows you to shut down a devices access if it has unusual traffic from your firewall.

[@glennsgrainger]

👍 great video mate

[@EverythingSmartHome]

Thanks buddy appreciate it!

[@victorstela]

Where is the VLANs video? 🤭I really want to know how you manage your iot devices on a different network.

[@rojoworst6536]

Again a very informative video for a rookie, like me. However adding your specs (2 lines about ipban) it results in a error. Saying: the login attemps line is not possible under the `http` section. How to overcome this. Thank you.

[@gordonmoll2513]

Hey Lewis, that was a really good video about setting up remote access to HA. Many months ago I got my remote access setup and it is working fine. I recently looked over my logs and saw a message to remove the base_url entry from my HTTP integration. That's when I started looking around and found your video which raise a couple questions. Q1: In your video you said that when setting up port forwarding that you could change the HA default port which would make the URL cleaner. I assume meaning to not have to include the port in the URL. I didn't do anything that I know of to change my HA default port but my 8123 port isn't open (using canyouseeme), I only have the 443 port forwarded, and I don't include a port in my URL. The instructions I followed were fairly similar to yours, except I didn't include the 8123 to 8123 port forwarding. Did I change my default somehow and how did I do that? Q2: I want to remove the base_url entry from HTTP. I currently have no URLs entered in the Configuration>General page. Is it as simple as just deleting the base_url entry and pasting the URL that was in base_url into the Internal & External spaces in Configuration>General? FYI, I'm running a supervised instance on Ubuntu on a NUC 10.

[@EverythingSmartHome]

Hi Gordon, thank you, appreciate it! That's because if I understand correctly it's because you've forwarded port 443 to 8123 which is kind of doing a translation on the fly so to speak. If you try to access it direct via the internal IP address using port 443 I would assume it wouldn't work. That's correct you can just simply remove the base URL. The internal and external URLs are required but it'd a good idea to set them

[@ewkco]

Excellent Video. Issues with 2FA and iPhone companion app. Never asked for the authentication code on iphone or ipad. Worked on both for a while. iphone stopped wotking with error: login attempt or request with invalid authentication from... Finally disable 2FA and am working again. Does 2FA work with the companion apps? Thanks!

[@ryang6672]

Would you be able to explain to how provide Admin only access for Logbook and History menus? I want to give access the sitter who I created a custom Lovelace card that they only have access too. What I just noticed is they still have access to logbook, history, maps, etc.

[@Roedy_Coedy]

My Question/Request. How do I set up Github for my config? (How do I easily share there etc?) I tried it years ago and got nowhere with it.

[@SBinVancouver]

VSC reports "Property ipban is not allowed". This because HTTPS access hasn't been enabled?

[@rajmohanjena109]

would also love to see a vid how to enable ssd boot on raspberry pi 3b...i think there are not much vid on this topic.

[@EverythingSmartHome]

Hello! Thanks for the suggestion, SSD is not supported on the Pi since they have not added support into the firmware, I think you can do it but it's very very hack and still requires the SD card to work

[@rajmohanjena109]

@@EverythingSmartHome oohh okkk then

[@openmike79]

Great tips! I found the secrets file tip especially useful. Do you know if it is possible to use the secrets file to store passwords for HA Supervisor Add-ons like MariaDB, Samba Share, or SSH & Web Terminal?

[@EverythingSmartHome]

Thanks! I'm not actually sure, give it a try!

[@joypeterson3786]

Michael, This can be done. In order to reference the secret from the MariaDB config you define the password in secrets.yaml, then do something like this in the MariaDB config: logins: - username: homeassistant password: '!secret mariadb_password' ----------------------------- The important part is to put the single quotes around the secret reference. Configuring HomeAssistant to use MariaDB also requires adding a recorder section to configuration.yaml. That section should define one property named db_url which also needs to use the MariaDB password. For that, I just defined a second secret named recorder_db_url to store the entire db_url in the secrets file and then use it as follows in configuration.yaml: recorder: db_url: !secret recorder_db_url I wish I knew a way of not having to repeat the MariaDB password in the 2 secrets in secrets.yaml for this to work, but I just got my Home Assistant blue and started setting it up today so I am new to all of this.

[@MattHawkinsUK]

The Google Drive Backup addon allows you to specify the backup password as a secrets item.

[@drooplug]

IoT devices notoriously have bad security. Having a separate vlan for them is a good way to decrease the risk of an exploited IoT device from providing access to the rest of your network.

[@johnroberts8493]

Is there an easy way to remove IP's from the blacklist? My wife is the type who'll guess at her password 20 times rather than resetting it, and I'm confident she'll blacklist our home IP, her mobile IP, and her work IP all within a few months.

[@EverythingSmartHome]

Hahaha I feel that 😂 yes there is an IP ban file created in the config folder, simply remove the ones you need to!

[@maharshi4614]

Disable ssh if you dont use or setup keys.

[@Indewolf]

I followed your instructions on using DuckDNS and Letsencrypt etc. I was able to get everything working, how do I get my GF access? She has the newest Iphone 14. I assume its an issue with the certificate requirements? I copied the fullshain pem to her IOS phone, installed the cert and still cannot get access. "Login Credentials Failed" can you help?

[@scottboyd3800]

Recommended routers and setup for vlans

[@44jese]

Hi, any tips on "login attempt failed" problem with duckdns and/or nginx? i've tried multiple different tips from internet, but with no luck. i'd like to have ip_ban enabled, but due to that problem i can't. trusted proxies / users don't seem to work. I've tried using NAT and firewall rules and i can't even remember what else i've tried but nothing seems to help. also could you make a in depth video of trusted users and how to use them? PS. your videos are great! not too fast and great explanations!

[@EverythingSmartHome]

Thanks, appreciate it! Sure I can probably help, can you hop over into the discord? It's probably easier to help there!

[@44jese]

@@EverythingSmartHome sure, do you have DC link in your somewhere? And currently i can't get to the pc but with text i can answer whenever i can :)

[@EverythingSmartHome]

It's in the description of all my videos!

[@SigertErzeel]

Where are the blocked ip addresses stored if they get blacklisted? What if your own ip gets black listed?

[@nicolasferrao3646]

What about IDS/IPS ? or NIPS

[@josephk9816]

Have you had any issues with the home assistant app and not using port 8123 for your external connections?

[@EverythingSmartHome]

I don't do this personally but in my testing no never had an issue

[@josephk9816]

​@@EverythingSmartHome Damn, away from home i can connect using a web browser but the app tells me no. Not sure what kind of weirdness is going on. Either way good video thanks for making it.

[@EverythingSmartHome]

Just checking, have you setup a proper certificate and DNS name etc?

[@josephk9816]

@@EverythingSmartHome DNS is all setup and works and my certs (where your video played a big role) works as well HTTPS FTW I can connect from other computers outside of the home no problem just the app doesn't seem to like having 2 different ports . for example if i am inside of my home i just connect to mydomain.duckdns.org:8123 if im outside of my house i use mydomain.duckdns.org:1999

[@EverythingSmartHome]

Ah I see, out of curiosity why would you use 2 different ports for internal and external? Why not just use a single port (doesn't need to be 8123) for both?

[@shaunwhiteley3544]

Vlan tutorial please 😀👍

[@EverythingSmartHome]

I'd love too! The problem is, what platform do you wanna see it on? There is no way to do one size fits all 🤔

[@shaunwhiteley3544]

@@EverythingSmartHome Sorry I don’t know enough about it to answer that 😢

[@miguelgarcia-vg1fh]

Do the vlan

[@pmurfster3007]

When using 2FA, will this stop any snapshots from being uploaded to my Google drive? Many thanks

[@EverythingSmartHome]

Do you mean 2FA on your Google Account?

[@paulmurphy3735]

@@EverythingSmartHomeMany thanks for your reply! Sorry for not explaining more clearly. If I add this extra security to HA, will it stop HA from upload any backup snapshots to my Google drive or will it work as normal? Thanks for your great tutorials 👍

[@EverythingSmartHome]

No problem just wanted to check! No there should be no issue at all that I can see but of course be sure to double check! Thanks, appreciate you 🙏

[@paulmurphy3735]

@@EverythingSmartHome Thanks very much for your time and replying back to me. ✌

[@EverythingSmartHome]

Anytime!

[@GnobarEl]

A nice tutorial would be how to setup duckdns and MQTT. Since I configured duck DNS my MQTT is no longer working and I'm not sure why.

[@EverythingSmartHome]

That's strange, what changes did you make? Did you end up using DNSmasq?

[@GnobarEl]

@@EverythingSmartHome Hello, I think it was a wrong configuration on my side. Everything looks working now. Thanks for your support.

[@EverythingSmartHome]

Glad you got it!

[@ScottSchramm]

Timestamps would help.

[@egil-andrenessmortensen3037]

I got the 403 access denied, not able to connect to HA even locally. Think it might be tip no 5. What to do?

[@EverythingSmartHome]

If you blocked yourself them edit the IP block file inside the config folder to fix

[@egil-andrenessmortensen3037]

@@EverythingSmartHome thanks for replying😁 however not able to log inn to gui, can i use console? Have no clue how to do that if possible at all

[@EverythingSmartHome]

Your welcome! Do you have SSH?

[@egil-andrenessmortensen3037]

@@EverythingSmartHome Have not installed that - so probably not. So Im screwed? :)

[@EverythingSmartHome]

Join the discord I'm sure we can help you out!

[@hillebrandstreet1882]

Hi is it possible to add my Local IP address not to get banned please

[@WeedRa1]

after restart the server for ip_ban my home assistant stop works, now i'm stucked on the page "unable to connect to HA" :(

[@EverythingSmartHome]

Did you check your config before restarting?

[@WeedRa1]

@@EverythingSmartHome yes and no error so i have restarted ha...

[@leticiaunisesky4852]

Imej itu terlalu menyinggung perasaan