35
Nginx Proxy Manager 2.13.6 Released With Built-In Two-Factor Authentication (linuxiac.com)
submitted 1 day ago by cm0002@infosec.pub to c/opensource@programming.dev
8 comments fedilink hide all child comments

Nginx Proxy Manager, a popular web-based and user-friendly reverse proxy management interface for Nginx, has just released version 2.13.6. Although this is only a patch release to a minor version, it actually delivers some fairly significant improvements.

The most notable change is the addition of TOTP-based two-factor authentication, allowing administrators to protect access to the web interface with time-based one-time passwords, bringing a long-requested security feature to Nginx Proxy Manager.

Certificate management has also been expanded. When creating new certificates, users can now explicitly choose between RSA and ECDSA key types, offering greater flexibility depending on compatibility or performance requirements.

you are viewing a single comment's thread
view the rest of the comments
[-] cm0002@infosec.pub 4 points 1 day ago

That's one problem it solves, but NPM is really just a frontend for Nginx Reverse Proxy.

And a reverse proxy is one of the basic security steps you need to take when exposing something to the open Internet. You want everything forwarded through it and spend most of your time hardening it and the server it's running on (and it should be the only thing running on that server, all other services should be running elsewhere, ideally)

[-] qualia@lemmy.world 1 points 10 hours ago

Crap, I'm in the process of setting up a headless Ubuntu server on my desktop to eek the maximum amount of CPU/GPU/RAM out of it for AI stuff and was planning on controlling it via my laptop.

I don't particularly care about privacy on that desktop, but would my ignorance of security hardening open me up to rogue hackers using my machine for their own purposes if I were to set it up so I could control it remotely (not just hardwired)?

[-] cm0002@infosec.pub 2 points 10 hours ago

For just one person limited use like that, i'd just use a VPN for whenever you're away from home.

But you could learn a bit about hardening and expose it anyways if you want, I personally just want to be able to access my stuff from anywhere so I spend a decent amount of time hardening.

It's not too hard, you really just need a certain baseline to defend against script kiddies and bot mass scanners. Unless you're a business or a high value target or something that'll attract the skills of "real" hackers

this post was submitted on 14 Jan 2026
35 points (100.0% liked)

Opensource

4789 readers
121 users here now

A community for discussion about open source software! Ask questions, share knowledge, share news, or post interesting stuff related to it!

CreditsIcon base by Lorc under CC BY 3.0 with modifications to add a gradient

⠀

founded 2 years ago
MODERATORS
pylapp@programming.dev