My personal start point was the excellent tutorial from Rusty on the initial setup of Vaultwarden. You would be right in pointing out that DSM includes Auto block functionality, as per:Īlas, this will not work for Docker containers, so I believe the fail2ban solution is a useful addition to protect your vault. If you have a clever router with some kind of intrusion detection system inside, then perhaps you do not need this, however my Unifi USG kills the throughput with this switched on so I do not use it. For me, if Security is supposed to be multi-layered, then I'll try and do that.īy the end you should be able to: disable signups to Vaultwarden, use 2FA, enable emails from your Vaultwarden vault and have some protection against brute force attacks. Some say that with https and 2FA you do not need anything else. As to whether all this is necessary, I do not know. This page is quite long and not as simple as the Rusty tutorial. I do not include all the points here, because some of it I do not understand, although I have picked out what I can and offer it, in the hope that your personal Vaultwarden solutions can become a little safer. If, by chance, you have never looked at the truly excellent Vaultwarden wiki then this is my attempt to publicise the effort that clever people have put in to explain and document their work.

Job done, without any attempt to further secure it. In the Real World away from forums and the like, I have exactly two friends who have installed Vaultwarden on their NAS and they each found a basic tuto in their native tongue and followed it. I have the view that (a) my password manager is THE most important content in my digital life, and (b) I am by no means an expert in software or digital security, so therefore I have to do what I can to protect My Secret Stuff from nefarious persons.

Finally a direct contribution to This Place, I would like to give some hints on making your Vaultwarden install a little more secure.

Vaultwarden docker