Hacker News Reader

Comment by mmcnl | Hacker News Reader

I have Authelia running for 2+ years already. I configured it with LDAP using "LLDAP" [0], a lightweight LDAP implementation. I then use Caddy as a reverse proxy and integrate it [1] with Authelia. This works great. I have solid 2FA for all my services and I feel my self-hosted applications are secure enough to be accessed without VPN. My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns.

[0] https://github.com/lldap/lldap

[1] https://www.authelia.com/integration/proxies/caddy/

View on HN

> My only concern is that Authelia hasn't had a new release for more than a year, which raises security concerns.

I'm a bit concerned about that too. When setting it up, I found a lot of their docs on github mentioned they have `template` and `expand-env` "configuration filters", then it took me entirely too long to realize that while the 4.38 pre-release notes, posted in January 2023, say it's "just around the corner", it's still being worked on.

Having said that, there still seems to be somewhat active development. It may just be one person at this point.

https://hub.docker.com/layers/authelia/authelia/v4.38.0-beta...

https://github.com/authelia/authelia/commits/v4.38.0-beta3/

It's me and two others though I'm definitely the most active. We put a lot of effort into security best practices and one of my co-developers is currently reviewing the 4.38.0 release. It's a fairly major release with a lot of important code paths that have been improved for the future.

Our official docs can be found at https://www.authelia.com and you can find docs for a particular PR in the relevant PR. We've also linked the pre-release docs in the pre-release discussions which can be found here: https://github.com/authelia/authelia/discussions/categories/...

Hey one of the Authelia developers here. We're very actively working on a very large release (it's just going through the peer review process and it should be good to go) and we currently have a pre-release for users to dive into.

I can understand the security concerns but we are regularly taking measures to ensure no zero-day vulnerabilities exist, there are no known vulnerabilities with Authelia at the present time either directly or via the code-paths of dependencies we actually use.

That's great to hear, I have no plans on moving away from Authelia. I love its simplicity.

Newest arch package is just over 4 months old - Last Updated: 2023-10-09 03:25 (UTC): https://aur.archlinux.org/packages/authelia

That's not a new release of authelia. Authelia's releases are at https://github.com/authelia/authelia/releases

The updates to the AUR package were not about new releases since 2022:

  aur/authelia $ git log ad4e6ca^..HEAD
  2c5029d (2023-10-09) Amir Zarrinkafsh ECDB8EF9E77E4EBF (HEAD -> authelia, origin/authelia) Fix frozek lockfile issue with pnpm
  246d77c (2023-01-22) Amir Zarrinkafsh ECDB8EF9E77E4EBF Utilise pnpm instead of yarn
  ad4e6ca (2022-12-21) Amir Zarrinkafsh Update to v4.37.5

I stand corrected, thanks!

If you'd like a newer build of the pre-release they are available. Feel free to reach out on GitHub Discussions (may not see it here but see how we go).

Reply on news.ycombinator.com