I install Vaultwarden (Bitwarden) on my Synology NAS

My goal

I have been using KeepassXC for months, it works perfectly, I had done a Retex on it. I set up my password manager on all my computers and smartphone

I have a problem with Keepass, which is sharing passwords. Some passwords are to be shared between me and my wife, this is not possible with Keepass. We use one database each because we have two authentication modes to open the database.

So I'm looking for a solution and Bitwarden offers it, we can create an "organization" that corresponds to the family and we can have passwords specific to each or shared passwords. Perfect, that’s what I’m looking for.

So I'm going to install Vaultwarden on my Synology NAS in a Container Manager docker. Configure a domain name for this, give it a certificate to exploit the https, choose a port other than 443 to secure a little more. Configure my router with port redirects and then configure Vaultwarden, allow it to send emails and secure use with Yubikey and Microsoft Athentificator (TOTP) … authentication.

I am installing the docker Vaultwarden

In Synology Container Manager on my Synology NAS, I go to Registry download vaultwarden/server

I take the "last" version and download.

Once loaded, I click Run

I change a few parameters as in the image above.

I quickly switch to File Station to add a vaultwarden folder to the docker folder.

If I understood correctly, using a folder created in File Station should not destroy the data if the docker is deleted, to check …

I configure the ports of vaultwarden 3012 and 3013 and its data file that I just created in File Station

I finish the wizard and then press the blue button to start the creation of the docker.

On the Container tab, perfect, a green dot indicates that it is launched.

I check that the firewall of the NAS does not block access

To ensure that the firewall on my NAS (which should be activated) does not block port 3013, I will allow it (Security / Firewall / Change rules)

then

I can check that vaultwarden starts on the ip address of my syno and port 3013

It does not suit me, I want to be able to access it from the outside, that the connection is in https and that a domain name is used instead of an IP.

I will customize my domain name

I go to External Access / DDNS / Add DDNS

I take the Synology service, everything else is simple to complete, I tick the box to get a certificate and I activate Heartbeat to be warned if there is any concern.

Creating the set takes a few minutes and here is my DDNS access created:

I check the port routings of my Router

I go to my Router, Network Center/Port Transmission and redirect ports to my NAS

The port 1999 will be the public https port that will go to the port 1999 of the NAS, I configure this manually.

The 3012 and 3013 ports are configured automatically and then the Syno NAS and Syno Router talk to each other.

I configure a Reverse proxy Synology

On the NAS, I'm going Control Panel / Login Portal / Advanced / Reverse Proxy

I take over the port 1999 which is the https port (initially 443 therefore) and send it all to the port 3013 of localhost.

My domain name is vaultwarden.xxxxxxx.familyds.com and therefore Vaultwarden joingnable on https://vaultwarden.xxxxxxx.familyds.com:1999

It is perfect, the connection works, in https with a domain name and with a valid certificate.

I activate the Yubikey service

To use my Yubikey with VaultWarden, you must activate the service and retrieve an ID and a key on the Yubico website

I'm going on https://upgrade.yubico.com/getapikey/

Just put your email, click on the Yubikey OTP box, press the Yubiket button and then validate.

I get two pieces of information

I will place these two pieces of information in environment variables.

I will configure the environment variables

Environment variables are configured in Container Manager, Containers tab, stop the vaultwarden container and go to Settings.

To allow my Yubikey key, I add these two variables:

YUBICO_CLIENT_ID: First field recover above
YUBICO_SECRET_KEY: Second field recover above

To secure my domain, I add this variable, which corresponds to:

DOMAIN: https://vaultwarden.xxxxxxx.familyds.com

To be able to send emails (more convenient to send guests and check emails)

SMTP_HOST: smtp.free.fr
SMTP_FROM: the e-mail address that will send the e-mails
SMTP_PORT: 587
SMTP_SECURITY: starttls
SMTP_USERNAME: firstname@free.fr
SMTP_PASSWORD: the account password

I create a first "family" account

In order not to give administrator access to users, I use a ‘family’ email to create a first account and organisation.

This account will have an "owner" role.

I add ‘user’ accounts with the emails of family members, everyone will then be able to validate their email and create their account. The owner profile must then accept them.

I prevent the addition of new accounts

To make it even more secure, I will block the addition of new accounts.

To this end, I am adding a new environment variable, as in the penultimate paragraph.

The variable is

SIGNUPS_ALLOWED: false

If an account is added, it will be refused:

I install the browser add-in on Brave

I will go and load the extension of my browser

https://bitwarden.com/download/#downloads-web-browser

Once installed, I have to configure the "self-hosted" server that is on my NAS.

In front of connection on I have to specify self-hosted.

I specify the https address to my reverse DNS by specifying the port.

Then, I log it with mail/password main of my user account and I find all my credentials.

I secure the family account (owner) with the Yubikey

I click Manage in front of Yubico.

I press the frame under Yubikey 1, I plug in my Yubikey, I press the button and I validate.

That’s ok, Yubikey is my second authentication.

Before leaving this screen, I generate and print the recovery code.

I secure the user account with the Yubikey and Microsoft Authenticator

The user account will be registered in the browser extension but also in the smartphone.

For example:

on the computer, opening the account with the password + the Yubikey will be the easiest.
on the smartphone, the account can be opened either via the password + Yubikey (in NFC) or via the password + Microsoft Authenticator (TOTP)

I set up a secure administration access

Vaultwarden offers an administration page, you have to secure it to use it.

A plain text environment variable may be used, but this is not recommended.

It is better to use a Hash in Argon2, so I will use the website https://argon2.online/

In this example, I use 3Mssk7Hi4cb“wzUC7fgTR as input text, click on the notched wheel to add salt to the hash, tick Argon2id and get the result “ $argon2id$v=19$m=16,t=2,p=1$c0JJWHVQamhGQzF6MXZudg$vlmd1dpgBVgwU4BM7RUUVw” is what I will place in the container environment variable (see a few previous paragraphs for explanation)

ADMIN_TOKEN: $argon2id$v=19$m=16,t=2,p=1$c0JJWHVQamhGQzF6MXZudg$vlmd1dpgBVgwU4BM7RUUVw

I access the Vaultwarden configuration page

I'm going on https://vaultwarden.xxxxx.familyds.com:1999/admin

I put the password, which is the entry text of the hash, so 3Mssk7Hi4cb“wzUC7fgTR in my example.

I walk a little in the config, it is a bit of a hidden side of vaultwarden, to discover.

I organise a backup of Vaultwarden’s data

I install Synology Hyper Backup

On my NAS, in Packet Centre, I install Hyper Backup.

I open a dedicated Dropbox with a dedicated address

I am therefore isolating this data.

I enable dual authentication for access to my new Dropbox.

I launch Hyper Backup and program the backup

I check Folders and packages then I choose the mode Dropbox

The link between Dropbox and Hyper Backup takes 2s and I'm going to choose where to backup, so I'm going to create a NAS Backup folder and a NAS directory (to stay vague about the content).