78
What's the security situation when opening a jellyfin server up for casting? (feddit.nu)
submitted 11 months ago by to c/selfhosted@lemmy.world
74 comments fedilink hide all child comments
 

when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.

what's the recommended way of doing stuff like this? ideally i want to be able to go to someone's house and just play some of my media on their tv.

not that any of this is doable in the near future, since i'm behind cgnat and won't get my colocated bounce server up until spring.

you are viewing a single comment's thread
view the rest of the comments
[–] 15 points 11 months ago (26 children)

Dumb question: why does everyone is so terribly afraid of opening stuff to the internet ? What's the scenario?

  • permalink
  • fedilink
  • source
  • hideshow 26 child comments
    •
  • [–] 53 points 11 months ago (2 children)

    Allowing external access to your services means that any misconfiguration or bugs can be exploited to gain control of your machine(s).

    Once that happens they can be fucked with, your data stolen, your resources co-opted for someone else’s use, etc. and often times it can be made to look as though whatever bad shit it’s doing is your doing.

    So, understand your security posture. You can’t be too careful. Taking over weak or exposed machines is a global industry now.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago

    But you can, in fact, be too careful. Availability is one arm of the security triad.

    If whatever complex configuration you have set up to avoid exposing something to the Internet is incompatible with something and what you wanted to do can't be done, or if you look and see that setting all that up would be too hard and don't bother to expose the service at all, then your security posture is incorrect because your service is just as unavailable as if someone else broke it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] [S] 13 points 11 months ago (11 children)

    i've set up servers with static ips in datacenter settings before. the way you know you're online is usually that your cpu activity jumps a few percent from all the incoming ssh traffic from russia and china. i don't want to risk anything happening to my home server.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 5 points 11 months ago (10 children)

    so fun to look through the ssh log and see hundreds of attempts...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 2 points 11 months ago (9 children)

    Quick question: If I look through the ssh log and I don't see the hundred of attempts, what could be going on?..

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 5 points 11 months ago (1 child)

    I am not sure lol. perhaps your ssh port isn't exposed to the internet, or maybe the bots are just ignoring you? maybe your hosting provider has some sort of security process to reject those attempts preemptively?

    I have no clue

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 11 months ago (6 children)

    Are you not actually open to the public internet? Is it running on a nonstandard port? Is it already pwned and something is scrubbing logs?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 11 months ago (5 children)

    Non standard port. But aren't secret chinese hack farm scanning wider than just 22 ? I don't know and deep down believe that it's pawned and scrubbing logs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 11 months ago (4 children)

    The resources required to port scan every port on every IP is generally not worth it. AFAIK they tend to stick to lower ports or popular ports. Unless they're intentionally targeting a specific IP or IP range, they're just looking for low hanging fruit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 11 months ago (3 children)

    Low hanging fruits are, in my personal case, pictures of my cats and public domain cultural artefacts.

    Industrializing hacking of random servers sounds like a shitty idea at the end of the day...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 11 months ago (2 children)

    The ability to generate a bunch of traffic that looks like it's coming from legit, every-day residential IPs is invaluable to disinformation campaigns. If they can get persistence in your network, they can toss it into a bot net which they'll sell access to on the dark web.

    A sucker opens insecure services to the open internet every day, that's free real estate to bot farms. Only when the probability of finding them is low enough is it not worth the energy/network costs. I think hosting on non-standard ports is probably correlated with lowering that probability below some threshold where it becomes not worth it...don't quote me, though.

    At the end of the day, the rule is not to depend on security by obscurity, but that doesn't mean never use it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 11 months ago (1 child)

    This whole thread (that I shamelessly hijacked) is very informative and allowed me to understand that cybersecurity is in practice a mixture of concrete nerdy log books and vague feeling of being under a threshold of worthiness.

    I woke up this morning and there was a faint noise coming from the server: immediately thought "ok that's it, it's pawned and become a node in a vast grid of malicious bots"....it was a cron verification of drives

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 11 months ago

    Hah yeah, I've definitely pulled the plug on my router before because I wasn't sure what I was seeing.

    I mean, cybersecurity I would consider to be a research field. In practice, yeah, it's a bunch of people just doing their best.

    I tend to keep everything inside my network and only expose what I need visible on non standard ports, one of those being a VPN. It's not that I couldn't run these services public facing, it's that the people taking the time to constantly update, configure, and auditing everything full time to head off red team are being paid. I don't need to deal with an attack surface any larger than it needs to be, ain't nobody got time for that.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 6 points 11 months ago* (last edited 11 months ago) (2 children)

    I'm paranoid dude, I don't need the whole world judging my awful taste in TV shows!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago

    I set up Jellyseer so my friends can request whatever. Just blame your full collection of My Little Pony and Gilmore girls on that one friend from Finland (unless you're in Finland, and then use Greece).

  • permalink
  • fedilink
  • source
  • parent
  • [–] 10 points 11 months ago (3 children)

    Missconfigurations allowing bots and shit hacking you. Overblown paranoia mostly if you just take some precautions

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 11 months ago (2 children)

    Okay thanks for mentionning overblown paranoia, that's what I have.

    What kind of exploitable server misconfigurations are we talking about here?? Brute forcing won't work because fail2ban, right? I'm a noob and deep down I'm convinced that my homeserver is compromised and has beenpart of a bitcoin mining farm for years... Yet, not a single proof...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago (1 child)

    my homeserver is compromised and has beenpart of a bitcoin mining farm for years

    The very first Linux server I deployed on a VPS was hacked almost immediately because of my ignorance. The bot gained entrance, and they supplanted a miner rig. Now, on a tiny VPS, it's pretty easy to tell if you're running a coin miner because all of the resources will be pegged. However, I got to thinking, on a corporate server, if they did manage to do this, it would almost be undetectable until someone started reviewing logs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •