78
What's the security situation when opening a jellyfin server up for casting? (feddit.nu)
submitted 11 months ago by to c/selfhosted@lemmy.world
74 comments fedilink hide all child comments
 

when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.

what's the recommended way of doing stuff like this? ideally i want to be able to go to someone's house and just play some of my media on their tv.

not that any of this is doable in the near future, since i'm behind cgnat and won't get my colocated bounce server up until spring.

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 11 months ago (2 children)

Okay thanks for mentionning overblown paranoia, that's what I have.

What kind of exploitable server misconfigurations are we talking about here?? Brute forcing won't work because fail2ban, right? I'm a noob and deep down I'm convinced that my homeserver is compromised and has beenpart of a bitcoin mining farm for years... Yet, not a single proof...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago (1 child)

    my homeserver is compromised and has beenpart of a bitcoin mining farm for years

    The very first Linux server I deployed on a VPS was hacked almost immediately because of my ignorance. The bot gained entrance, and they supplanted a miner rig. Now, on a tiny VPS, it's pretty easy to tell if you're running a coin miner because all of the resources will be pegged. However, I got to thinking, on a corporate server, if they did manage to do this, it would almost be undetectable until someone started reviewing logs.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •