78
What's the security situation when opening a jellyfin server up for casting? (feddit.nu)
submitted 11 months ago by to c/selfhosted@lemmy.world
74 comments fedilink hide all child comments
 

when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.

what's the recommended way of doing stuff like this? ideally i want to be able to go to someone's house and just play some of my media on their tv.

not that any of this is doable in the near future, since i'm behind cgnat and won't get my colocated bounce server up until spring.

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 11 months ago* (13 children)

The default configuration for Jellyfin is good. I mostly mean as long as you follow best practices in general you should be fine, eg:

  • You keep your system and jellyfin updated;
  • have some type of firewall in place;
  • make sure you aren't accidentally exposing jellyfins port directly to the internet;
  • have a good password for your jellyfin accounts that are able to login from outside the LAN;
  • and so on and so forth

https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/

A firewall is probably the most important, having your ssh port blocked in the firewall being second.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [–] 9 points 11 months ago (3 children)

    Also, don’t use the default “data/media/{library name}” (or whatever the suggested format is) folder setup that the Trash Guide has you set up. At least change the “tv”, “movies”, etc name to something different. Jellyfin has a known vulnerability where an attacker can get access to media without valid credentials if they already know the file path. Jellyfin devs have stated that they have no intention of ever fixing this, because it would require completely divesting from the Kodi branch that everything is built on. And since everyone follows the Trash Guide to set their *Arr stack and library up, guessing file paths is laughably easy.

    You’re using the suggested file naming in your *Arr stack, so Jellyfin can automatically match media? Congrats, so is everyone else. You’re using the suggested folder layout so your *Arr stack can use hardlinks? Congrats, so is everyone else. At least change the library folder names. Since your library folder doesn’t need to match the name of your Jellyfin library, you can literally have your “tv”, “movies”, and other folders be named whatever you want. Hell, name your tv folder “peepee” and your movies folder “poopoo” for all I care.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 11 months ago (8 children)

    having your ssh port blocked in the firewall being second

    So like if I want to access my PC from outside, is it enough that I don't have a firewall installed but that I open up some random port and redirect it to my PC's port 22, and then connect to it via the random port?

    make sure you aren't accidentally exposing jellyfins port directly to the internet

    Same thing for Jellyfin?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 1 point 11 months ago* (last edited 11 months ago) (7 children)

    If you don't want to worry too much, you can setup a vpn (like wireguard) on your server for ssh access.

    Using a non standard port is a good idea, but not entirely foolproof because bots might still port scan (even if unlikely that they do that for ssh I'm not sure). At a mininum, you probably want to use keys for login like the other commenter on the main comment said.

    Personally, using a vpn for when I want access to SSH when I'm out is worth the couple hours setting it up the one time (very simple setup with wireguard-easy for example). Maintenence time spent on upgrading is very low.

    (Tl;dr personally I'd use a vpn to access ssh specifically rather than exposing it to the internet)

    Same thing for Jellyfin?

    Not 100% sure what you mean, but to clarify: Don't accidentally expose jellyfins port to the internet (eg the default port 8096). Make sure it is only accessible from outside your network through your reverse proxy.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 11 months ago* (6 children)

    Could you explain a bit more?

    Like, right now, I have two machines on my local network. Both are running sshd on port 22.

    In my router, I've set the port forwarding to be some high port number in the 19000's to forward to port 22 on the first machine, and then the same high port number incremented by one (1) to forward to port 22 on the second machine.

    Also key based login only of course.

    Is this insecure in some way?

    Would a VPN make connecting to my computers more secure somehow? I'm not sure I understand how if so.

    What I meant with the Jellyfin question was kind of, how is having it exposed via a reverse proxy different from exposing its port right away? Is it because the only allowed connection would be HTTPS/encrypted etc, maybe?

    I've never set up a home network apart from physical cables and using routers and switches before, no advanced site/network configuring. Definitely interested to learn more though for when I want to serve a real media center using a NAS and like a Pi.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 11 months ago (5 children)

    Your SSH setup is good.

    ssh is a very resilient piece of software so I doubt with your setup you would encounter any issues.

    Enforcing use of a VPN to get into your network before being able to ssh into a machine is mostly just an extra layer of defense, though using a non-standard port, only allowing key logins and disabling root user login are all layers of defense you have already added.

    I thinj you'll be fine, but if you are worried, you could setup a VPN or alternatively something like Fail2Ban if you notice any brute-force attacks (which may be unlikely with the use of a non-standard port).

    What I meant with the Jellyfin question was kind of, how is having it exposed via a reverse proxy different from exposing its port right away? Is it because the only allowed connection would be HTTPS/encrypted etc, maybe?

    It's down to how secure the software is really.

    Jellyfins (and other software) don't use really secure web servers for getting themselves accessible via the network.

    Caddy (a reverse proxy, for example) is made to be exposed to the internet and so it is more resilient and safe to use.

    So putting the resilient software (a good reverse proxy) infront of Jellyfin (or most other software) simply increases your security by having the more safe web server be the one interfacing with end users.

    Have fun on your journey!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 11 months ago (4 children)

    Okay cool, thanks for that follow-up and confirming my SHH setup seems reasonable. 🙏

    There's one thing I don't really get though, with the whole reverse proxy thing and how that's supposedly safer:

    putting the resilient software (a good reverse proxy) infront of Jellyfin (or most other software) simply increases your security by having the more safe web server be the one interfacing with end users.

    Like, once a user client has contact with the Jellyfin instance, via the reverse proxy, wouldn't the Jellyfin instance be just as vulnerable as without the reverse proxy? Once a connection is established, or found to be available, you could just start exploiting away in the same way, right? Or wrong? If wrong, how? 😅 Maybe it's too long for a text reply? Maybe I should watch some helpful video explaining how it works. 😁

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 11 months ago (3 children)

    No problemo.

    Thanks for pointing out the reverse proxy comment. I think I was wrong to say simply putting jellyfin behind a reverse proxy will increase your security.

    The benefits may only be minute or non-existent if you don't use the reverse proxy for handling other stuff like HTTPS (and redirects to https, etc), restricting access or adding extra authentication requirements (mainly https).

    It may also be good to note that Jellyfins docs explicitly do not recommend directly exposing jellyfin ports to the internet (a reverse proxy or using a vpn are recommended instead).

    Still I will continue to feel safer always using a reverse proxy when I expose to the internet (maybe my misconceptions).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 11 months ago (2 children)

    Thanks again, mate. So basically, if I'm exposing my junk to the world, and by junk I mean service(s), and by world I mean the open internet, I should do it using a reverse proxy and enable HTTPS, otherwise it's not really very secure? Would that be a reasonable takeaway?

    Yet again, thanks. Especially for pointing out the things you (may) be not so sure about. That's admirable. 🫡

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •