Selfhosted

hideshow 24 child comments

parent

[–] AHemlocksLie@lemmy.zip 38 points 7 months ago

I mean I'm sure they'd like to just ship safe code in the first place. But if that's not their expertise and they demonstrate that repeatedly, we gotta take steps ourselves. Secure is obviously best, but I'd rather have insecure Jellyfin behind a VPN than no Jellyfin at all.

parent

[–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it

[–] Auli@lemmy.ca 5 points 7 months ago

They didn't start the project from Kodi. It is a fork of Emby.

parent

[–] WhyJiffie@sh.itjust.works 5 points 7 months ago

there is just too much place in the codebase for vulnerabilities, and also, most projects like this are maintained by volunteers in their free time for free.

I guess if you set up an IP whitelist in the reverse proxy, or a client TLS certificate requirement, it's fine to open it to the internet, but otherwise no.

parent

[–] teawrecks@sopuli.xyz 5 points 7 months ago* (4 children)

If I say I custom rolled my own crypto and it's designed to be deployed to the open web, and you inspect it and don't see anything wrong, should you do it?

Jellyfin is young and still in heavy development. As time goes on, more eyes have seen it, and it's been battle hardened, the security naturally gets stronger and the risk lower. I don't agree that no one should ever host a public jellyfin server for all time, but for right now, it should be clear that you're assuming obvious risk.

Technically there's no real problem here. Just like with any vulnerability in any service that's exposed in some way, as long as you update right now you're (probably) fine. I just don't want staying on top of it to be a full time job, so I limit my attack surface by using a VPN.

parent

[–] CompactFlax@discuss.tchncs.de 7 points 7 months ago (1 child)

Young.

The original ticket is 2019. That’s 7 years ago.

Technically there's no real problem here.

It responds to and serves content to unauthenticated requests. That’s sorta table stakes if you’re creating an authenticated web service and providing guides to set it up with a reverse proxy.

parent

[–] teawrecks@sopuli.xyz 2 points 7 months ago

Ok, I misread what you were linking to. Yeah, that's pretty bad to allow actual streaming of content to unauthed users. I agree they should not be encouraging anyone to set this up to be publicly accessible until those are fixed. Or at least add a warning.

parent

[–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it

[–] rumba@lemmy.zip 2 points 7 months ago

Biggest worry is someone finding an uncaught RCE.

Of course plugins also have surface area.

We know they can anon pull video. You can sandbox it to limit exposure.

But if they modify the web client with an RCE, then you hit your own server as a trusted site and that delivers a payload...

parent

load more comments (1 reply)

[–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it

[–] FauxLiving@lemmy.world 5 points 7 months ago (4 children)

Yes, not everyone. My grandmother would struggle setting up a VPN, for example.

However, a community member of the selfhosted community is perfectly capable of reading a manual and learning the software.

That's how you become tech literate in the first place, and you're already on that path if you're commenting/reading here.

parent

[–] Hammersamatom@lemmy.dbzer0.com 3 points 7 months ago* (1 child)

Agreed, was more so referring to others. I apologize if it seemed like I was referring to myself

I'm already well and truly deep into this, myself. Two Proxmox nodes running the *Arr stack and Jellyfin in LXC containers. Bare metal TrueNAS, with scheduled LTO backups every two weeks. A few other bits and bobs, like some game servers and home automation for family.

Will need to re-map everything eventually, it's kind of grown out of hand

parent

load more comments (1 reply)

[–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it

[–] FauxLiving@lemmy.world 1 point 7 months ago

I was not actually presenting a scenario where my grandmother would use a VPN.

I was pointing out that this community is full of people who are perfectly capable of learning to use a VPN. In response to this comment:

Unfortunately, not everyone is tech-literate enough nowadays to understand how a VPN works, nor do they want to

That's a true statement about 'everyone' i.e. the entire population of the planet... but true about everyone here in this community.

parent

load more comments (1 reply)

[–] Infernal_pizza@lemmy.dbzer0.com 3 points 7 months ago (8 children)

Isn't it easier to set up a VPN than expose it to the internet?

hideshow 8 child comments

parent

[–] sanzky@lemmy.world 5 points 7 months ago (5 children)

and then you are giving access to your lan to people whose computer you don’t control and might be full of malware.

parent

[–] Infernal_pizza@lemmy.dbzer0.com 5 points 7 months ago

Tbh I forgot about giving access to others, my homelab is for me only lol

parent

[–] FauxLiving@lemmy.world 2 points 7 months ago (3 children)

You only have to give them access to a specific port on a specific machine, not your entire LAN.

My VPN has a 'media' usergroup who can only access the, read-only, NFS exports of my media library.

If you're just installing Wireguard and enabling IP forwarding, yeah it would not be secure. But using a mesh VPN, like Tailscale/Headscale, gives you A LOT more tools to control access.

hideshow 3 child comments

parent

[–] WhyJiffie@sh.itjust.works 2 points 7 months ago (2 children)

yeah but even with plain wireguard the peers can be limited. you just have to figure out the firewall rules, or use opnsense as your wireguard server because it figures the harder part out for you.

parent

[–] sanzky@lemmy.world 1 point 7 months ago* (1 child)

it’s not that it cannot be done. the issue is that something as simple as acceding a service should not require to configure wire guard and routing rules. plenty of FOSS projects are safe to expose through a simple reverse proxy

parent

[–] WhyJiffie@sh.itjust.works 1 point 7 months ago

plenty of FOSS projects are safe to expose through a simple reverse proxy

I have my doubts about that. Personally I would never do that.

parent

[–] Hammersamatom@lemmy.dbzer0.com 3 points 7 months ago* (1 child)

Oh absolutely, difference being that you only need to expose the service once, versus helping however many people set up VPNs to access the service on your LAN

I know way too many people who won't remember to toggle it on, or just won't deal with it

It's just not convenient enough

parent

[–] WhyJiffie@sh.itjust.works 1 point 7 months ago

I know way too many people who won't remember to toggle it on, or just won't deal with it

they need a VPN app that toggles automatically. turn off when they happen to connect to your network, otherwise on, and only forward jellyfin and such apps through it.

parent

load more comments (2 replies)

[–] LycaKnight@infosec.pub 13 points 7 months ago (5 children)

Yeah, i have my 30 docker containers behind Headscale (Tailscale).

parent

[–] pfr@piefed.social 8 points 7 months ago (4 children)

NetBird is coming for you

parent

[–] antrosapien@lemmy.ml 3 points 7 months ago (2 children)

I have been planning to check out Netbird for couple of days. Is it a good alternative for headscale and pangolin?

parent

[–] pfr@piefed.social 2 points 7 months ago (1 child)

It depends if you're using Pangolin for private access or public exposure.

NetBird is a clean replacement for headscale/tailscale, but if your using pangolin specifically for its public tunnel feature then you'd need to keep pangolin.

parent

load more comments (1 reply)

[–] LycaKnight@infosec.pub 1 point 6 months ago

yeah. it did. took a bit. i used headscale initramfs with dropbear for my servers. Didnt find anything for netbird so i copied the headscale initram script and changed it for netbird. But all works now. I like it.

parent

[–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it

[+] bonenode@piefed.social 16 points 7 months ago (2 children)

[deleted]

parent

[–] traxex@lemmy.dbzer0.com 2 points 7 months ago

Tailscale is a super easy vpn that gives you access to your home network from anywhere. And it’s free.

parent

[–] esc@piefed.social 3 points 7 months ago

The solution is mentioned already - use vpn, it will solve 90% of the problems that you can encounter. Also you can serve multiple other services this way without exposing them.

parent

[–] quick_snail@feddit.nl 3 points 7 months ago (5 children)

If only they would fix the htaccess bug

parent

[–] yannic@lemmy.ca 1 point 7 months ago (4 children)

You've piqued my interest. Where can I read about it?

I did a quick search on their github and came up empty. Maybe no one mentioned "htaccess" in the issue.

parent

[–] quick_snail@feddit.nl 1 point 7 months ago* (3 children)

Search for "basic auth"

Its the only software project I know of that you can't put behind http basic auth. They mark this bug as "wontfix" every time someone points it out to them

hideshow 3 child comments

parent

[–] yannic@lemmy.ca 1 point 7 months ago (2 children)

Basic auth? The insecure authentication method?

Ok, I'll look it up anyway. Under the jellyfin repository, there were eight results, none of which seemed to describe what you meant, and under the jellyfin-web repository, there were none. Using a web crawler search, I was able to find Issue #123 for jellyfin-android

Is that it?

parent

[–] quick_snail@feddit.nl 1 point 7 months ago (1 child)

Basic auth is very secure.

Unlike custom implemented logins. So it's common to use basic auth in front of custom auth implementations. So even when the app has a login vuln, you're safe.

Yes that ticket is one of many.

Try searching the repo. Make sure to backspace out the prefix that ignores closed tickets.

parent

[–] yannic@lemmy.ca 1 point 7 months ago*

That's exactly how I searched. If you want security, it's probably best to follow the Unix philosophy of do one thing and do it well. In other words, don't trust someone building a media server to handle auth and instead use the OIDC or LDAP plugins.

parent

[–] maplesaga@lemmy.world 3 points 7 months ago (5 children)

Utilize authelia perhaps?

parent

[–] yabbadabaddon@lemmy.zip 7 points 7 months ago (4 children)

Doesn't work with TVs

parent

[–] AllHailTheSheep@sh.itjust.works 2 points 7 months ago (3 children)

ldap auth will work on tvs

hideshow 3 child comments

parent

[–] exu@feditown.com 3 points 7 months ago (2 children)

But that's basically using the same built-in auth. If there's an auth bypass I don't think it makes a difference.

parent

[–] AllHailTheSheep@sh.itjust.works 2 points 7 months ago (1 child)

not really. you can disable the default jellyfin login and force it to use ONLY ldap.

parent

[–] possiblylinux127@lemmy.zip 1 point 7 months ago

...which still uses Jellyfin for authentication. The only difference is that instead of checking your password locally it is sent over the network via LDAP

parent

[–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it

[–] AllHailTheSheep@sh.itjust.works 3 points 7 months ago

you totally can use ldap or oidc it just requires more setup. you just ensure jellyfin and your source of truth talk on their own subnet, docker can manage it all for you. ldap can be setup to be ldaps with ssl and never even leave the docker subnet anyways.

and yes I suppose you could rely on whitelists, but you'd have to manually add to the whitelist for every user, and god forbid if someone is traveling.

parent

[–] mriormro@lemmy.zip 2 points 7 months ago (1 child)

Don’t ever shit in your own house, either.

Just in case they’re watching.

parent

[–] possiblylinux127@lemmy.zip 1 point 7 months ago

I shit in my toilet

parent

[–] ligma_centauri@lemmy.world 1 point 7 months ago

Just did a cursory read of the commits related to security for this release, and my assumpion based solely on the changes, is that it's not a remote-access vulnerability, but a supply-chain-esque vulnerability where a video you downloaded from a questionable source might trigger code embedded in the metadata to be run by jellyfin.

parent

[–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it

[–] possiblylinux127@lemmy.zip 1 point 7 months ago

I still wouldn't do it personally