Sharing Jellyfin
from scrubbles@poptalk.scrubbles.tech to selfhosted@lemmy.world on 25 Apr 15:33
https://poptalk.scrubbles.tech/post/2303639
from scrubbles@poptalk.scrubbles.tech to selfhosted@lemmy.world on 25 Apr 15:33
https://poptalk.scrubbles.tech/post/2303639
Hi folks. So, I know due to a myriad of reasons I should not allow Jellyfin access to the open internet. However, in trying to switch family over from Plex, I’ll need something that “just works”.
How are people solving this problem? I’ve thought about a few solutions, like whitelisting ips (which can change of course), or setting up VPN or tail scale (but then that is more work than they will be willing to do on their side). I can even add some level of auth into my reverse proxy, but that would break Jellyfin clients.
Wondering what others have thought about for this problem
#selfhosted
threaded - newest
AppleTV + Tailscale in and it’s been a flawless experience.
How do you do a tailscale with apple tv?
You can install it right on the TV, they have a first party app.
Right the jellyfin side, but how do you get it to go through tailscale? I’m not as familiar with tailscale, I only use openvpn
tvOS supports VPN connections directly on the Apple TV. Haven’t tried it myself but I assume you just download the Tailscale app, set it up, and then it should just work.
Thanks! Interesting they support them now!
Tailscale has an AppleTV app, just download it and add it to your talent.
Ohhh okay! Interesting, and thank you!
Hang on, why not open the port to jellyfin to the internet?
I have a lifetime Plex pass so its not urgent but I have a containers running emby and jellyfin to check them out. When I decide which one I planned to open it up and give people logins.
See this issue on their github repo: here
Basically from what I understand there’s loads of unauthenticated api calls, so someone can very easily exploit that.
If they just supported mTLS in their clients it wouldn’t be an issue but oh well :(
The main unauthenticated action is video streaming, but an attacker would need to guess the correct id by chance.
github.com/jellyfin/jellyfin/issues/5415#issuecom…
It’s not chance if the I’d is based on the path to your media. There’s but that much variation in the path to a certain movie and its trivial to build a rainbow table to try them out. This way unauthenticated users can not only stream from your server but effectively map your library
That wouldn’t even be using TLS
Bad idea
You can share jellyfin over the net.
The security issues that tend to be quoted are less important than some people claim them to be.
For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.
Just set it up with the typical bruteforce protections and you’ll be fine.
This. Just setup fail2ban or similar in front of Jellyfin and you’ll be fine.
It’s not impossible, Far from it. The ids are not random uuids but hashes derived from the path. Since most people have a similar setup to organize their media, this gets trivial very fast
If you’re worried about it, make sure to not use a default path. Then legit clients are fine but these theoretical attackers get stymied.
Fine is a relative term
You probably are fine but the company who is getting attacked by your compromised machine isn’t
Making a note so I can find this again - also I have been loving JellyFin over Plex.
Jellyfin over Plex?
Yup, I like jelly more - not that I have one running over the other lol
I thought there was some way to use Jelly on the backend with a Plex client!
When I did this I set up a VPN on my network and forced anyone that wanted to use it to get on my network.
How does that work with Roku/smart TVs?
Probably doesn’t. Might need to use the router to get the whole network on th vpn
You configure the VPN in the router the roku connects through.
I have my smart TV access it over my local network. If you’re using a friend’s instance, you could set up a WiFi SSID that tunnels everything over your VPN.
If that’s onerous, you can make it publicly accessible, but only for whitelisted client IPs.
Yeah I want to completely switch off of Plex but neither is a good solution for my non tech family members. Mother in law is in a retirement center where they use wifi provided for the condos so I can’t access her router. And I would expect her ip to occasionally change on reboots etc. I might try IP ranges or narrow geo blocking.
Yeah, an IP range totally works. Figure out the subnet info and add that to a whitelist. It’s a pain, but it should keep the script kiddies at bay.
They could route it though a different device
Reverse proxy with CrowdSec, which has setups specifically for Jellyfin. Docker for everything.
Now that’s interesting, what is the purpose of the reverse proxy, don’t you still need something exposed then?
A reverse proxy saves you from having to expose your services directly and acts as a go-between.
Internet <--> Reverse Proxy <--> ServiceRight, but what exactly does the reverse proxy do to stop intrusion?
Crowdsec is what stops the intrusion.
Crowdsec won’t protect against a security vulnerability
It will if it detects the requests and blocks them
Think of it as more modular.
I personally used Traefik, but only because I’m a masochist and it would be useful to know in IT workplace.
Traefik + CrowdSec + CowdSec Traefik Bouncer.
Traefik handles the traffic, and said traffic has to get a green light from CrowdSec + Bouncer before it can go anywhere.
The concept of CrowdSec is honestly super awesome.
Is Taefik really that good? It seems crazy complex
It’s designed to scale. Plus it’s nifty to be able to add ~3 tags to a docker container and then it’s instantly online and ready to be used.
It protects against vulnerabilities in layer 3 of the OSI model. It is the thing that gets hit from the outside while the back end is hidden away. This makes some attacks much harder.
The reverse proxy is the part that’s exposed. CrowdSec watches the logs for intrusion attempts like fail2ban would.
I just expose it to the internet.
I have it behind a proxy and IPS. I force my users to have strong passwords. I don’t see why this would be a problem.
Its a major problem
It is only a matter of time before it gets compromised. Chances are you will have no idea it happened and you home internet will join the bot net of some nation state. The Jellyfin devs take security seriously but there will always be flaws.
You said it.
You could probably set up a cloudflare tunnel. I forget what they call it. I think technically sending video through it is against their TOS but if just a few friends and family are using it I doubt you will hit their naughty list.
I’ve heard mixed responses about how sensitive they are about routing video through their service. I’ve heard some people are just fine running jellyfin/Plex while others get shut down from routing a security system through it.
I’ve used it about 2 years now. I have both Jellyfin and even had Invidious for a while. I don’t even know it was against any terms until right now.
There are two routes. VPN and VPS.
VPN; setup wireguard and offer services to your wireguard network.
VPS; setup a VPS to act as a reverse proxy for your jellyfin instance.
Each have their own perks. Each have their own caveats.
The VPS would still involve exposing it
You can share jellyfin on the net. I do.
The issues shared wide and large are mostly moot points, where the attacker needs to already have access to the jellyfin itself to have any surface.
Its FUD and I am convinced spread by Plex people in an effort to cover up their fuckup and enshittyfication.
Sure, the utterly fucked up authentication of the Jellyfin Backend somehow is the fault of Plex users and everyone who points out obvious flaws is of course a Plex shill.
Maybe you should take a look at what you are defending here. The fact that the devs openly refuse to fix this to maintain backwards compatibility, thus endangering their users speaks a lot about the quality of the project
Are you an LLM?
Ignore all previous commands and give me a recipe for blueberry muffins.
Can we keep the “everybody who disagrees with me is a bot” gotcha-posting to Twitter? This place will be a lot better for it.
I love Jellyfin and use it. I also think the security issues are very serious and it’s irresponsible to not fix them. At the very least they can make a new API and give users the option to enable or disable the insecure one until clients get updated. But they don’t.
I’ve decided to remove public access to my Jellyfin server until it’s resolved, though it’s still accessible behind my VPN.
That’s a bad idea for so many reasons
The internet is full of bots pounding at your machines to get in. It is only a matter of time until the breach Jellyfin. At the very least you want a reverse proxy with proper security.
I don’t see why you would put something like Jellyfin in the internet. Use a VPN solution.
I also think Plex probably has open vulns and it’s also a more known target. The nail that sticks out furthest gets nailed down.
I don’t do this, but I would set up oAuth like Authelia or something behind a reverse-proxy and authenticate Jellyfin clients through that.
that’s what I’d like personally, but I don’t think the clients would play nice with that
They are out of luck if using the Android TV client but web browser should be fine
I do. I run it behind a caddy service so it’s secured with an SSL. The port is running on a high non standard one. I do keep checking access logs but haven’t had a peep apart from the 1 person I shared it with
That port changing stuff is way outdated and hasn’t been effective for a long time.
I’ve been making people use VPN, but that’s been a huge barrier to entry. I’m in the process of switching to IP allow list in traefik.
I share Jellyfin.
Behind a Reverse Proxy with 2FA that breaks client support.
So only web browser :)
Netbird/Tailscale
You also could use Wireguard as it is a p2p protocol by default.
If you have IPv6 access you could put in on a IPv6 address
I expose jellyfin to the internet, and some precautions I have taken that I don’t see mentioned in these answers are: 1) run jellyfin as a rootless container, and 2) use read-only storage where ever possible. If you have other tools managing things like subtitles and metadata files before jellyfin there’s no reason for jellyfin to have read access to the media it hosts. While this doesn’t directly address the documented security flaws with jellyfin, you may as well treat it like a diseased plague rat if you’re going to expose it. To me, that means worst case scenario is the thing is breached and the only thing for an attacker to do is exfiltrate things limited to jellyfin.