Hi folks. So, I know due to a myriad of reasons I should not allow Jellyfin access to the open internet. However, in trying to switch family over from Plex, I’ll need something that “just works”.

How are people solving this problem? I’ve thought about a few solutions, like whitelisting ips (which can change of course), or setting up VPN or tail scale (but then that is more work than they will be willing to do on their side). I can even add some level of auth into my reverse proxy, but that would break Jellyfin clients.

Wondering what others have thought about for this problem

  • daniskarma@lemmy.dbzer0.comEnglish
    505·
    2 months ago

    You can share jellyfin over the net.

    The security issues that tend to be quoted are less important than some people claim them to be.

    For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.

    Just set it up with the typical bruteforce protections and you’ll be fine.

    • MaggiWuerze@feddit.orgEnglish
      144·
      2 months ago

      It’s not impossible, Far from it. The ids are not random uuids but hashes derived from the path. Since most people have a similar setup to organize their media, this gets trivial very fast

      • Synestine@sh.itjust.worksEnglish
        42·
        2 months ago

        If you’re worried about it, make sure to not use a default path. Then legit clients are fine but these theoretical attackers get stymied.

        • MaggiWuerze@feddit.orgEnglish
          43·
          2 months ago

          What? Why would I have to make my library harder to manage just because Jellyfin devs can’t get their act together? They should just start a api/v2 and secure it properly while allowing to disable the old one

          • Synestine@sh.itjust.worksEnglish
            11·
            2 months ago

            Ah, so you’re the kind who loves bitching about things online, but won’t lift a finger to defend themself, gotcha.

            What I mentioned prior doesn’t change anything about library management in the slightest, you just wanted an excuse.

          • blitzen@lemmy.caEnglish
            2·
            2 months ago

            I’m with you that you shouldn’t have to, but putting your media directory one level up in a randomly generated directory name isn’t too bad. ~/[random uuid]/media/… may not be a terrible idea in any case.

    • Possibly linux@lemmy.zipEnglish
      75·
      2 months ago

      Fine is a relative term

      You probably are fine but the company who is getting attacked by your compromised machine isn’t

      • daniskarma@lemmy.dbzer0.comEnglish
        9·
        2 months ago

        I don’t think jellyfin vulnerabilities could lead to a zombified machine. At least I’ve not read about something like that happening.

        Most Jellyfin issues I know are related to unauthorized API calls of the backend.

        • Possibly linux@lemmy.zipEnglish
          34·
          2 months ago

          I think it is a matter of time honestly.

          Jellyfin has grown enough in popularity that it is likely a target for a state actor looking to create some minions. Just because there isn’t any known remote code execution vulnerabilities doesn’t mean there couldn’t be one in the future.

          Maybe I’m being paranoid but it seems way safer to just not expose Jellyfin.

      • zenpocalypse@lemm.eeEnglish
        5·
        2 months ago

        Reading over that list, I don’t really see anything that isn’t “maybe gets read privileges for non-critical data”. Hardly useful enough to be worth attempting access to a single personal Jellyfin server.

        I’d be mildly surprised if anyone has ever bothered.

        You do you, but in my view the effort outweighs the benefits.

        • NicestDicerest@lemmy.worldEnglish
          2·
          2 months ago

          Sure, and its your own choice - But you should still be aware of what could/can happen, so that you can make this decisions informed. Maybe I worded it a bit too harshly, i’m sorry English is not my first language.

  • majestictechie@lemmy.fosshost.comEnglish
    8·
    2 months ago

    I do. I run it behind a caddy service so it’s secured with an SSL. The port is running on a high non standard one. I do keep checking access logs but haven’t had a peep apart from the 1 person I shared it with

    • yeehaw@lemmy.caEnglish
      32·
      2 months ago

      That port changing stuff is way outdated and hasn’t been effective for a long time.

      • majestictechie@lemmy.fosshost.comEnglish
        2·
        2 months ago

        A quick scan will show it ofcourse. But it stops bots and stuff just hitting “known” ports. I’ve not had any issues in the months it’s been active compared to the previous month’s I just used the standard port

  • non_burglar@lemmy.worldEnglish
    91·
    2 months ago

    Oof, a lot of vitriol in this thread.

    In the end, security is less about tooling and config, and more about understanding the risks and acting accordingly.

    I expose jellyfin to the internet, but only to a specific public IP. That reduced my risk considerably.

  • cantankerous_cashew@lemmy.worldEnglish
    2·
    2 months ago

    Unethical life pro tip, but I use the free tier of Cloudflare tunnels and Cloudflare access to gate access to my jellyfin instance. This is technically against their TOS but I don’t cache anything and my bandwidth usage is low so it’s probably not too noticeable. I’ll update this post if I get banned at some point 🤡

  • Chris@lemmy.worldEnglish
    162·
    2 months ago

    When I did this I set up a VPN on my network and forced anyone that wanted to use it to get on my network.

      • Chris@lemmy.worldEnglish
        11·
        2 months ago

        Probably doesn’t. Might need to use the router to get the whole network on th vpn

      • sugar_in_your_tea@sh.itjust.worksEnglish
        21·
        2 months ago

        I have my smart TV access it over my local network. If you’re using a friend’s instance, you could set up a WiFi SSID that tunnels everything over your VPN.

        If that’s onerous, you can make it publicly accessible, but only for whitelisted client IPs.

        • Blue_Morpho@lemmy.worldEnglish
          4·
          2 months ago

          Yeah I want to completely switch off of Plex but neither is a good solution for my non tech family members. Mother in law is in a retirement center where they use wifi provided for the condos so I can’t access her router. And I would expect her ip to occasionally change on reboots etc. I might try IP ranges or narrow geo blocking.

          • sugar_in_your_tea@sh.itjust.worksEnglish
            31·
            2 months ago

            Yeah, an IP range totally works. Figure out the subnet info and add that to a whitelist. It’s a pain, but it should keep the script kiddies at bay.

    • doodledup@lemmy.worldEnglish
      21·
      2 months ago

      I have it behind a proxy and IPS. I force my users to have strong passwords. I don’t see why this would be a problem.

      • Possibly linux@lemmy.zipEnglish
        12·
        2 months ago

        Its a major problem

        It is only a matter of time before it gets compromised. Chances are you will have no idea it happened and you home internet will join the bot net of some nation state. The Jellyfin devs take security seriously but there will always be flaws.

  • RonnyZittledong@lemmy.worldEnglish
    5·
    2 months ago

    You could probably set up a cloudflare tunnel. I forget what they call it. I think technically sending video through it is against their TOS but if just a few friends and family are using it I doubt you will hit their naughty list.

    • Censed@lemmy.zipEnglish
      2·
      2 months ago

      I’ve heard mixed responses about how sensitive they are about routing video through their service. I’ve heard some people are just fine running jellyfin/Plex while others get shut down from routing a security system through it.

      • Clusterfck@lemmy.sdf.orgEnglish
        2·
        2 months ago

        I’ve used it about 2 years now. I have both Jellyfin and even had Invidious for a while. I don’t even know it was against any terms until right now.

  • TheButtonJustSpins@infosec.pubEnglish
    41·
    2 months ago

    I’ve been making people use VPN, but that’s been a huge barrier to entry. I’m in the process of switching to IP allow list in traefik.

  • fishynoob@infosec.pubEnglish
    6·
    2 months ago

    I don’t do this, but I would set up oAuth like Authelia or something behind a reverse-proxy and authenticate Jellyfin clients through that.

  • Appoxo@lemmy.dbzer0.comEnglish
    41·
    2 months ago

    I share Jellyfin.

    Behind a Reverse Proxy with 2FA that breaks client support.
    So only web browser :)

  • ch8zer@lemmy.caEnglish
    153·
    2 months ago

    AppleTV + Tailscale in and it’s been a flawless experience.

  • Darkassassin07@lemmy.caEnglish
    10·
    2 months ago

    I’m so tired of seeing this overblown reaction to ancient non-news.

    Yes, there are some minor vulnerabilities in Jellyfin; but they really really aren’t concerning.

    Unauthenticated, a random person could potentially (with some prior knowledge of this specific issue, and some significant effort randomly generating media UUIDS to tryout) retrieve/playback some media unauthorized. THATS IT. That’s the ONLY real concern. And it’s one you could mitigate with a fail2ban filter if you were that worried about it.

    The other ‘issues’ here, are the potential for your already authenticated users to attack each others settings. Who do you share your server with that you’re concerned about them attacking each other???

    Put this to bed and stop fussing over it. It’s genuinely not worth your time or attention. Exposing Jellyfin to the net is fine.

    Dev comment on the situation: (4 days ago) https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2825240290

  • skankhunt42@lemmy.caEnglish
    53·
    2 months ago

    Hang on, why not open the port to jellyfin to the internet?

    I have a lifetime Plex pass so its not urgent but I have a containers running emby and jellyfin to check them out. When I decide which one I planned to open it up and give people logins.

    • Selfhoster1728@infosec.pubEnglish
      143·
      2 months ago

      See this issue on their github repo: here

      Basically from what I understand there’s loads of unauthenticated api calls, so someone can very easily exploit that.

      If they just supported mTLS in their clients it wouldn’t be an issue but oh well :(