708
Jellyfin critical security update - This is not a joke (github.com)
submitted 5 months ago by to c/selfhosted@lemmy.world
260 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 60 points 5 months ago (18 children)

Use a VPN, it's not ideal but it's secure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 18 child comments
    •
  • [–] 44 points 5 months ago (4 children)

    Somehow difficult to install on a TV though.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 24 points 5 months ago (3 children)

    That’s why you do it at your router or gateway and then set a route for the Jellyfin server through the VPN adapter. That way any device on your network will flow through the tunnel to the Jellyfin server including TVs

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 46 points 5 months ago

    Which again implies that you have a router that allows you to do so. It's not always the case. For tech enthusiast people that's the case. But not for everyone.

    I tried to do the same thing at first, but it was a pain, there were tons of issues.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 11 points 5 months ago* (1 child)

    Oh yes, the routers and gateways that most people have that are isp provided that may not actually have open VPN or wireguard support.

    Those ones?

    Also putting a VPN in someone else's house so that all their Network traffic goes through your gateway is pretty damn extreme.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -2 points 5 months ago

    What? No, you can do a tiny reverse proxy/vpn on a stick with something like a RPi. Configure it and give it to them. Then they point their Jellyfin client on their device to the IP of the RPi instance on their network and that creates the tunnel back to your VPN endpoint and server.

    And for VPNs at a router level you can inject routes and leave th default route going out through your ISP, you don’t need to, nor want to, have all traffic going through it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 5 months ago (11 children)

    Don’t reverse proxies like pangolin just do the job? Does it have to be VPN in this particular concept? VPN isn’t like immune to vulnerabilities.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 31 points 5 months ago (5 children)

    Reverse proxy doesn't really get you much security. If there is an application level issue a reverse proxy will not help

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 5 months ago (2 children)

    Hmmm, I'm a bit rusty on this but can't one put an auth gate in front of the application, handled by the reverse proxy?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 5 months ago (1 child)

    You can, that would actually give you security. Not sure how many people do that. I assumed a straight reverse proxy without any auth

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    I think that's one of the major reasons to use pangolin over something like nginx - built in auth and support for oidc.

    Of course, the native jellyfin apps don't like the auth layer so idk if it helps if you're trying to install it on your dad's tv

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 5 months ago (1 child)

    Reverse proxy will let anyone connect to it. VPN, you can create keys/logins for your intended users only. Having said that, from what I could see, nothing in the security fixes were to do with authentication. I think (just from a cursory look), they could only be exploited, if at all from an authenticated user session.

    But personally, something like jellyfin where the number of people I want to be able to access it is very limited, stays behind a VPN. Better to limit your potential attack surface as much as you can.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 5 months ago* (2 children)

    Pangolin is based off of Traefik if I’m not mistaken, should be able to use Traefiks IPAllowlist middleware to blacklist all IP addresses and only whitelisting the known few, that way you can expose your application to the internet knowing you have that restriction in place for those who connect to your service.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 5 months ago (1 child)

    If the people you want to have access have static, exclusive ip addresses. Which is pretty unusual, these days.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •