708
Jellyfin critical security update - This is not a joke (github.com)
submitted 5 months ago by to c/selfhosted@lemmy.world
260 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 5 months ago (11 children)

Don’t reverse proxies like pangolin just do the job? Does it have to be VPN in this particular concept? VPN isn’t like immune to vulnerabilities.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 31 points 5 months ago (5 children)

    Reverse proxy doesn't really get you much security. If there is an application level issue a reverse proxy will not help

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 5 months ago (2 children)

    Hmmm, I'm a bit rusty on this but can't one put an auth gate in front of the application, handled by the reverse proxy?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 5 months ago (1 child)

    You can, that would actually give you security. Not sure how many people do that. I assumed a straight reverse proxy without any auth

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 5 months ago

    I think that's one of the major reasons to use pangolin over something like nginx - built in auth and support for oidc.

    Of course, the native jellyfin apps don't like the auth layer so idk if it helps if you're trying to install it on your dad's tv

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 5 months ago (1 child)

    Reverse proxy will let anyone connect to it. VPN, you can create keys/logins for your intended users only. Having said that, from what I could see, nothing in the security fixes were to do with authentication. I think (just from a cursory look), they could only be exploited, if at all from an authenticated user session.

    But personally, something like jellyfin where the number of people I want to be able to access it is very limited, stays behind a VPN. Better to limit your potential attack surface as much as you can.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 5 months ago* (2 children)

    Pangolin is based off of Traefik if I’m not mistaken, should be able to use Traefiks IPAllowlist middleware to blacklist all IP addresses and only whitelisting the known few, that way you can expose your application to the internet knowing you have that restriction in place for those who connect to your service.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 5 months ago (1 child)

    If the people you want to have access have static, exclusive ip addresses. Which is pretty unusual, these days.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •