when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.
what’s the recommended way of doing stuff like this? ideally i want to be able to go to someone’s house and just play some of my media on their tv.
not that any of this is doable in the near future, since i’m behind cgnat and won’t get my colocated bounce server up until spring.
Dumb question: why does everyone is so terribly afraid of opening stuff to the internet ? What’s the scenario?
Allowing external access to your services means that any misconfiguration or bugs can be exploited to gain control of your machine(s).
Once that happens they can be fucked with, your data stolen, your resources co-opted for someone else’s use, etc. and often times it can be made to look as though whatever bad shit it’s doing is your doing.
So, understand your security posture. You can’t be too careful. Taking over weak or exposed machines is a global industry now.
It starts with being used in a botnet. Then your data can be either erased, corrupted or encrypted against ransom.
The first thing I opened to the internet was a SSH server. 28 minutes after opening it, I started getting constant entry attempts.
i’ve set up servers with static ips in datacenter settings before. the way you know you’re online is usually that your cpu activity jumps a few percent from all the incoming ssh traffic from russia and china. i don’t want to risk anything happening to my home server.
so fun to look through the ssh log and see hundreds of attempts…
Quick question: If I look through the ssh log and I don’t see the hundred of attempts, what could be going on?..
Are you not actually open to the public internet? Is it running on a nonstandard port? Is it already pwned and something is scrubbing logs?
Non standard port. But aren’t secret chinese hack farm scanning wider than just 22 ? I don’t know and deep down believe that it’s pawned and scrubbing logs.
The resources required to port scan every port on every IP is generally not worth it. AFAIK they tend to stick to lower ports or popular ports. Unless they’re intentionally targeting a specific IP or IP range, they’re just looking for low hanging fruit.
Low hanging fruits are, in my personal case, pictures of my cats and public domain cultural artefacts.
Industrializing hacking of random servers sounds like a shitty idea at the end of the day…
The ability to generate a bunch of traffic that looks like it’s coming from legit, every-day residential IPs is invaluable to disinformation campaigns. If they can get persistence in your network, they can toss it into a bot net which they’ll sell access to on the dark web.
A sucker opens insecure services to the open internet every day, that’s free real estate to bot farms. Only when the probability of finding them is low enough is it not worth the energy/network costs. I think hosting on non-standard ports is probably correlated with lowering that probability below some threshold where it becomes not worth it…don’t quote me, though.
At the end of the day, the rule is not to depend on security by obscurity, but that doesn’t mean never use it.
I am not sure lol. perhaps your ssh port isn’t exposed to the internet, or maybe the bots are just ignoring you? maybe your hosting provider has some sort of security process to reject those attempts preemptively?
I have no clue
Ignoring ? Nah someone mentionned my ISP might be protecting me uphill.
Missconfigurations allowing bots and shit hacking you. Overblown paranoia mostly if you just take some precautions
Okay thanks for mentionning overblown paranoia, that’s what I have.
What kind of exploitable server misconfigurations are we talking about here?? Brute forcing won’t work because fail2ban, right? I’m a noob and deep down I’m convinced that my homeserver is compromised and has beenpart of a bitcoin mining farm for years… Yet, not a single proof…
The very first Linux server I deployed on a VPS was hacked almost immediately because of my ignorance. The bot gained entrance, and they supplanted a miner rig. Now, on a tiny VPS, it’s pretty easy to tell if you’re running a coin miner because all of the resources will be pegged. However, I got to thinking, on a corporate server, if they did manage to do this, it would almost be undetectable until someone started reviewing logs.
There are probably thousands of zero days out there in the hands of hacking organizations and nation state level actors. Exposing anything to the internet that doesn’t absolutely have to be is an invitation for the world to join your network and access all your files, if you’re okay with that risk then proceed
Aren’t zero day very specific? Or maybe it’s become a very generic term.
Anyway, I am under the impression that either it’s suddenly very simple to hack into EVERYONE because someone zero dayed the wireguard protocol and there a major flow in it, it’s a shitshow, for all, for some, just me or nobody, whatever. Or it’s a very targeted attack on me personaly, and that’s a whole other story and the means to protect my pictures of my cats and my cool public domain movies collection are different (think social engineering). Also port 22 being bombarded by brute force attempts so don’t choose a password that’s 6 letters thanks.
I KNOW I am missing many things, but still, I don’t get it.
In all likelihood a targeted attack would never come your way but when hosting community made software like immich for example there is a very large attack surface with no security researchers poking at it to find vulnerabilities of which there are likely many. Exposing something like nginx or Wireguard is likely very safe if properly secured because it’s been battle hardened over the decades with millions of eyes on it trying to break it at every turn. So what matters most is your threat model, what you’re deploying, and how you’re deploying it.
Fail2ban will protect you from brute force but just this week there was a maximum risk vulnerability found in react allowing remote code execution, this is one of the most used frameworks on the web developed by some of the most talented engineers in tech over a decade ago and it still has issues that could lead to malicious takeover of your system.
React2Shell is exactly the shitshow situation yes. Suddenly we are all at risk. But in this case, I’m sorry to say that my cats’ pictures are worthless.
Your point on nginx/wireguard makes me think that it might be better to htaccess through a reverse proxy than relying on a built in login system. For exemple, I should deactivate jellyfin’s login and put it behind an htaccess at the proxy’s level. Is that completely dumb?
Anyway, I clearly need to research “threat models” and cyber/infosec more. Thank you very much!
I’m paranoid dude, I don’t need the whole world judging my awful taste in TV shows!
I set up Jellyseer so my friends can request whatever. Just blame your full collection of My Little Pony and Gilmore girls on that one friend from Finland (unless you’re in Finland, and then use Greece).
lol
It’s not just opening stuff to the internet, it’s opening stuff to the internet without any authentication in this case. If you don’t know how that’s bad…….
Yeah sorry I missed the part where it has no authentification whatsoever, that’s just open bar.
Authentification + monitoring + fail2ban + ip blacklist