Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer

• fonix232@fedia.io ⁨2⁩ ⁨days⁩ ago

  Not if your Jellyfin is set up correctly.

  Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.

  Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.

  source

  • Blue_Morpho@lemmy.world ⁨1⁩ ⁨day⁩ ago

    The start of this thread is “number one reason people don’t move to Jellyfin is ease of remote access.”

    30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.

    source

    • fonix232@fedia.io ⁨1⁩ ⁨day⁩ ago

      It's literally just:

      • create docker container
      • forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
      • forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS

      I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.

      source

      • Blue_Morpho@lemmy.world ⁨1⁩ ⁨day⁩ ago

        Not at Cisco. With a Cisco. I ran a mid sized ISP in the 90’s until I was bought out by a cable company and retired. Although several of my employees went on to work at Cisco. I also had a few friends who were executives at Cisco because we all started at a company working for Vint Cerf and Bob Khan (they were the angel investors) back before most knew of the Internet.

        First it’s a VM because I’m not going mess around with stuff on bare metal. Create docker is a can of worms because you have to pick a reverse proxy software like nginx, traefik, caddy. Which means you need to understand all three to know which to pick. Then there’s setting up the certificate with the dns provider. So I got nginx working with a certificate but gave up after the VM running Jellyfin couldn’t see it. Googling showed someone on Reddit with the same problem but no answer other than others saying “works for me”

        source

        • -> View More Comments
    • fonix232@fedia.io ⁨1⁩ ⁨day⁩ ago

      Beside, that wasn't even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.

      Port setup and it's perceived impossibility by you has naught to do with that topic.

      source