Comment on Just created my own zero trust network!

possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

• dataprolet@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

  What’s wrong with exposing Jellyfin to the internet?

  source

  • mic_check_one_two@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

    There are a few security issues with it, but all of the worst known issues require a valid login token. So an attacker would already need to have valid login credentials before they could actually do anything bad. Things like being able to stream video without authentication (but it requires already having a list of the stored media on the server, which means you have been logged in before). Or being able to change other users’ settings (but it requires already being logged in to a valid user).

    source

    • Dhs92@piefed.social ⁨3⁩ ⁨weeks⁩ ago

      The bug you mentioned actually just requires the attacker knows your local media paths to generate the hash. The issue is that most people use trash guides to setup *arr which means they probably have the same paths for everything

      source
  • possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

    You really shouldn’t expose anything directly to the internet. It is a security problem waiting to happen. (Assuming it hasn’t already)

    This is how giant botnets form.

    source

    • dataprolet@lemmy.dbzer0.com ⁨3⁩ ⁨weeks⁩ ago

      What security problems?

      source

      • sugar_in_your_tea@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

        Bots randomly attack stuff, and if you leave something insecure, they’ll install a bot net node.

        source

        • -> View More Comments
  • smiletolerantly@awful.systems ⁨3⁩ ⁨weeks⁩ ago

    Nothing. People fearmonger

    source
• DieserTypMatthias@lemmy.ml ⁨3⁩ ⁨weeks⁩ ago

  Why would you expose anything to the internet when you got Tailscale?

  source
• BaroqueInMind@piefed.social ⁨3⁩ ⁨weeks⁩ ago

  How?

  source

  • tux7350@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Ya got three options.

    Option A is to create your own certificate that is self-signed. You will then have to load the certificate into any client you want to use. Easier than people realize, just a couple terminal commands. Give this a go if you want to learn how they work.

    Option B is to generate a certificate with Let’s Encrypt via an application like certbot. I suggest you use a DNS challenge to create a wildcard certificate.

    Option C is to buy a certificate from your DNS provider aka something like cloudflare.

    IMO the best is Option B. Takes a bit to figure it out but its free and rotates automatically which I like.

    I like helping and fixing stuff, if you’d like to know anything just ask :D

    source

    • RunningInRVA@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

      None of these are client certificates btw. These are just ways to have your server use TLS encryption with any client that connects but it offers no authorization. If you want authorization with client certificates you need to implement mTLS (Mutual TLS).

      source

      • tux7350@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

        Oooo ya know I actually don’t know about these. I’ve done both A and B for my homelab and C for work.

        Any good resources / insight into mTLS? I appreciate the response btw!

        source

        • -> View More Comments
      • SheeEttin@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

        Nor is it authentication.

        source

        • -> View More Comments
    • possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

      That is for server side certs not client side. I’m talking about Mutual TLS.

      Setting up https is not going to stop bots. All it does is prevent man in the middle attacks. You want to limit who and what can access Jellyfin so that you don’t end up being a victim of an automated exploit.

      source
  • archy@lemmy.world ⁨3⁩ ⁨weeks⁩ ago

    Kleopatra

    source

    • possiblylinux127@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

      That isn’t mutualTLS

      It just is a frontend for gpg. You need OpenSSL for mutual certs.

      source