Hi folks. So, I know due to a myriad of reasons I should not allow Jellyfin access to the open internet. However, in trying to switch family over from Plex, I’ll need something that “just works”.
How are people solving this problem? I’ve thought about a few solutions, like whitelisting ips (which can change of course), or setting up VPN or tail scale (but then that is more work than they will be willing to do on their side). I can even add some level of auth into my reverse proxy, but that would break Jellyfin clients.
Wondering what others have thought about for this problem
I do. I run it behind a caddy service so it’s secured with an SSL. The port is running on a high non standard one. I do keep checking access logs but haven’t had a peep apart from the 1 person I shared it with
That port changing stuff is way outdated and hasn’t been effective for a long time.
A quick scan will show it ofcourse. But it stops bots and stuff just hitting “known” ports. I’ve not had any issues in the months it’s been active compared to the previous month’s I just used the standard port
Hang on, why not open the port to jellyfin to the internet?
I have a lifetime Plex pass so its not urgent but I have a containers running emby and jellyfin to check them out. When I decide which one I planned to open it up and give people logins.
See this issue on their github repo: here
Basically from what I understand there’s loads of unauthenticated api calls, so someone can very easily exploit that.
If they just supported mTLS in their clients it wouldn’t be an issue but oh well :(
The main unauthenticated action is video streaming, but an attacker would need to guess the correct id by chance.
https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2825240290
It’s not chance if the I’d is based on the path to your media. There’s but that much variation in the path to a certain movie and its trivial to build a rainbow table to try them out. This way unauthenticated users can not only stream from your server but effectively map your library
That wouldn’t even be using TLS
Bad idea
I don’t do this, but I would set up oAuth like Authelia or something behind a reverse-proxy and authenticate Jellyfin clients through that.
that’s what I’d like personally, but I don’t think the clients would play nice with that
They are out of luck if using the Android TV client but web browser should be fine
Unethical life pro tip, but I use the free tier of Cloudflare tunnels and Cloudflare access to gate access to my jellyfin instance. This is technically against their TOS but I don’t cache anything and my bandwidth usage is low so it’s probably not too noticeable. I’ll update this post if I get banned at some point 🤡
deleted by creator
Yes that is the GitHub issue I was referring to
deleted by creator
You should maybe reconsider this for security reasons. You should implement a Whitelist or a VPN. Jellyfin is notoriously insecure software, check here:
Reading over that list, I don’t really see anything that isn’t “maybe gets read privileges for non-critical data”. Hardly useful enough to be worth attempting access to a single personal Jellyfin server.
I’d be mildly surprised if anyone has ever bothered.
You do you, but in my view the effort outweighs the benefits.
Sure, and its your own choice - But you should still be aware of what could/can happen, so that you can make this decisions informed. Maybe I worded it a bit too harshly, i’m sorry English is not my first language.
deleted by creator
Making a note so I can find this again - also I have been loving JellyFin over Plex.
Jellyfin over Plex?
Yup, I like jelly more - not that I have one running over the other lol
I thought there was some way to use Jelly on the backend with a Plex client!
AppleTV + Tailscale in and it’s been a flawless experience.
How do you do a tailscale with apple tv?
You can install it right on the TV, they have a first party app.
Right the jellyfin side, but how do you get it to go through tailscale? I’m not as familiar with tailscale, I only use openvpn
tvOS supports VPN connections directly on the Apple TV. Haven’t tried it myself but I assume you just download the Tailscale app, set it up, and then it should just work.
Thanks! Interesting they support them now!
Tailscale has an AppleTV app, just download it and add it to your talent.
Ohhh okay! Interesting, and thank you!
When I did this I set up a VPN on my network and forced anyone that wanted to use it to get on my network.
How does that work with Roku/smart TVs?
Probably doesn’t. Might need to use the router to get the whole network on th vpn
I have my smart TV access it over my local network. If you’re using a friend’s instance, you could set up a WiFi SSID that tunnels everything over your VPN.
If that’s onerous, you can make it publicly accessible, but only for whitelisted client IPs.
Yeah I want to completely switch off of Plex but neither is a good solution for my non tech family members. Mother in law is in a retirement center where they use wifi provided for the condos so I can’t access her router. And I would expect her ip to occasionally change on reboots etc. I might try IP ranges or narrow geo blocking.
Yeah, an IP range totally works. Figure out the subnet info and add that to a whitelist. It’s a pain, but it should keep the script kiddies at bay.
You configure the VPN in the router the roku connects through.
They could route it though a different device
Netbird/Tailscale
You also could use Wireguard as it is a p2p protocol by default.
If you have IPv6 access you could put in on a IPv6 address
I’m so tired of seeing this overblown reaction to ancient non-news.
Yes, there are some minor vulnerabilities in Jellyfin; but they really really aren’t concerning.
Unauthenticated, a random person could potentially (with some prior knowledge of this specific issue, and some significant effort randomly generating media UUIDS to tryout) retrieve/playback some media unauthorized. THATS IT. That’s the ONLY real concern. And it’s one you could mitigate with a fail2ban filter if you were that worried about it.
The other ‘issues’ here, are the potential for your already authenticated users to attack each others settings. Who do you share your server with that you’re concerned about them attacking each other???
Put this to bed and stop fussing over it. It’s genuinely not worth your time or attention. Exposing Jellyfin to the net is fine.
Dev comment on the situation: (4 days ago) https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2825240290
You can share jellyfin over the net.
The security issues that tend to be quoted are less important than some people claim them to be.
For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.
Just set it up with the typical bruteforce protections and you’ll be fine.
It’s not impossible, Far from it. The ids are not random uuids but hashes derived from the path. Since most people have a similar setup to organize their media, this gets trivial very fast
If you’re worried about it, make sure to not use a default path. Then legit clients are fine but these theoretical attackers get stymied.
What? Why would I have to make my library harder to manage just because Jellyfin devs can’t get their act together? They should just start a api/v2 and secure it properly while allowing to disable the old one
I’m with you that you shouldn’t have to, but putting your media directory one level up in a randomly generated directory name isn’t too bad. ~/[random uuid]/media/… may not be a terrible idea in any case.
Ah, so you’re the kind who loves bitching about things online, but won’t lift a finger to defend themself, gotcha.
What I mentioned prior doesn’t change anything about library management in the slightest, you just wanted an excuse.
No, I’m the kind who thinks security by obscurity is bullshit. But you do you
Fine is a relative term
You probably are fine but the company who is getting attacked by your compromised machine isn’t
I don’t think jellyfin vulnerabilities could lead to a zombified machine. At least I’ve not read about something like that happening.
Most Jellyfin issues I know are related to unauthorized API calls of the backend.
I think it is a matter of time honestly.
Jellyfin has grown enough in popularity that it is likely a target for a state actor looking to create some minions. Just because there isn’t any known remote code execution vulnerabilities doesn’t mean there couldn’t be one in the future.
Maybe I’m being paranoid but it seems way safer to just not expose Jellyfin.
Any software can have zero-day exploits for that matter.
That’s is absolutely true
Avoid exposing things unless you really need to and follow best practices.
This. Just setup fail2ban or similar in front of Jellyfin and you’ll be fine.
I have it as an unprivileged container behind a reverse proxy and HTTPS/HSTS. I know it’s not perfect but I keep backups of important shit and monitor things regularly.
I agree that Jellyfin needs to improve its API security, though. Their excuse that “it would break clients on old APIs” is moot when C# comes with API versioning features out of the box.
There are two routes. VPN and VPS.
VPN; setup wireguard and offer services to your wireguard network.
VPS; setup a VPS to act as a reverse proxy for your jellyfin instance.
Each have their own perks. Each have their own caveats.
The VPS would still involve exposing it
You’re exposing your jellyfin instance to a single IP, your VPS. That’s what a reverse proxy is.
You block all communication from any IP but local, and your VPS IP from jellyfin, and forward web traffic from your VPS to your jellyfin instance. It’s not the same as exposing your jellyfin instance directly. Not sure why I have to explain that…but here we are, I guess.
I expose jellyfin to the internet, and some precautions I have taken that I don’t see mentioned in these answers are: 1) run jellyfin as a rootless container, and 2) use read-only storage where ever possible. If you have other tools managing things like subtitles and metadata files before jellyfin there’s no reason for jellyfin to have write access to the media it hosts. While this doesn’t directly address the documented security flaws with jellyfin, you may as well treat it like a diseased plague rat if you’re going to expose it. To me, that means worst case scenario is the thing is breached and the only thing for an attacker to do is exfiltrate things limited to jellyfin.
