4 ms·

Can anyone comment on the security of Jellyfin? When I had last looked into it, it seemed like Jellyfin had a somewhat weak security model that made me question

Can anyone comment on the security of Jellyfin? When I had last looked into it, it seemed like Jellyfin had a somewhat weak security model that made me question switching family members to it from Plex.

heavyset_go 6mo ago
Don't expose it to the internet unless you know what you're doing, or put it on a VPS you don't care about. Ideally keep it behind a VPN and give your family members access to it that way, and let local devices on your LAN connect to it without a VPN.
- ssl-3 6mo ago
  Those are fine ideas. But I'm not all about getting something like Tailscale to work with my elderly mother's Roku device, nor teaching her how to use it.
  - ray_v 6mo ago
    I set my dad up with a Linux box as a daily driver for him - he keeps the desktop on , and the roku jellyfin now has a clean proxy into jellyfin over the tailscale network. Giving him a desktop I can remote into was a great decision that paid dividends for him :)
  - lamasery 6mo ago
    Get your elderly mother an Apple TV and infuse, then connect with Tailscale. It’s pretty friggin’ smooth in daily operation. Apple TV’s UI is no easier to get lost in than Roku, and actually has fewer pitfalls if you toggle one setting (the one that makes one home tap open the Apple TV app, and a second press while in that app actually go home, by default; switch that to always go home on any press of that button no matter what) I dunno if Tailscale works on Roku but otherwise that would indeed be entirely viable too, last I saw Jellyfin’s app on there is really good. Likely need a server powerful enough to transcode, though, lots of (all?) Roku devices don’t have hardware decoding for newer codecs like h.265. That’s one big benefit of an Apple TV, it can hardware decode damn near everything.
    - ssl-3 6mo ago
      Perhaps. Y'all (collectively) have some good ideas. But she likes the Roku. She's even got silicone skins for the remotes (plural; spares!), and two of them are tethered near the chairs that her and dad tend to sit in. Also: The Roku stuff already exists, and is paid for, and it works with Plex (without a VPN, because my local Plex container didn't come with the caveat to avoid exposing it to the world). Buying them one or more Apple TV devices to use instead seems expensive and likely to fail somehow. Switching them to (cheap? linux?) PCs also sounds expensive and bad, particularly with my dad. He's certainly had more years to learn how to use a computer than I have, but he's spent most of the recent decades deliberately avoiding them. He hates them, and he doesn't want to learn them. He'd fall apart and give up on television entirely if I gave him a PC with a slick Logitech K400 to run it with. (He can drive a Roku with Youtube TV and Plex like a pro, but that's mostly only a D-pad and a back button.) --- But since you and others have mentioned it: Transcoding. That's really not a big problem for many vaguely-recent PCs. With Plex, at least: The quite old i7-6700k desktop box I use for this transcodes to h.264 like a beast using its paltry iGPU, and does h.265 just fine with an old nVidia RTX 2080 if I elect to use that instead. Either way works well and never breaks a sweat. It may have been a powerful machine a decade ago, but a used computer with a 6700k (or so) to serve media with is cheap these days. (And a brand-new power-sipping N150 box does transcoding waaaay better, even in credit-card form factor.)
      - dmos62 6mo ago
        Sad to hear about people getting stuck in weak ecosystems. By the way, I switched from Jellyfin to plain SMB + Nova Player (Android), which has basically the same interface, but no user profiles, and works over SMB, obviously. No transcoding, best format support, and best performance for large files I've found yet for my TCL Android TV.
        ssl-3 6mo ago
        I mean, for my TV at home where everything is connected with a gigabit LAN, I usually use Kodi on a Pi4, over SMB, with a Logitech KT400 to drive it from wherever I feel like sitting. It's silent, reasonably self-contained, and is appliance-like to get going (just dump OpenELEC onto an SD card, plug everything in, and then simply begin using it). Plus, there's two HDMI outputs: One that connects directly to the the dumb TV and sends only video, while the other sends only lossless PCM audio to the once-rather-high-end AV receiver (that gets choked up on more-modern HDMI bitrates). And that's great for me at my house, with my pile of gear, and with my technical proclivities. But I'm not my mom, and this isn't my mom's house. :)
  - asixicle 6mo ago
    You can point Tailscale toward a $5 exit-node VPS and Caddy/nginx through a cheapo-but-memorable-domain to get a Jellyfin Dashboard up in a browser. I assume running the domain and port through the Jellyfin Roku app would work fine (can't be sure as I've never used a Roku). Just mind your ACLs
  - whywhywhywhy 6mo ago
    I use Jellyfin and when it works it’s great but a few small things make it totally unusable for a non-technical family member. One thing is when it can’t see the server it doesn’t just say it can’t see it, it acts like the issue is you’re not logged in and then when you log in (having to type your password manually each time, on a TV) it then fails. This is only really diagnosable if you can access both the client and server and is a complete failure and very tedious experience if you only have client access. Feels like I experience this at least once a month so couldn’t ever set this up for family members remotely.
- voxic11 6mo ago
  I put mine behind caddy on a long unguessable path prefix. So that acts as a sort of password that you need to know before you can access it at all. So far it's seemed to work great. The advantage to using a path prefix vs like caddy basic auth is that its compatible with all the normal jellyfin clients.
  - heavyset_go 6mo ago
    You can also use HTTP auth with your reverse proxy and it works with all Jellyfin clients
- RajT88 6mo ago
  TLS is a must-have. They don't bother doing any kind of password hashing on login. It's sent in cleartext.
  - teraflop 6mo ago
    That's no different from how just about any other webapp works. "Bothering" with client-side password hashing, in the absence of TLS, is security theater. It provides only the most trivial protection against eavesdroppers. If someone can steal an unhashed password, then they can also steal whatever hash you send instead. If you try to fix this with some kind of ad-hoc challenge-response protocol, then the attacker can just steal your session cookie after login. There shouldn't even be a question of using insecure HTTP for anything that requires authentication.
    - RajT88 6mo ago
      > "Bothering" with client-side password hashing, in the absence of TLS, is security theater. Filtering out unsophisticated attackers I would not classify as "theater". Read this, and let me know if the implications of port forwarding your server (or putting it on IP6) is readily apparent: https://jellyfin.org/docs/general/post-install/networking/#ssl--https https://jellyfin.org/docs/general/post-install/networking/#s... A lot of these users are not very sophisticated themselves. The least sophisticated attackers are likely to be the most numerous. This is bad. People who say it's not bad (or worse, suggesting anyone dumb enough to publicly expose their server without TLS) are engaging in security snobbery.
  - heavyset_go 6mo ago
    Yes, TLS should be considered a given. Set things up right and you can use TLS locally, too, with Let's Encrypt, which is a prereq to stream some things to streaming sticks using Jellyfin's raw HTTP streaming without a Jellyfin client.
random_human_ 6mo ago
For whatever reason people here and on Reddit will tell you that you need to have Jellyfin pass through five VPNs, otherwise nasty things will happen. Meanwhile the actual devs suggests simply setting up a reverse proxy, which you can do in two lines with Caddy: https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/caddy/ https://jellyfin.org/docs/general/post-install/networking/re...
- MaxikCZ 6mo ago
  Reverse proxy itself will do barely any defense, what you need in combination is an authgate (authentik, authelia), and here we are moving from "simple reverse proxy" to fun weekend activity and then some getting it to work as expected. + it kills the app auth flow, so only web interface is suitable for this.
  - notpushkin 6mo ago
    > Reverse proxy itself will do barely any defense, what you need in combination is an authgate What’s your threat model?
    - MaxikCZ 6mo ago
      Same as anyones: random bots scanning IP/ports to find established services and trying exploits from the book.
      - random_human_ 6mo ago
        If you expose Jellyfin on 443, have HTTPS properly set up (which Caddy handles automatically), your admin password is not pswd1234 (or you straight up disable remote admin logins), and use a cheap .com domain rather than your IP--what is the actual attack surface in that case? As far as I can remember that is more or less what is usually suggested by Jellyfin's devs, and I have yet to see something that convinces me about its inadequacy.
        6mo ago
MaxikCZ 6mo ago
Yea its pretty bad, there are pages of non-fixed confirmed exploits, you really shouldnt let it face the net. VPN is one solution, and actually the only real solution for app-based jellyfin (TV, phone apps) I found so far. Another is to host Jellyfin behind reverse proxy, and have a completely independent authgatein front of it (authentik, authelia). Jellyfin even supports LDAP (trough plugin), so you dont have to login twice per visit. The downside is only web interface can be hidden this way, as apps will break expecting jellyfin auth page and finding something else.
vachina 6mo ago
To alleviate your concerns, I have a public facing Jellyfin instance hosted on a subdomain for almost a year now. So far zero pwns or bot activity.
dawnerd 6mo ago
It’s still a mess and any suggestions to fix it are met with hostility which is a shame because I’d love to use it. Last I checked there were still endpoints not behind auth that exposed stuff you’d probably not want exposed.
ndesaulniers 6mo ago
I run it in a docker container behind traefik in another container. Getting that wired up and working in podman was quite the challenge. Docker container mounts my media as read only.
- nyolfen 6mo ago
  i didn't have much trouble services: jellyfin: build: dockerfile: jellyfin.Dockerfile container_name: jellyfin group_add: - 44 - 993 environment: - TZ=<redacted> - JELLYFIN_PublishedServerUrl=<redacted> - DOMAIN_NAME=<redacted> ports: - 8096:8096 - 8920:8920 - "7359:7359/udp" volumes: - ./config:/config - ./cache:/cache - ./config/index.html:/jellyfin/jellyfin-web/index.html - type: bind source: /mnt/storage/Video target: /media restart: always devices: - /dev/dri:/dev/dri the device and group_add were for integrated graphics passthrough for transcoding (very highly recommend if you're containerized) i also recommend seerr to pair with jellyfin: https://seerr.dev/ https://seerr.dev/ my wife logs into the seerr ui with her jellyfin account, makes requests, they get grabbed by sonarr/radarr, which in turn place them in the correct library, and they're identified & labeled correctly on import
- deleted 6mo ago
  [deleted]

heavyset_go 6mo ago

Don't expose it to the internet unless you know what you're doing, or put it on a VPS you don't care about. Ideally keep it behind a VPN and give your family members access to it that way, and let local devices on your LAN connect to it without a VPN.

ssl-3 6mo ago
Those are fine ideas. But I'm not all about getting something like Tailscale to work with my elderly mother's Roku device, nor teaching her how to use it.
- ray_v 6mo ago
  I set my dad up with a Linux box as a daily driver for him - he keeps the desktop on , and the roku jellyfin now has a clean proxy into jellyfin over the tailscale network. Giving him a desktop I can remote into was a great decision that paid dividends for him :)
- lamasery 6mo ago
  Get your elderly mother an Apple TV and infuse, then connect with Tailscale. It’s pretty friggin’ smooth in daily operation. Apple TV’s UI is no easier to get lost in than Roku, and actually has fewer pitfalls if you toggle one setting (the one that makes one home tap open the Apple TV app, and a second press while in that app actually go home, by default; switch that to always go home on any press of that button no matter what) I dunno if Tailscale works on Roku but otherwise that would indeed be entirely viable too, last I saw Jellyfin’s app on there is really good. Likely need a server powerful enough to transcode, though, lots of (all?) Roku devices don’t have hardware decoding for newer codecs like h.265. That’s one big benefit of an Apple TV, it can hardware decode damn near everything.
  - ssl-3 6mo ago
    Perhaps. Y'all (collectively) have some good ideas. But she likes the Roku. She's even got silicone skins for the remotes (plural; spares!), and two of them are tethered near the chairs that her and dad tend to sit in. Also: The Roku stuff already exists, and is paid for, and it works with Plex (without a VPN, because my local Plex container didn't come with the caveat to avoid exposing it to the world). Buying them one or more Apple TV devices to use instead seems expensive and likely to fail somehow. Switching them to (cheap? linux?) PCs also sounds expensive and bad, particularly with my dad. He's certainly had more years to learn how to use a computer than I have, but he's spent most of the recent decades deliberately avoiding them. He hates them, and he doesn't want to learn them. He'd fall apart and give up on television entirely if I gave him a PC with a slick Logitech K400 to run it with. (He can drive a Roku with Youtube TV and Plex like a pro, but that's mostly only a D-pad and a back button.) --- But since you and others have mentioned it: Transcoding. That's really not a big problem for many vaguely-recent PCs. With Plex, at least: The quite old i7-6700k desktop box I use for this transcodes to h.264 like a beast using its paltry iGPU, and does h.265 just fine with an old nVidia RTX 2080 if I elect to use that instead. Either way works well and never breaks a sweat. It may have been a powerful machine a decade ago, but a used computer with a 6700k (or so) to serve media with is cheap these days. (And a brand-new power-sipping N150 box does transcoding waaaay better, even in credit-card form factor.)
    - dmos62 6mo ago
      Sad to hear about people getting stuck in weak ecosystems. By the way, I switched from Jellyfin to plain SMB + Nova Player (Android), which has basically the same interface, but no user profiles, and works over SMB, obviously. No transcoding, best format support, and best performance for large files I've found yet for my TCL Android TV.
      - ssl-3 6mo ago
        I mean, for my TV at home where everything is connected with a gigabit LAN, I usually use Kodi on a Pi4, over SMB, with a Logitech KT400 to drive it from wherever I feel like sitting. It's silent, reasonably self-contained, and is appliance-like to get going (just dump OpenELEC onto an SD card, plug everything in, and then simply begin using it). Plus, there's two HDMI outputs: One that connects directly to the the dumb TV and sends only video, while the other sends only lossless PCM audio to the once-rather-high-end AV receiver (that gets choked up on more-modern HDMI bitrates). And that's great for me at my house, with my pile of gear, and with my technical proclivities. But I'm not my mom, and this isn't my mom's house. :)
- asixicle 6mo ago
  You can point Tailscale toward a $5 exit-node VPS and Caddy/nginx through a cheapo-but-memorable-domain to get a Jellyfin Dashboard up in a browser. I assume running the domain and port through the Jellyfin Roku app would work fine (can't be sure as I've never used a Roku). Just mind your ACLs
- whywhywhywhy 6mo ago
  I use Jellyfin and when it works it’s great but a few small things make it totally unusable for a non-technical family member. One thing is when it can’t see the server it doesn’t just say it can’t see it, it acts like the issue is you’re not logged in and then when you log in (having to type your password manually each time, on a TV) it then fails. This is only really diagnosable if you can access both the client and server and is a complete failure and very tedious experience if you only have client access. Feels like I experience this at least once a month so couldn’t ever set this up for family members remotely.
voxic11 6mo ago
I put mine behind caddy on a long unguessable path prefix. So that acts as a sort of password that you need to know before you can access it at all. So far it's seemed to work great. The advantage to using a path prefix vs like caddy basic auth is that its compatible with all the normal jellyfin clients.
- heavyset_go 6mo ago
  You can also use HTTP auth with your reverse proxy and it works with all Jellyfin clients
RajT88 6mo ago
TLS is a must-have. They don't bother doing any kind of password hashing on login. It's sent in cleartext.
- teraflop 6mo ago
  That's no different from how just about any other webapp works. "Bothering" with client-side password hashing, in the absence of TLS, is security theater. It provides only the most trivial protection against eavesdroppers. If someone can steal an unhashed password, then they can also steal whatever hash you send instead. If you try to fix this with some kind of ad-hoc challenge-response protocol, then the attacker can just steal your session cookie after login. There shouldn't even be a question of using insecure HTTP for anything that requires authentication.
  - RajT88 6mo ago
    > "Bothering" with client-side password hashing, in the absence of TLS, is security theater. Filtering out unsophisticated attackers I would not classify as "theater". Read this, and let me know if the implications of port forwarding your server (or putting it on IP6) is readily apparent: https://jellyfin.org/docs/general/post-install/networking/#ssl--https https://jellyfin.org/docs/general/post-install/networking/#s... A lot of these users are not very sophisticated themselves. The least sophisticated attackers are likely to be the most numerous. This is bad. People who say it's not bad (or worse, suggesting anyone dumb enough to publicly expose their server without TLS) are engaging in security snobbery.
- heavyset_go 6mo ago
  Yes, TLS should be considered a given. Set things up right and you can use TLS locally, too, with Let's Encrypt, which is a prereq to stream some things to streaming sticks using Jellyfin's raw HTTP streaming without a Jellyfin client.

random_human_ 6mo ago

For whatever reason people here and on Reddit will tell you that you need to have Jellyfin pass through five VPNs, otherwise nasty things will happen. Meanwhile the actual devs suggests simply setting up a reverse proxy, which you can do in two lines with Caddy: https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/caddy/ https://jellyfin.org/docs/general/post-install/networking/re...

MaxikCZ 6mo ago
Reverse proxy itself will do barely any defense, what you need in combination is an authgate (authentik, authelia), and here we are moving from "simple reverse proxy" to fun weekend activity and then some getting it to work as expected. + it kills the app auth flow, so only web interface is suitable for this.
- notpushkin 6mo ago
  > Reverse proxy itself will do barely any defense, what you need in combination is an authgate What’s your threat model?
  - MaxikCZ 6mo ago
    Same as anyones: random bots scanning IP/ports to find established services and trying exploits from the book.
    - random_human_ 6mo ago
      If you expose Jellyfin on 443, have HTTPS properly set up (which Caddy handles automatically), your admin password is not pswd1234 (or you straight up disable remote admin logins), and use a cheap .com domain rather than your IP--what is the actual attack surface in that case? As far as I can remember that is more or less what is usually suggested by Jellyfin's devs, and I have yet to see something that convinces me about its inadequacy.
      - 6mo ago

MaxikCZ 6mo ago

Yea its pretty bad, there are pages of non-fixed confirmed exploits, you really shouldnt let it face the net. VPN is one solution, and actually the only real solution for app-based jellyfin (TV, phone apps) I found so far. Another is to host Jellyfin behind reverse proxy, and have a completely independent authgatein front of it (authentik, authelia). Jellyfin even supports LDAP (trough plugin), so you dont have to login twice per visit. The downside is only web interface can be hidden this way, as apps will break expecting jellyfin auth page and finding something else.

vachina 6mo ago

To alleviate your concerns, I have a public facing Jellyfin instance hosted on a subdomain for almost a year now. So far zero pwns or bot activity.

dawnerd 6mo ago

It’s still a mess and any suggestions to fix it are met with hostility which is a shame because I’d love to use it. Last I checked there were still endpoints not behind auth that exposed stuff you’d probably not want exposed.

ndesaulniers 6mo ago

I run it in a docker container behind traefik in another container. Getting that wired up and working in podman was quite the challenge. Docker container mounts my media as read only.

nyolfen 6mo ago
i didn't have much trouble services: jellyfin: build: dockerfile: jellyfin.Dockerfile container_name: jellyfin group_add: - 44 - 993 environment: - TZ=<redacted> - JELLYFIN_PublishedServerUrl=<redacted> - DOMAIN_NAME=<redacted> ports: - 8096:8096 - 8920:8920 - "7359:7359/udp" volumes: - ./config:/config - ./cache:/cache - ./config/index.html:/jellyfin/jellyfin-web/index.html - type: bind source: /mnt/storage/Video target: /media restart: always devices: - /dev/dri:/dev/dri the device and group_add were for integrated graphics passthrough for transcoding (very highly recommend if you're containerized) i also recommend seerr to pair with jellyfin: https://seerr.dev/ https://seerr.dev/ my wife logs into the seerr ui with her jellyfin account, makes requests, they get grabbed by sonarr/radarr, which in turn place them in the correct library, and they're identified & labeled correctly on import
deleted 6mo ago
[deleted]