• 10 Posts
  • 339 Comments
Joined 3 months ago
cake
Cake day: March 27th, 2025

help-circle
  • A while back there was a situation where outsiders could get the name of the contents of your Jellyfin server, which would incriminate anyone. I believe it’s patched now, but I don’t think Jellyfin is winning any security awards. It’s a selfhosted media server. I have no frame of reference for knowing whether or not any of my information was overkill and I’m sure there are even some out there that would say I didn’t go far enough, even.









  • Vanilla_PuddinFudge@infosec.pubtoSelfhosted@lemmy.worldJellyfin over the internet
    link
    fedilink
    English
    arrow-up
    44
    arrow-down
    7
    ·
    edit-2
    1 day ago

    Jellyfin isn’t secure and is full of holes.

    That said, here’s how to host it anyway.

    1. Wireguard tunnel, be it tailscale, netbird, innernet, whatever
    2. A vps with a proxy on it, I like Caddy
    3. A PC at home with Jellyfin running on a port, sure, 8096

    If you aren’t using Tailscale, make your VPS your main hub for whatever you choose, pihole, wg-easy, etc. Connect the proxy to Jellyfin through your chosen tunnel, with ssl, Caddy makes it easy.

    Since Jellyfin isn’t exactly secure, secure it. Give it its own user and make sure your media isn’t writable by the user. Inconvenient for deleting movies in the app, but better for security.

    more…

    Use fail2ban to stop intruders after failed login attempts, you can force fail2ban to listen in on jellyfin’s host for failures and block ips automatically.

    More!

    Use Anubis and yes, I can confirm Anubis doesn’t intrude Jellyfin connectivity and just works, connect it to fail2ban and you can cook your own ddos protection.

    MORE!

    SELinux. Lock Jellyfin down. Lock the system down. It’s work but it’s worth it.

    I SAID MORE!

    There’s a GeoIP blocking plugin for Caddy that you can use to limit Jellyfin’s access to your city, state, hemisphere, etc. You can also look into whitelisting in Caddy if everyone’s IP is static. If not, ddns-server and a script to update Caddy every round? It can get deep.

    Again, don’t do any of this and just use Jellyfin over wireguard like everyone else does(they don’t).












  • Vanilla_PuddinFudge@infosec.pubtoLemmy Shitpost@lemmy.worldIt is what it is
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    edit-2
    4 days ago

    I really don’t have the time, or the interest, to explain it to you

    Then don’t serve a check your ass can’t cash

    a very small amount of digging will show you why.

    Then a very smalll amount would disprove me. Until then, my point of not installing this poison still stands. Enjoy your willful ignorance. Telling me off took more effort than finding your argument lmao.












OSZAR »