Emby admin brute force access

[Happy2Play 9780]

Just now, One2Go said:

On the Dashboard I have these RED Alerts of past failed login attempts, how do I clear those out? I looked where the logs are kept on the QNAP "/share/CACHEDEV1_DATA/.qpkg/EmbyServer/programdata/logs" there are only four in the folder and none of them contain the Alerts displayed on the dashboard. The Alerts go all the way back to 2019.

Please tell me how to get rid of the Alerts as I only want to see if any new ones are appearing.

Well you have to shutdown Emby and delete the activitylog.db (or manually edit it) to clear the dashboard area or wait I believe 7 days for them to disappear or get replaced.

 

[One2Go 120]

Thanks that is what I was looking for. I guess I wait 3 more days and they should disappear if it is set to 7 days. Any idea what app on windows allows editing of the activitylog.db?

[One2Go 120]

I found the app SQLite that was used for it and I believe I can live with it until the entries disappear from the view in a few days. Not worth spending the time on modifying the activitylog.db

Thanks for your help Happy2Play

[SuperSami77 3]

Hello,
Personally, I use cloudflare and I created a custom rule that blocks all requests not coming from my country and when I travel I just add the country I'm going to.
It drastically limits attacks

[sh0rty 714]

For people who don't want to go the Cloudflare Tunnel route since Emby/Plex/Jelly video streaming is against their TOS, I warmly suggest fosrl/pangolin: Tunneled Mesh Reverse Proxy Server with Identity and Access Control and Dashboard UI

No open ports at home thanks to the newt agent (wireguard based) at home connected to the Pangolin VPS, Traefik with HTTP3/QUIC, builtin 2FA on the Reverse Proxy, IP or path restriction if needed, Crowdsec...everything a selfhoster exposing services needs in his life in one package. Run it since 3 weeks and it's a real sick piece of software that is constantly evolving since the first release. You also bypass CGNat issues a lot of Europeans have with their providers.

For geoblocking on the same VPS Pangolin is running, I use friendly-bits/geoip-shell: User-friendly and versatile geoblocker for Linux to make the security setup complete (just allow German IPs from Maxmind DB).

This results in -99,9% crawler/bot/script-kiddie alerts and lets me sleep well, because they are blocked or lose hope before they could even reach the Emby Login Screen (ca. 1 IP alert a week which is immediately banned by a crowdsec scenario). 

Edited April 7, 2025 by sh0rty