Windows computer. Install natively or in Docker?

[rob51 0]

I'm trying to decide if I want to move my Emby server install from a regular Windows install to a Docker container within Windows.  The only reason would be to limit further intrusion if my Emby server were compromised from the Internet.

I created a separate non-admin user and run Emby Portable as that user via a service (created with NSSM).  Ideally that user will have full permissions to C:\Emby, write permissions to a transcoding temp folder, and read-only permissions to my media.  The biggest issue with compartmentalizing my "EmbyServer" user with those permissions is... I cannot.  Even if I only give EmbyServer read permissions to my media, it still has write permissions because of the dynamic Authenticated Users group.  See attached photos.  I can't just willy-nilly start removing that permission from folders (especially roots of drives) because that will break some other programs.  So as it stands now, if my server is compromised, even that basic user EmbyServer can cause some damage.  This can be fixed if I move to Docker, but I'd really rather not.

I'm a new Emby user having come over from a decade+ of Plex.  Has anyone had their Emby server compromised?  If so, was it a bug or something you did or didn't do with your home firewall?

-----------------------

Further info: I front Emby app with pfSense.  I use my own domain and SSL is managed with ACME.  Emby is piped through a reverse proxy haproxy with very curated permissions.

• Requests have to match my https://embyserver.mydomain.com exactly, or they are denied.
• Run it on a high port
• If any IP tries to login more than 45 times in a few minutes, I block them.
• Prevent long URL path hunting
• and more

 

[Abobader 3516]

Hello rob51,

** This is an auto reply **

Please wait for someone from staff support or our members to reply to you.

It's recommended to provide more info, as it explain in this thread:

Thank you.

Emby Team

[rob51 0]

4 times, not 45 times!  I can't seem to edit that post.

[Luke 43136]

Quote

install to a Docker container within Windows

Hi, just be aware, we have not been testing our docker container on windows at all, so we really have no idea how that would go.

[Apotropaic 75]

Hi, what you’re doing is more than the typical user so you’re in a good position already.

I used to front my installation with pfSense years ago so my memory is a little hazy but apply some Snort/Suricata signatures to help detect port scans, brute force attacks as well as any other suspicious activity going on. Got to be careful how many you turn on…

Would also be useful to implement ‘pfBlockerNG’ which can block ‘known’ bad IPs from various threat intelligence feeds, as well as applying geoblocks etc.

As for the windows side of things, if performance and GPU transcoding aren’t at the top of your requirements you could run Ubuntu within Hyper-V on your machine, and run Emby inside that.

You won’t be able to mount USB drives to it but you can always create network shares and do it that way.

Edited 1 hour ago by Apotropaic

[rob51 0]

Yeah I'm still debating a move like that, but need to research a bit more if all my GUI acceleration is available and that another layer of abstraction doesn't cause performance issues.  I suppose there is one way to find out..

I go one step further than GEO blocking.  I whitelist my Emby access firewall rule with only ASN's from potential users and friends -- all the common broadband providers and such.  I also have higher level rules that block the ASN's of all known scanners and other downloadable ACL's for known bad guys.  My only worry now is if they get in, but I'm probably the least likely person at this point.