securing emby

[sixtysix 1]

Hey dudes.  There has been a lot of progress since I last used mediabrowser on wmc.  Currently I am using plex but thinking of switching to emby after watching a video on emby on xbmc.

 

However, I'd like to setup emby similar to how I have most of my services setup for secure remote access, behind an nginx reverse proxy using ssl and basic authentication, which uses the authorization header.

 

The problem seems to be that emby also uses the authorization header.  Here is another user trying to work through the problem.  https://github.com/MediaBrowser/MediaBrowser/issues/1113

They chose to turn off basic authentication in nginx.

 

Any ideas on how to get reverse proxy with basic authentication and emby to play together nicely?

 

 

[Luke 42077]

i think a lot of people here are doing that. you just have to make sure the header value is preserved

[sixtysix 1]

Ok, I'll just have to wait for someone to chime in then.  The browser sends up the authorization header for basic authentication which overwrites the custom value that emby tries to use.

[xelar 4]

Hi

 

Why do you want to use basic authentication in addition to emby's user login interface? In User - Advanced, you can choose to hide every user from the web interface and display Login-Password only.

 

I have that running very well behind a nginx proxy and ssl.

 

Cheers

[sixtysix 1]

I'd like to access emby remotely.  I didn't spend a lot of time looking into emby's security, although it looks like it uses a custom authentication.  I don't know how it works or if I can trust there aren't exploits.  At least with nginx, ssl, and basic authentication, it is less likely a vulnerability will be found without being patched.

 

I read some forum posts on here where people were saying that certain parts of the ui were accessible without logging in and things of that nature.  So I'd feel safer with that extra level of security.

[xelar 4]

Oh really? I didn't know that, can u point me to those posts/threads?

I'm accessing it remotely, too...

[sixtysix 1]

Here are two i found.  It looks like they've been resolved, I am just trying to be extra cautious.

 

http://emby.media/community/index.php?/topic/20376-all-folders-visible-to-all-users-after-upgrade/

http://emby.media/community/index.php?/topic/12335-unauthenticated-access-over-the-internet-to-logs-folder/