Security security security

[rliepins 9]

Hi all

 

Holy cow, the web is such an unsafe place.  Hacks of major sites abound and major companies are getting caught with their pants down.  So this begs the questions - how secure can Emby be made?  Is there a way to lock it down?  How is the Emby user database and website protected?  How can we protect our open servers?  All these questions....so how about we discuss what the current security model is now and how can it be made better.

 

Sorry for this most general of topics, but I see this as a major issue that we, as a community, should take a long, hard look at.

 

 

[jody 4]

Most secure way will be to don't have it connected to the internet or lan that has internet. 

Else you might want to consider not to make use of the web-client but only the server and if you need it to be on the internet, make it available only via your own vpn server that you can on the same server. 

[Raff 51]

Sorry for this most general of topics, but I see this as a major issue that we, as a community, should take a long, hard look at.

Actually, there are two different topics here. First is "How secure can I make my Emby install?" and the second is "How secure is Emby Connect and this forum?"

 

 

how secure can Emby be made?  Is there a way to lock it down?

Yes - install Emby from the website and then disconnect the server from the network. The downside is that you must use that machine to watch your media and metadata would need to be manually managed. Personally, I would think this makes Emby pointless, but security is a trade-off between usability and safety. In this case, maximum security, but minimum usability.

 

Next would be to attach the server to a LAN that is not connected to the internet. Then you can enjoy your media from any other system connected to that LAN, but still have that pesky metadata problem. To solve the metadata issue, you must allow outbound connections to the metadata providers. For the really security conscious, you can even limit the access to the metadata provider and loopback everything else. Pretty high maintenance, but it would prevent someone from pumping data off your server after an attack unless they rooted your server.

 

Which brings us to the actual threat - if someone has root access to your server, by whatever means, you are doomed. There is nothing you can do to stop them pretty much doing anything they want. Since these are home servers for the most part, I'll shorthand the physical security discussion with - don't let untrustworthy people spend time alone on your computers. On the software side, you should know your router, firewall and OS security features. Keep them up-to-date and make sure they have the minimum permissions to do what you want them to do and no more. One thing of note - if you have UPnP enabled you probably want to check your router to see if it has assigned an inbound connection. UPnP is a pretty convenient way to get stuff on your network to see each other, but it can also open up access you don't want. Again, if you don't use external connectivity, don't allow it.

 

If you need external connectivity then you really should take into consideration how safe Emby as a server and/or Emby Connect as a service is. I don't know enough about secure C#/.NET programming to audit the server code, but it is open source and you can. I don't use Emby Connect, so I can't speak to it at all. Installing a certificate at this point will provide some protection to remote users' passwords and provide a bit of privacy, so I would recommend it.

 

Lastly, the thing a lot of people forget when it comes to security is monitoring your systems. Security is an ongoing effort, not a one and done thing. While there are some automated applications (virus and malware scans for example) you want to be familiar with the status panels/Recent Activity (can you identify all the things that accessed your server?) and logs (is it reporting some unusual activity?) so you can detect when something doesn't seem right.

 

This is a big topic and I am sure the community has myriad opinions on this subject. However, don't feel slighted if this doesn't become a popular thread - sometimes the BIG topics are too broad for people to chime in on.

[chef 3810]

I know that the password/ user authentication for each account is pretty solid.

 

Not sure exactly how emby connect works, because I don't use it really.

 

The classes used for authentication of user accounts is based off the .net cryptograph namespace. That is super hard to break unless you have the key, which is your password.

 

The cryptograph namespace encrypts the information on a couple different levels.

You'll have to excuse me if I don't remember exactly the two kinds of encryption available through .net, MD5 and SHA1.

 

You would have to correct me, but I believe the server uses SHA1 to encrypt the password.

 

 

Also, emby allows for manual logins which help hide admin accounts (they won't be shown on the emby login page).

 

I feel pretty safe as far as user logins go.

 

I am not sure the relationship with the image providers/metadata providers, but

I still feel safe with regards to emby.

[ShaRose 0]

If you want it to be secure, use a strong password with Emby connect and don't forward ports. If a remote attacker can't see the server he can't touch it.