2-Factor Authentication (2FA)

[yocker 1575]

Disable admin account from outside and use VPN when needing to use the admin account should make files secure.
Keep an eye on where users connect from once in a while, there are plugins for that.
Blacklist countries you have no users in.
Make sure users don't set 1234 as password.. Emby needs a feature for minimum lenght and special character passwords
Correctly set up proxy instead of direct Emby access.
Tailscale funnel also works very nicely and doesn't require "outsiders" to have tailscale.

Not saying 2fa isn't needed, just that there are other ways to secure the server.

[muzicman0 86]

I honestly don't understand the 2fa on just admin accounts.  I don't want ANYONE logging into my server that I don't know, admin or not.

[ugenest 1]

On 3/4/2026 at 12:44 PM, ugenest said:

+1 for 2FA for the admin account

for any account would be better (that would be perfect), but than nothing, it should be at least for the admin account

[yocker 1575]

3 hours ago, ugenest said:

for any account would be better (that would be perfect), but than nothing, it should be at least for the admin account

If only the admin account then a VPN would be easier and better.

[bandit8623 241]

On 3/8/2026 at 11:42 AM, yocker said:

If only the admin account then a VPN would be easier and better.

using 2 factor auth vpn i disagree.  extra work compared

[yocker 1575]

39 minutes ago, bandit8623 said:

using 2 factor auth vpn i disagree.  extra work compared

VPN is typically easy to set up and a click of a button to connect once set up.
IMO the most amount of work is opening the port for it if not using tailscale.

[bandit8623 241]

9 minutes ago, yocker said:

VPN is typically easy to set up and a click of a button to connect once set up.
IMO the most amount of work is opening the port for it if not using tailscale.

thats if you use tailscale i guess. i use openvpn with 2fa. nothing touches my internal network.  all done on opnsense

Edited March 10 by bandit8623

[yocker 1575]

6 minutes ago, bandit8623 said:

thats if you use tailscale i guess. i use openvpn with 2fa. nothing touches my internal network.  all done on opnsense

I use selfhosted Wireguard my self. No need for 2fa for me when only i have the keys.
Other users that use my VPN have their own network and shares so can't harm anything.

Different needs for different uses ofc.

[bandit8623 241]

Saw this and thought Emby could do something along this line

https://blog.noip.com/what-is-no-ip-public-tunnels-a-modern-approach-to-remote-access?utm_source=email&utm_source=email&utm_medium=promo&utm_campaign=2026-march-promo-paid

Edited March 17 by bandit8623

[caffeineshock 18]

Yeah, no. Basically a reverse proxy. Does not solve the problem

On 3/17/2026 at 12:28 PM, bandit8623 said:

Saw this and thought Emby could do something along this line

https://blog.noip.com/what-is-no-ip-public-tunnels-a-modern-approach-to-remote-access?utm_source=email&utm_source=email&utm_medium=promo&utm_campaign=2026-march-promo-paid

 

[bandit8623 241]

11 hours ago, caffeineshock said:

Yeah, no. Basically a reverse proxy. Does not solve the problem

 

of course it does. everyone that would connecting via this method uses 2fa. would be an option to use if added correctly.   thats what you wanted.  With link sharing you woudlnt even need 2fa as only the device with the link can login.  its just an idea.  dont throw it out so fast as its not just like a reverse proxy..

Edited May 9 by bandit8623