Local user without password can login even with connect account set

[Kryptonit3 0]

I am trying to make sure my server is secure. I noticed maybe an issue, but maybe it's by design.

 

I have the main admin account we will say it's username is Dad. I also have my emby connect account username Kryptonit3 added in the user settings.

 

My local account Dad does not have a password. My emby connect user does. If someone goes to my login page remotely they can just enter in any username that does not have a password set regardless if an emby connect username is set as well and get in without issue. I have unchecked the box that allows those usernames to be hidden from remote login page, but if someone tried random common usernames and they happen to coincide with a local user without a password they can get in.

 

To recreate. Create a new user, no password. Add their connect username. Go off network or use VPN to pull up your emby login. You will be able to login with the connect account and password, and the local username without password.

 

I saw mention of using a pin number in a few posts during my searching but they were dated 2016 and since I cannot find it I am guessing it has been removed.

 

Plex has recently created two separate areas in their admin panel, one for home (local) users, another for "Friends". I am new to emby and am migrating away from Plex. Is there a way I can allow my local accounts to remain without a password so the different members of my home can choose their profiles without hassle but disallow accounts without passwords to login remotely?

 

Also, for accounts that I have added the users connect username (which will always have a password) can you set it so that their local username (Dad in above example which does not have a password) cannot login and the connect account takes precedence?

 

Thank you for your assistance!

Edited October 30, 2019 by Kryptonit3

[ebr 16676]

Yes, that is by design.  We don't force someone to have to go through Connect just because an account is attached.  Your local credentials will always work.

 

You need to simply provide a password for the account.

 

This is different from the other guys because our entire philosophy on your users is different.  We never want to have to force you to go through us in order to log in to your server.

[Kryptonit3 0]

Yes, that is by design.  We don't force someone to have to go through Connect just because an account is attached.  Your local credentials will always work.

 

You need to simply provide a password for the account.

 

This is different from the other guys because our entire philosophy on your users is different.  We never want to have to force you to go through us in order to log in to your server.

 

Thanks for the quick response. Is there a possibility of a feature to disallow non password logins remotely in the future? If I am in my living room and I am done watching emby, and my wife wants to open her account it is going to suck having to keep typing in the password to switch between local users.

[ebr 16676]

Hi.  Take a look at the settings page for each user after you have supplied a password for them.  I think you'll find that you can accomplish what you want - albeit in the opposite way...

[Kryptonit3 0]

Hi.  Take a look at the settings page for each user after you have supplied a password for them.  I think you'll find that you can accomplish what you want - albeit in the opposite way...

 

 Ok, I found it. When on the password tab of the user the local network access box is hidden until you set the password.

 

 

An unrelated question:

 

https://github.com/MediaBrowser/Wiki/wiki/Emby-Connect#sending-an-invitation

 

Invite with emby connect seems to be missing on my add user screen.

 

Do I need to create a local user first, then manually add their emby connect username once they send it to me to allow access?

[ebr 16676]

https://github.com/MediaBrowser/Wiki/wiki/Emby-Connect#sending-an-invitation

 

Invite with emby connect seems to be missing on my add user screen.

 

Do I need to create a local user first, then manually add their emby connect username once they send it to me to allow access?

 

Yes, that invite process has been deprecated (we need to update the docs).

[Luke 43041]

@@cayars will be updating that wiki. Thanks for the feedback.

[DaninFuchs 1]

I was just informed by a trusted friend that they were able to remotely log into my server without a password; they simply used their email address. They have an Emby Connect account, but by logging directly into the server with no password they only needed their email.

 

I understand that the intent here is "you aren't forced to use Emby Connect once it's turned on" but --

How many server admins know that they have accounts with no password requirement? Isn't it kind of insane to not inform am admin that empty passwords are accepted when creating new accounts? How many admins knew that Emby Connect was non-binding and optional so every account they made and linked is a gaping security hole?

This NEEDS to be mentioned in the process of user creation.