Security concerns over port forwarding for plex reddit / selfhosted ---------------------------------------------------------------------- Saso23 · 2023-12-02 01:01 Hi everyone, I have been self-hosting my services for a while now, and when I tried for the first time I made the rookie mistake to port forward my port 22, and as you can guess my server got hacked. Since then, I have re-imaged the whole thing and disabled ssh through password (only machines with ssh key can login). I am now trying to port forward for a few services (Plex and a Minecraft server), for which I am even using a different port externally (i.e. port 670 externally is mapped to 32400 internally). What are the chances that someone can still hack into the server through these ports? ---------------------------------------------------------------------- iamofnohelp · 2023-12-02 01:09 They can still find the open port. Don't think you're any better using a custom port. Proper security and strong passwords and MFA are still needed. ---------------------------------------------------------------------- zedkyuu · 2023-12-02 01:18 The chances are hard to quantify, but they are definitely nonzero. It's entirely dependent on how secure the software is and continues to be, and knowing that is of course basically impossible without huge amounts of scrutiny. And even if the vendor can immediately patch every single issue that they become aware of (and you can apply these patches immediately, too), you're still vulnerable to issues that others figure out first before the vendor learns about them. There's some security in obscurity (people may not care as much about breaking into consumer-focused software) but it's also hard to quantify. So I would say if you are concerned, work to limit the damage. Isolate the services from each other and also from any particularly sensitive data you have. The gold standard would be to have them all live on separate physical machines but that's pretty impractical. VMs and containers can help to keep things isolated but they introduce an additional layer of configuration and potential vulnerabilities. Consider using something like a DMZ to hold the external facing services and then set up specific ACLs to permit required internal access (e.g. set things up so that Plex can access a common fileserver for media files, but limit it so that it can only access those files and only in certain ways). ---------------------------------------------------------------------- subven1 · 2023-12-02 01:18 Chance is low but the correct answer is: it depends. If the service you are running has known RCE vulnerabilities that are used in the wild, you are doomed again. Switching the port to something non standard helps but is not bulletproof. The best way to protect yourself is keep your system and services up to date. Opening port 22 can be bad. Having password authentication enabled or let root login via SSH is bad. Use a user + password combination that is commonly used / brute forcible is veeeeery bad! Hope you learned your lessen. If you need SSH, fail2ban or blackhole helps. ---------------------------------------------------------------------- ericesev · 2023-12-02 01:23 100%. Go over to [https://www.shodan.io/](https://www.shodan.io/). It's super easy to find all the services on non-standard ports. ---------------------------------------------------------------------- zedkyuu · 2023-12-02 01:24 Properly maintained and configured SSH should be safe. Numerous large companies (e.g. Google) use it as the external touchpoint for controlled internal access, so there are a lot of eyes on the code as a result, and if a security hole should open up, adversaries will very likely go after the big fish first. But "properly maintained and configured" means kept up to date, public key or certificate authentication, etc. I get nervous when I think about the variety of appliances out there that have SSH built in with no means to update it other than system updates from the vendors. ---------------------------------------------------------------------- multidollar · 2023-12-02 02:54 Think about it this way, there are bots that scan the entire valid port range. It’s easy to discover a service running on any port and detect what it is. Cybersecurity is an entire industry. Major companies that run internet facing applications spend tonnes of money on securing infrastructure. If you’re hitting a popular website, you’ve passed through security measures you don’t even know about, like web application firewalls and the like. People who expose things to the whole open internet do so out of necessity. And any time I’ve worked for a company offering web services, I have constantly looked for alternatives to have the least amount exposed. Having Plex (or any application) exposed to the internet means that the second a flaw is found, it gets exploited. I think (without looking it up) that NextCloud or OwnCloud recently had a vulnerability that resulted in them saying “just don’t expose it to the internet until we fix it because it’s being actively exploited en masse”. ---------------------------------------------------------------------- funkbruthab · 2023-12-02 03:57 My plex was hijacked once. I was using a password that was common to my email address (it wasn’t my email password, but I had a habit of using variations of the same password for two decades), and was readily available from database breaches distributed on the dark web. I was out of town, and couldn’t access my server anymore, checked my email and saw emails about plex confirming my change of password and change of email. Clicked on the “that wasn’t me” hyperlink but still didn’t have my server back (self hosted, online and running at my house), so I called a buddy to go over and power down my pc that was hosting. Changed my passwords for everything (never went back to my reused passwords) and haven’t had a problem since. Nordvpn has a nifty feature that will tell you when your email is featured in a dark web data dump, so you know to change those passwords - but nothing beats 2fa. Don’t sweat opening up services to the internet if it’s “essential” to you, just do it wisely. Good passwords, 2fa, and keeping systems updated is enough to keep you 99.9% safe. I know so much more about this stuff now, I wish I could do forensics on that machine to see what happened when it happened. Never even reformatted the windows pc, just got my plex back and kept it up for the next 3 years until I moved into a proxmox machine a few weeks ago. ---------------------------------------------------------------------- Saso23 · 2023-12-02 05:01 Yes, I definitely learned my lesson. I forgot to mention I am running Ubuntu and all my services are in docker containers (except plex, which I plan to move to a docker container soon). This time around, I set-up a password with a bunch of random characters and server is only accessible through public key (no password and no root login). The only thing I still have to set up is 2FA and fail2ban. After doing this, and keeping the server always updated, am I safe to consider it secure enough to port forward 32400 for plex and 25565 for minecraft? ---------------------------------------------------------------------- Saso23 · 2023-12-02 05:04 Yeah basically similar thing to what happened to me. When I was hacked, I actually didn't find out until one day I had to work from home and my laptop would not connect to my company's VPN, and when talking to infosec I was told my IP address was flagged as malicious, and that's when I found out my server was hacked and was being used to brute-force into other servers. This time around, I set-up a password with a bunch of random characters and server is only accessible through public key (no password and no root login). The only thing I still have to set up is 2FA and fail2ban (I am using Ubuntu 20.04, debating whether I should upgrade it to 22, but I don't want to risk breaking services as I'm in the middle of exam season in university and wouldn't have the time to set it all up again until the winter break. Anyways, after setting up 2FA and fail2ban, am I right in feeling I should be safe to port forward Plex when I need to do so? ---------------------------------------------------------------------- Saso23 · 2023-12-02 05:06 I deploy all my services as docker containers, they should be pretty isolated as they stand no? Please correct me if I am wrong, I am not the most informed on Docker other than knowing how to start containers or containerize applications I develop from time to time ---------------------------------------------------------------------- Saso23 · 2023-12-02 05:07 That is always my fear, the fact that a single vulnerability in an application could potentially expose my information on the internet even though my server is secure. ---------------------------------------------------------------------- subven1 · 2023-12-02 05:15 Yeah, thats the basics and should be okay. ---------------------------------------------------------------------- Mijago · 2023-12-02 06:55 I switched to keepass a few years back, and now Vaultwarden. I never use the same password twice and they are always generated passwords. Also, everything facing the public is behind authentik with 2fa, so that's my single point of trust & failure. Not sure if this is a good idea hmm. Some services also have an IP whitelist in the traefik Labels, to ensure that I can only use them when I am either home or in my vpn. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-12-02 10:56 Should be fine but if you listen to everyone here the general feeling here is you'll be hacked the minute you go online with an open port. There are tons of people running plex as for port scanners when I ran plex (not behind a reverse proxy) I never saw myself on shodan when I had a none standard port. Do keep your software up to date. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-12-02 10:57 Sure but most are just scanning common ports. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-12-02 11:02 Then reduce the noise. I geo block all connections, perfect no but stops most of the world from connecting to my exposed ports. Hell for plex I only allowed my country and the AWS servers required for login at one point but found it easier to just put it behind a proxy, now AWS is out of the picture. ---------------------------------------------------------------------- Budget-Supermarket70 · 2023-12-02 11:05 Hard to put plex behind authentik if your using non pc clients. ---------------------------------------------------------------------- javijuji · 2023-12-02 12:11 Why do you need to port forward ssh? You are better off setting a VPN for ssh access and only forward port 32400 (or whatever port you are using for Plex). ---------------------------------------------------------------------- sarkyscouser · 2023-12-02 14:33 A reverse proxy will help, Caddy is probably the simplest to set up. Then you can forward ports 80 and 443 to caddy and close your Plex port. You will need a domain/sub-domain or ddns to do this. ---------------------------------------------------------------------- carlinhush · 2023-12-02 15:00 Start out with setting up VPN access. No need to port forward anything else yet still you can access any services in your home network from anywhere safely. Wireguard e.g. If you still need to set up a direct, meaning non-VPN tunneled, access to anything, let's say Plex, look into adding additional layers of security between it and the Internet. Like a Reverse Proxy. Web application firewall. Geo-blocking measures, Cloudflare proxy. ---------------------------------------------------------------------- Saso23 · 2023-12-02 15:14 Would you recommend looking into nginx reverse proxy or is there a better way that I could research on? ---------------------------------------------------------------------- Saso23 · 2023-12-02 15:15 No no I do not want to port forward ssh, that was just my mistake the first time around. This time I just want to port forward few services like Plex and minecraft server ---------------------------------------------------------------------- Saso23 · 2023-12-02 15:16 Thanks! This is great advice! ---------------------------------------------------------------------- javijuji · 2023-12-02 15:35 If the containers are sharing a bridge network then they can see each other. If someone gains control of a container and it has /var/run/docker.sock they basically have root privileges. ---------------------------------------------------------------------- InvaderDoom · 2023-12-02 19:52 That’s how I have mine set up, I have domain for my plex that routes to my firewall as 443, then hits my Nginx proxy and routes it to 32400. Additionally, only IP addresses coming from Cloudflare proxies are allowed to get through 80 or 443 ---------------------------------------------------------------------- ericesev · 2023-12-02 20:24 I use a reverse proxy, but I look at the reverse proxy the same way. The second a flaw is found, it gets exploited. The question is how do you mitigate that. Here is how I look at it. * Have two factor authentication enabled in the proxy. Use security keys; they're not phishable and their private keys cannot be stolen by malware. Every request should need to be authenticated by the reverse proxy before allowing the request to proceed to the backend service. This breaks some mobile apps, but just avoid mobile apps entirely; using them just adds more code and more risk. * Make sure you're keeping it updated regularly. The best way to stop known issues is to not run software with known issues. * Many remote code execution vulnerabilities can be avoided by using applications that are written in memory safe languages. Caddy & Traefik are both written in memory safe languages. * Have solid logging, monitoring & alerting. If your reverse proxy is doing something odd, you need to be alerted right away. Alert on things like an abnormal number of successful logins, successful logins from outside normal ISPs, non-http errors, and process crashes. * Limit the scope of what the reverse proxy can access on the local file system. A reverse proxy shouldn't be able to run a shell, or access other application's configuration files. Only permit the reverse proxy to access what it needs with SELInux/AppArmor or similar sandboxing tools. Configure SELInux/AppArmor to crash the process when a violation occurs. Send alerts when this happens. * Similarly, a reverse proxy shouldn't be making connections to the internet. It should only to specific internal services. Configure the firewall appropriately and alert if the reverse proxy tries to make connections that are not allowed. * Don't have your backend services blindly trust the reverse proxy. If you use SSO, have a token, like a JWT, to validate the user in the backend. Or have a separate login use for the backend. All of this applies to other forms of remote access too, like VPNs.