Server Version#: 1.16.2.1297-4b7ace214 (amd64 Ubuntu Linux)
Player Version#: Web and Roku
My Plex server is connected to Plex via a paid Plex Pass. Seemingly anybody is able to logon to the Plex interface on my Linux Plex media server, publicly available on port 32400, by simply creating an account at Plex - offered at the time of logon attempt by either e-mail, Google account or Facebook account - and retrieve a bare-bones interface hosted on my server. They do not have access to any of my local or shared libraries but they are still presented with an interface asking them to install Plex Media Server. They are able to access plugins like News, TIDAL (why are you all connecting this garbage in anyway?), podcasts, web shows, etc. My “guest user” is disabled as well, yet it doesn’t matter because someone can just make an account and it is accepted for login.
Again, this is a random e-mail based Plex account I created on-the-fly after accessing my server via https://:32400/. Anonymous users on the Internet are able to access resources on my server (besides my library, at least it appears that way) despite only two users being permitted logon to my server. I do not know if this is a side-effect of being connected to the ‘Plex cloud’ / plex login infrastructure via the paid pass or what as I haven’t used my server in a non-paid capacity in quite a while, but it is very irritating and concerning.
My concern is that someone may be able to access either my libraries, the server filesystem, other resources on the server, originate queries from the server, etc. should there be some vulnerabilities within the primary web server interface. What with the whole interface changing in the past year or so (which blind-sided me and forced me to upgrade my whole setup from my Roku - the new client interface is laggy on Roku SE - to my server) without warning and without option, I imagine there are plenty of bugs yet to be discovered. And being a guinea pig for these bugs to be exploited because my server is publicly accessible is unsettling.
Authentication should be authentication - if a user isn’t authenticated, he should not get beyond the logon process. Yet, here I am able to create an account and access.
A search for Plex server security pulls up a lengthy page about SSL and DNS rebinding. SSL is not making access to my Plex server secure, it’s just encrypting the connection end to end and ensuring that the server on the end is actually my server (although, not really, unless there’s a signed cert) / preventing MITM. I however cannot imagine why anyone would be conducting a MITM attack to steal Plex credentials. I can imagine, however, why someone would want to be able to get basic access to the server interface via an unprivileged / user without shared libraries so that they can try and exploit scripts on the server.
Is there a way to allow ONLY the permitted users (the two in my list with whom I share libraries) to logon at all to my server? Do I need to disconnect from the Plex Pass in order to achieve this? What’s the deal here?
Thanks
