Does the plex user require access to any Synology applications?

[Pyrroc]

Sorry if this has been answered elsewhere, but I can only find topics on share/folder permissions.

The user “plex” defined on my Synology by default has access to DSM, FTP, File Station and rsync.

In the interest of pedantic security, can I safely deny plex rights to those applications?

[FordGuy61]

Just looked and they’re denied on my DS918+ and it does not cause any issues. I do not know if the PMS installer denied things or if I did it at some point. Don’t remember ever checking.

[ChuckPa]

Plex is defined as if any other user however:

1. It runs as a service
2. Synology required I use their synouser utility
3. It has a 256 bit random password which changes every time you update the package

Here is the actual script segment

synouser --get plex 2>1 > /dev/null
if [ $? -ne 0 ]; then

# create user with random password
  echo "Creating Plex user."
  synouser --add plex $(uuidgen) 'Plex User' 0 '' ''
else
  echo "Securing existing Plex user"
  synouser --setpw plex $(uuidgen)
  synouser --modify plex 'Plex User' 0 ''
fi

Having plex be a normal user gives you full control over what shares it can see on your NAS.

[Pyrroc]

@FordGuy61, thank you.

@ChuckPa, that’s cool. I have no issues at all with plex being a defined user, I was just interested in reducing attack vectors. With “plex” being a well-known username on every Synology running PMS, it becomes a vector that an attacker could possibly use. Hypothetically let’s say there was a vulnerability in DSM that somehow allowed access without a password as long as one knew a valid username. Hopefully denying that user access to DSM would mitigate that.

Ideally the plex username would have a uniquely (to each installation) generated suffix at the end, e.g. plex-A6zw2J, so that it was extremely difficult to guess, and even then I’d likely deny it access to the apps. It looks like that would be very difficult to do given the requirement of using the synouser facility to query for an existing user unless that value were able to be derived consistently from data available prior to making the query.

I appreciate your time and assistance.

[Pyrroc]

@ChuckPa, looking at the CLI guide, it looks like it might be better to use a zero in the last parameter, “app_privilege”, of the create user statement rather than the ‘’. I would assume that ‘’ equates to a null or empty string when it’s looking for a number.

synouser --add plex $(uuidgen) 'Plex User' 0 '' ''

would become

synouser --add plex $(uuidgen) 'Plex User' 0 '' 0

[Pyrroc]

@ChuckPa

Sorry to go on about this, but I noodled on doing the suffix-style plex userids.

So we start with 3 cases:

1. No userid
2. Classic “plex” userid
3. New suffix-style userid

Going to just high-level the process…

set plex_username to “”
use grep “Official Plex PMS User” on /etc/passwd to determine if new-style user exists

• if so, use awk to extract value into plex_username
• if not, generate new-style user (e.g. grab last 6 or 8 characters of $(uuidgen)) and set plex_username

The rest closely follows your existing process with slight modification:

use synouser to check for classic plex userid

• if not:

    - create userid: synouser --add $plex_username $($uuidgen) 'Official Plex PMS User' 0 '' 0`

• if so:

    - rename the classic account: synouser --rename plex $plex_username
    - reset the password: synouser --setpw $plex_username $($uuidgen)
    - modify the account: synouser --modify $plex_username 'Official Plex PMS User' 0 ''

To summarize, this is all very likely easier said than done , but maybe worthwhile for security purposes in the future.

[ChuckPa]

I appreciate the input but

1. The Plex username is plex. It’s established.
2. I must consider ALL the users.
3. As it stands now, it’s a non-privileged account.
4. While Synology uses Linux, it is not a “desktop Linux” environment. It is a “minimum-required to-task” environment.

Your thought-experiment has given me some additional input for securing the the account even further. I will do this.

To answer your OP.

1. Plex doesn’t require any Synology applications
2. Plex should never be used as a ‘Login’ account because it’s a service.
3. Please consider username plex the same as you would any other Linux service account like lpd, sync , mail, etc. Plex Media Server is a service application on the host – Nothing more.
4. If, when the installation scripts run, anything is missing, or misaligned, they will restore the package runtime environment to what it knows to be a runnable state.

[Pyrroc]

@ChuckPa,

Thanks for your time and consideration.