Server Version#: ALL
Player Version#: N/A
Hey folks,
So it’s simple enough to dig around the logfiles for good authentication, user IDs, players, etc, but I am curious to what degree Plex logs failed attempts from the internet.
I’ve tried to manufacture some bad logins to generate something in the logs and haven’t really had any luck-- am I missing something?
More of an admin thing than a gripe-- the product has been flawless for me.
Cheers!
Attempts at what?
Failed logins to the Plex server.
For now I just have some scripts look through logs for some specific strings but if Plex has some sort of bruteforce protection in place (and it seems to-- my bad logins generate a warning about lockouts eventually) then which component is doing the auth, bruteforce protection, etc, and where do they log?
In short, if my server is being scanned and/or attacked from the internet, where will it show up in logs?
Cheers
You don’t log into PMS. You log into your Plex account. Only after you’ve logged in can you access the server, so there is no way to log a failed login attempt to PMS, since that can never happen.
The only time PMS would log anything similar is if a client’s specific token expired/revoked, etc. Those are logged.
So if I go to Shodan and look for default port 32400, I get ~380k devices exposing this port to the internet, 99% of them running plex (go plex!). The way the auth flow works for all those exposed devices is essentially a redirect to app.plex.tv? Going to https://MYIP:32400 at least shows up in the logs for the login page resources being served (I can see these in the logs when I grep for WAN for instance), but that’s it?
Thanks again for your quick responses.
If you access a server’s IP directly you are accessing the local Plex Web client that comes included with PMS. We do not log access to Plex Web in the PMS logs. If this is the first time logging into the local Plex web, then yes you will get redirected to plex.tv to authenticate yourself.
Sounds good. Thanks for the clarification and thanks for the product.
Cheers!
This topic was automatically closed after 90 days. New replies are no longer allowed.
