dogs0n

I mostly found it funny they felt the neet to upgrade from mint on a family members computer to anything else, because I can't imagine mint not already working fine for them.

I fail to see the benefit in "Upgrading" to kubuntu (or anything else) in this case.

But yes u right hehe arch btw but also mby mint btw 🤔

Upgrade Mint to Kubuntu 💀

Hehe yep, that's a good takeaway and the same as what I think.

Thank you too, i enjoyed this discussion.

No problemo.

Thanks for pointing out the reverse proxy comment. I think I was wrong to say simply putting jellyfin behind a reverse proxy will increase your security.

The benefits may only be minute or non-existent if you don't use the reverse proxy for handling other stuff like HTTPS (and redirects to https, etc), restricting access or adding extra authentication requirements (mainly https).

It may also be good to note that Jellyfins docs explicitly do not recommend directly exposing jellyfin ports to the internet (a reverse proxy or using a vpn are recommended instead).

Still I will continue to feel safer always using a reverse proxy when I expose to the internet (maybe my misconceptions).

Your SSH setup is good.

ssh is a very resilient piece of software so I doubt with your setup you would encounter any issues.

Enforcing use of a VPN to get into your network before being able to ssh into a machine is mostly just an extra layer of defense, though using a non-standard port, only allowing key logins and disabling root user login are all layers of defense you have already added.

I thinj you'll be fine, but if you are worried, you could setup a VPN or alternatively something like Fail2Ban if you notice any brute-force attacks (which may be unlikely with the use of a non-standard port).

What I meant with the Jellyfin question was kind of, how is having it exposed via a reverse proxy different from exposing its port right away? Is it because the only allowed connection would be HTTPS/encrypted etc, maybe?

It's down to how secure the software is really.

Jellyfins (and other software) don't use really secure web servers for getting themselves accessible via the network.

Caddy (a reverse proxy, for example) is made to be exposed to the internet and so it is more resilient and safe to use.

So putting the resilient software (a good reverse proxy) infront of Jellyfin (or most other software) simply increases your security by having the more safe web server be the one interfacing with end users.

Have fun on your journey!

If you don't want to worry too much, you can setup a vpn (like wireguard) on your server for ssh access.

Using a non standard port is a good idea, but not entirely foolproof because bots might still port scan (even if unlikely that they do that for ssh I'm not sure). At a mininum, you probably want to use keys for login like the other commenter on the main comment said.

Personally, using a vpn for when I want access to SSH when I'm out is worth the couple hours setting it up the one time (very simple setup with wireguard-easy for example). Maintenence time spent on upgrading is very low.

(Tl;dr personally I'd use a vpn to access ssh specifically rather than exposing it to the internet)

Same thing for Jellyfin?

Not 100% sure what you mean, but to clarify: Don't accidentally expose jellyfins port to the internet (eg the default port 8096). Make sure it is only accessible from outside your network through your reverse proxy.

I agree, there is a lot of paranoia, but honestly that's probably a good thing, because the people who are paranoid might not know that much, so a good amount of paranoia is healthy there.

The chance of being exploited is very low for me to care too too much. Why spend countless days locking up my entire infra when there's a very low low chance anyone could exploit me in the first place (obviously get your setup to a good standard, I don't recommend not reading up on anything and exposing server, etc. Just for me, I don't need to over do it).

That being said, personally I have ssh behind a vpn because that's a very important service that only I am accessing anyways, so it makes sense for me to disable that attack vector.

Cool, thank you for the knowledge!

If your app interfaces with the OS, like most apps would (reading a file, managing the window, etc), then you would be writing rust, no?

Doubt it

The default configuration for Jellyfin is good. I mostly mean as long as you follow best practices in general you should be fine, eg:

• You keep your system and jellyfin updated;
• have some type of firewall in place;
• make sure you aren't accidentally exposing jellyfins port directly to the internet;
• have a good password for your jellyfin accounts that are able to login from outside the LAN;
• and so on and so forth

https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/

A firewall is probably the most important, having your ssh port blocked in the firewall being second.

As long as your jellyfin server is properly configured behind a reverse proxy, letting it be accessible publicly on the internet is fine.

Obviously everyone has their own threat model, but it's not that big of a threat in this case (personally I don't care).