search

wernight / docker-plex-media-server

Dockerized Plex Media Server
https://registry.hub.docker.com/u/wernight/plex-media-server/
MIT License
128 stars 34 forks source link

Removing --net=host bypasses login #24

Open magicknot opened 8 years ago

magicknot commented 8 years ago

Whenever I remove --net=host the login screen seems to disappear, allowing anyone to see the server as my user (I'm the owner).

wernight commented 8 years ago

I think you're logged in. Try to close all windows and start an incognito. It's also not likely an issue with this containerize image.

magicknot commented 8 years ago

I tried it on incognito before opening this issue.

wernight commented 8 years ago

No sure if you're using latest or autoupdate tag and which environment variables you're setting.

magicknot commented 8 years ago

I'm sorry for the lack of information in my post. I'm using the latest tag and doing docker inspect on the container, the env is the following:

            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "PLEX_MEDIA_SERVER_MAX_PLUGIN_PROCS=6",
                "PLEX_MEDIA_SERVER_MAX_STACK_SIZE=3000",
                "PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR=/config",
                "PLEX_MEDIA_SERVER_HOME=/usr/lib/plexmediaserver",
                "LD_LIBRARY_PATH=/usr/lib/plexmediaserver",
                "TMPDIR=/tmp"
            ],
wernight commented 8 years ago

Looks like you're running with the default settings.

It seems something changed in the way Plex is initially set up. Now unclaimed servers are accessible without log in if the port is open. It's a big security issue. I'm trying to understand yet how and when a server may get unclaimed as it seems to happen.

wernight commented 8 years ago

It seems that this issue only happens with --net=host. If people can confirm I'll update the README to make it much more prominent that there is a security risk. I do not understand why it doesn't remember that it was claimed though. Unless the apk install has something to do with it, or I'm not saving some directory...

I've added a script to help retrieve the X-Plex-Token, but I found that installing without --net=host to be still a pain.