I’m a software developer working in the telecam sector on security related products, so I know a fair bit about system security. Yet I wound secure my own system far less than most people here if I didn’t enjoy cybersecurity as a hobby.

I wonder what you are securing against? Some examples:

  • jellyfin: unless you have home videos on there, what does it matter if someone exfiltrates some movies? Surely you have basic DOS protection and/or region locking to reduce wasted network traffic, right?
  • linux: I assume nobody is using their servers as daily drive PCs, so what does it matter if somehow your system is superficially compromised. You can always reimage. Sure they could mine some bitcoin with your system, but it doesn’t have that much PSU headroom to cost you much on your bills, right?

It just seems like most attack vectors lead to mild annoyance at most for most systems.

Do you guys just enjoy cybersecurity? Do you actually keep sensitive data on your self hosted systems? Do you self-host on expensive hardware? What am I missing?

  • Morgikan@fedia.io
    31·
    7 days ago

    It would depend on having access to misconfigured permissions or docker.sock like when you chain containers to manage other containers. Because you have access to docker.sock and that socket can send API calls to the docker daemon (which is run from root) those commands would inherit the same level of access. An attacker could make the API call to mount /:/root and then access the host filesystem.

    It’s just an example of how even though the container might not have anything worthwhile, it can be used to laterally move and open another door.

    • hirihit640@sh.itjust.worksEnglish
      4·
      7 days ago

      Got it. Access to docker.sock is definitely something to be wary of, or CAP_ADMIN, or access to certain host devices.

      Worth mentioning though that Jellyfin usually has none of these.

      • The Stoned Hacker@lemmy.worldEnglish
        2·
        7 days ago

        Also worth mentioning that Linux recently has had two massive privilege escalation vulnerabilities that bypass system namespacing and thus also provide container escapes.

        • Lambda@lemmy.caOPEnglish
          1·
          7 hours ago

          Yeah, my thought here is that dockerization isn’t a security measure really. I, for one, run my jellyfin on bare metal with nixos, but secure it behind a keycloak SSO system.

          • The Stoned Hacker@lemmy.worldEnglish
            1·
            5 hours ago

            You’re wrong, containerization is a massive security measure that shouldn’t be ignored. Proper containerization allows you to segment the namespacing of a single server by user and application; this helps massive with esrablishing boundaries that are still very difficult to cross under normal circumstances. Keycloak is an IdP which only provides one layer of security; good swcurity implements defense in depth where every layer of the system has securiry measures. Just because Linux recently had two vulnerabilities that bypass a lot of those doesn’t mean they’re worthless; you still need initial access to a nonprivileged user to exploit those and layered security can help prevent that from happening in the first place.