Any way to secure Web Admin access?

[omnihilo]

Okay, I don't have the product yet but am looking over things. Am I correct in thinking that anyone who knows (or stumbles upon) my IP address and finds port 8129 open will have access to my network? Is there not even a login prompting for a password? Is there any way to currently make this more secure, or does anyone know if they're planning on securing it in the next release?

[Terminal]

If they find your IP they will need a password to get in, provided you set it that way. You can leave it open, or you can set it so that anyone can stream or download video but not do anything else. You can set different users with different passwords and different privileges. I suggested that they allow the user name for the admin account be changed, but it hasn't been done yet. I figured if you can change the user name that gives someone one more thing to figure out besides the password. As it is now they know one of the user names it is admin.

Also if they do get in they do not have full acess to you network, they only have access to the video files in valid BTV folders.

[jmcclain]

You have complete security control from the web admin mode. You can enable or disable security (if you are not port forwarding the webadmin port or the streaming port, maybe you want it wide open on your LAN from a password standpoint). You can create different users and control their "access" level, basically controlling if they can "watch only", "watch and record", or "admin" level to be able to change any settings they want.

I've created a "guest" account on my HTPC with password "letmein" with VIEW only privledges. You can at least browse around. Keep in mind that I have my "streaming" content bandwidth set pretty low (only have 128kb/sec upload bandwidth on my DSL), and I only have one WMV file there that you can even stream (the rest have to just be manually downloaded). Please don't kill my upload bandwidth with a lot movie downloads, this was just to let you all in to see how it looks.

goto http://206.207.77.117:8080

Surprised Snapstream doesn't have a web admin sample login page to let people just play with it.

-Jeff

[Cal]

OK. That was cool. I logged in a guest and had a look. I was looking for a sample of this on the web. But your live one will do.

I tried playing the fireworkfactory clip as I saw it was only a couple of minutes long. I only got a few seconds before it cut off. I think however it may be my end. I'll try later today on my laptop on a different network if its still up.

Thanks.

[TomZ]

Also note that for this to work, your browser must accept cookies from the BTV server.

It does not warn you if cookies are rejected (find the feature request hidden in this sentence). It just keeps asking you to log in.

[jmcclain]

Originally posted by Cal
OK. That was cool. I logged in a guest and had a look. I was looking for a sample of this on the web. But your live one will do.

I tried playing the fireworkfactory clip as I saw it was only a couple of minutes long. I only got a few seconds before it cut off. I think however it may be my end. I'll try later today on my laptop on a different network if its still up.

Thanks.

Heheh..actually, I've been remote desktop'ed into that system from work, so the bandwidth has been pretty stressed over the last hour (grin). You can change the amount of streaming buffer you want in WMP 9.0 to require more buffer so you don't catch up as easily. Also, the WMV that is on there is at a pretty high bit rate, so to chunk it down on the streaming side to 128 kbps isn't great. I really didn't put this up to be an example of streaming video, since my setup is NOT very good for that outside my own internal LAN.

-Jeff

[Terminal]

Originally posted by merrypig


No hacker badge for you!

Your right I don't have one, I don't live at home in my parents basement. I understood that in an earlier version there was a problem that would allow someone to access your entire system, but I thought it had been fixed.

[omnihilo]

Wow, not as bad as I thought. I couldn't find any mention on the online tutorial about security, so thank you all for the info. Thanks jmcclain, that gives me a pretty good idea of the interface.

[jmcclain]

You do miss out on a LOT of the advance security configuration pages and the other tool configuration pages by that guest security level set to VIEW ONLY (you can't even schedule recordings), but I'm not really interested in giving you Admin privledges to try those out.

Anyway, just set up the trial version yourself (it is simple) and you will see how well it works.

Regards,

-Jeff

[tkoenig]

I just went into the security settings page on my web admin to enable security, and it says "no security features available at this time..." So where do I enable it?

[jmcclain]

Hum...are you using BTV 3.4 (build 1271)?

In mine, you click on configure->advanced->security settings. There should be a blue table that says "Security Settings: OFF", and then you can click a link that says "Turn Security ON".

Shrug?

-Jeff

[tkoenig]

Originally posted by merrypig
you have to turn it on by going to web admin on the btv server itself first before you can access it remotely.

Thanks.