Posts by PhilippeB

  • Possible security breach

    Yes this is what I do.

    I will study this. I'm trying to build for starters, for now the build fails (tried both top of develop branch and 11.0.1)

    I am thinking the network share should use asymetric authentication, setup one time and never able to read them after.

    I'll post my findings if any, long way to go but i am a patient person.

  • Possible security breach

    I would like to say yes and yes, but i will answer no and yes.

    kodi needs write access to 'export media DB' in multiple files where the files are stored where the media lives.

    Exporting in multiple files is the only way i found to keep the .nfo files that say what media you listened and what you did not, which is kinda usefull if you have a large DB and migrating to a new hardware. (Sorry for being off topic, just wanted to give a thourough answer) but you are right, kid could delete ;)

  • Possible security breach

    Hi guys. Thank you for your answers chewitt

    Some updates:


    I realize that LibreElec is the outside "Shell" and Kodi is the app doing the thing, so I should have posted my concerns to a Kodi forum instead, sorry about that. Then maybe Kodi is not the faulty one, maybe it's Samba.
    At this point, we are getting philosophical about it.

    I confirm that I was not looking at the right unit (I have two) and the faulty one had both avahi and samba enabled. That is now off.

    **However**

    Kodi still is using SAMBA mounts to access my NAS where my media files are located right ?
    So let's not confuse "Accessing Kodi" through SAMBA from my laptop, and "Accessing my NAS from KODI" (which will continue to happen even with SAMBA off, this has nothing to do with mounts).

    Credentials are still being stored in clear, and anybody can 'get' to these credentials by many means.
    For example, you can see them by simply using KODI UI (Gear) -> File Manager -> passwords.xml (or mediasources.xml).

    Now any friend's kid in visit to my home can get access to my NAS by simply playing with my TV remote control, which gives me the creeps. The fact that libreElec that is using Kodi that is using SAMBA punches a hole in my network security.

    Credentials should NEVER (ever) be stored in clear. A breach is a breach, who ever is responsible should at least look into it I think. Documenting the fact that it exists doesn't protects the less skilled users.

    - A 33 year experienced embedded developer specialized in Linux/openWRT and on the cyber security comitee, aka "low/no Linux skilled user" ;)

  • Possible security breach

    Thank you chewitt . So i guess the answer is that we should use something else than Samba to be more secure correct ?

    BTW i never enabled SAMBA in the first place (Samba to access LE device)
    The folder i was refereing to was visible in windows because the device probably multicasts a XML shema to be discoverable on the network. It is something i used to do in the past to make one on my embedded device visible to a windows network.

  • Possible security breach

    Hi. I observed that my LibreElec device (latest version) was visible on my windows PC so i started to fool around the folders just to learn about its structure...

    I rapidly noticed that in /Userdata/passwords.xml, the credentials to my NAS are saved in clear (!)

    This is not good, even if documented... really not good ;(

  • Quick guide to running LE in ProxMox

    akaylor I was able to install LE 12.0.1 in a record time (below 5 minutes) with your steps, so thank you ALOT for that.

    I can see LE through proxMox console web interface and everything runs as expected so far.


    Now the 1million$ question: Can it passthrough video and audio directly to a physical HDMI port ?

    Currently if I connect a physical monitor to the PC node running ProxMox, i see ProxMox login console which make sense.

    What i'm trying to do is install proxMox on current home theater setups (i have 2) and continue using them as LE setups + use these setups CPUs to run other task on them when I don't use them to watch movies.

    So they would become permanently part of my ProxMox cluster, and still fullfill their primary roles of LE setups.

    Thank you,

    Philippe

  • Remove nas as source leave fantom behind

    Klojum yes sorry about this i do suffer ADHD and sometimes a bit of keyboard errors. Also i am french so translating as it goes :)

    I first removed source the 'correct' way using the GUI and even though it seemed to do the job correctly (source was gone in the gui) as soon as i shutdown my nas, kodi will post an error message on powerup, obviously still looking for my nas.

    I know that because if i power up my nas, error message goes aways and the other way around.

    It is only after seeing that the gui onviously did not completely removed my nas that i went through the xml files removing any reference to it, there was no videos only music.

    Thanxs

  • Remove nas as source leave fantom behind

    i once had a source pointing to my nas but each time my nas was poewered down this would generate a "cant connect to host error message on kodi startup.

    I then remove the source and added local hd instead, same problem. Everytime i boot LE now k0di complains qbout not being able tomdonnect to the source. But there is no source to connect to anymore si ce i removed the connection, but it always co plains u less i leave my nas opened.

    Is there a way to ssh that out ?

    Thanxs