How do you secure public facing Immich? #3243
Replies: 13 comments 40 replies
-
|
I run my setup with Traefik as reverse proxy and Crowdsec. |
Beta Was this translation helpful? Give feedback.
-
|
Did a little tuning now: Updated config: #3243 (reply in thread) |
Beta Was this translation helpful? Give feedback.
-
|
[Nest] 7 - 03/03/2024, 5:10:54 PM ERROR [AuthService] Error in OAuth discovery: OPError: expected 200 OK, got: 403 Forbidden how to resolve this ? |
Beta Was this translation helpful? Give feedback.
-
|
thank you @Allram !! |
Beta Was this translation helpful? Give feedback.
-
|
I added the name: crowdsecurity/immich-whitelists
description: "Whitelist false positive from Immich-api"
filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"
whitelist:
reason: "Whitelist false positive from Immich-api"
expression:
- evt.Parsed.traefik_router_name == 'immich-api@docker' && evt.Meta.http_verb == 'POST' && evt.Meta.http_status == '403' && evt.Parsed.request contains '/asset/upload'
- evt.Parsed.traefik_router_name == 'immich-api@docker' && evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '429' && evt.Parsed.request contains '/api/asset/thumbnail/'
- evt.Parsed.traefik_router_name == 'immich-api@docker' && evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '200' && evt.Parsed.request contains '/api/asset/thumbnail/'
- evt.Parsed.traefik_router_name == 'immich-api@docker' && evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '304' && evt.Parsed.request contains '/api/asset/thumbnail/'
- evt.Parsed.traefik_router_name == 'immich-api@docker' && evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '429' && evt.Parsed.request contains '/photos/'
- evt.Parsed.traefik_router_name == 'immich-api@docker' && evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '200' && evt.Parsed.request contains '/photos/'
- evt.Parsed.traefik_router_name == 'immich-api@docker' && evt.Meta.http_verb == 'GET' && evt.Meta.http_status == '304' && evt.Parsed.request contains '/photos/' |
Beta Was this translation helpful? Give feedback.
-
|
Updated my config with more/new paths: |
Beta Was this translation helpful? Give feedback.
-
|
The above was not working for me but set on the right path. This worked for me on version v1.140.1 after using immich-go to import 30gb of google takeout data into immich. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I'm using the swag reverse-proxy with fail2ban that should properly secure immich and ban IPs if they attempt to login for ~5 times. Did anyone find a way to work around that yet? |
Beta Was this translation helpful? Give feedback.
-
|
I set up immich + fail2ban successfully. When there is a failed login, a log line in I set up fail2ban to pick up that line and ban the corresponding ip. Here is my setup:
services:
immich-server:
logging:
driver: "journald"
options:
tag: "immich-server"
$ vim /etc/fail2ban/filter.d/immich.local
[Definition]
failregex = immich-server.*Failed login attempt for user.+from ip address\s?<ADDR>
journalmatch = CONTAINER_TAG=immich-server
$ vim /etc/fail2ban/jail.d/immich.local
[immich]
enabled = true
filter = immich
backend = systemd
chain = DOCKER-USER
Debug tips:
|
Beta Was this translation helpful? Give feedback.
-
|
@Jurrer Thanks that worked perfectly! @simone-viozzi The fail2ban setup was a little confusing in comparison. Turns out you must append the immich jail file with |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, that worked really well! An fyi for people that aren't on systems with
|
Beta Was this translation helpful? Give feedback.
-
|
The original works wonder ! But if anyone want to save some hours of troubleshooting, you may want to try and not set an iptables chain like in the example jail, so like this : $ vim /etc/fail2ban/jail.d/immich.local In my case, it would cause the IP to be banned as expected, but the said IP could still connect to the server.. |
Beta Was this translation helpful? Give feedback.
-
|
To add to @dekiesel comment, I had to use syslog for the crazy-max docker image of fail2ban I set the logpath to: |
Beta Was this translation helpful? Give feedback.
-
|
Hello! Thanks for your example. I just wanted to share how I improved upon the idea of using journald logging. My way ensures you have full access to a log file, with log rotation, to your path of choice, with no permission issue! Also helps if running fail2ban in a container. Its a bit more convoluted but here goes. Make the directory where you want to store the log file: Create a service to forward journald logs to a log file: For the service, paste the following. Make sure to replace {user} & {group} Then reload systemctl daemon and enable the service: To check the service status: To check the log file: Finally, add log rotation: Paste the following. Make sure to replace {user} & {group} To test the log rotation: And there you go, thanks ChatGPT! 😂 Hopefully this can help someone like me who really wanted a log file |
Beta Was this translation helpful? Give feedback.
-
|
I spent couple hours to get it working, but here is the nginx version. The modified Now the NGINX side, let's modify how nginx writes access logs. Add this part within the Let's define variable describing our upstream app: location / {
include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
+ set $upstream_app immich-server;
set $upstream_port 3001;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}reload/restart nginx; open immich to generate traffic; check if your nginx log looks as intended: For the final part, let's fix that nginx-logs parser, so it notices our upstream server. look for the If not, replace the pattern in
save the file, and test it again done, you should see Edit1: disable nginx logging rewrites |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much for pointing me in the right direction. I have a Nginx Proxy Manager server that is my proxy. I could't quite figure out how to get the 'Target Server' part of the log to work with the NPM configuration. I look a look at the parser for NPM and keyed on filtering based on the target server. If it will help anyone else... The modified I restarted crowdsec and lastly tested |
Beta Was this translation helpful? Give feedback.
-
|
That really helped me!
I am sure, I will need to add few more lines (maybe for .wellknown etc when I have to add another device and http probing will kick in another ban. Will update if there are any changes in my configs in this thread. cat /etc/crowdsec/parsers/s02-enrich/immich-whitelists.yaml |
Beta Was this translation helpful? Give feedback.
-
|
unfortunately this doesn't seem to work for me, I've got immich, nginx and crowdsec in separate containers (with nginx-proxy-manager as my reverse proxy setup), but for some reason I cannot get then to interact. I've tried on the side to go with fail2ban which does work and does pick up the failed immich log in attempts but can't get that to communicate with nginx either. Any support would be most welcome. |
Beta Was this translation helpful? Give feedback.
-
|
@Kein90 First and foremost, are the containers on the same network? |
Beta Was this translation helpful? Give feedback.
-
|
Right you are, my apologies. Yes, everything is on the same network. The issue that I'm facing particularly is with nginx-logs.yaml, can't get it right somehow: log file reads Hope this gives you a general idea. Thank you for the help. |
Beta Was this translation helpful? Give feedback.
-
|
Do any of these schemes allow file sharing by link? I use swag and couldn't seem to get that to work so I bypassed it for now. I mean work without having to give people a swag/authelia login. |
Beta Was this translation helpful? Give feedback.
-
|
I know, this is too late a response. But, I was looking for solution for this issue and wanted to report that this works for shared links as well. I just created a large shared link album (I've 2FA OIDC setup as well) . Opened up that link on private browser on cellphone network, scrolled up / down / page refresh multiple times within seconds. Didn't get a ban. For http probing, I had to add another line. Added my config in the same discussion, elsewhere. |
Beta Was this translation helpful? Give feedback.
-
|
What about this that I did on my nginx? I don't really understand how that thing is configured, but I got it a bit secured this way. This in nginx site config: .conf files contain just configuration for proxy_pass (and for php for one URI). And auth.php in the server root directory: <?php
//not sure this line works - my Immich runs on different machine, so I'm getting logs different way.
$logs = shell_exec("docker logs immich_server --since 30m 2>&1");
if (substr_count($logs, "from ip address " . $_SERVER['REMOTE_ADDR']) > 10)
{
http_response_code(403);
}
else
{
http_response_code(200);
}
?>Every time I access login page or api endpoint for login, it gets logs from last 30 minutes, checks whether your IP is there more than 10 times (as failed attempts) and if it is, it blocks access to the page. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, has anyone built a successful content security policy ? When I try with my usual |
Beta Was this translation helpful? Give feedback.
-
|
I manage to have a usable Content-Security-Policy using However, it should be noted that this CSP is not really secure as it contains "unsafe-inline" and "unsafe-eval". But in any case, it still narrows the scope of what resources can be loaded from an Immich instance. Ideally, Immich should be adapted in such a way that these unsafe inline and eval() can be removed, further securing the CSP. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @amadeous , I am not sure that I understand it all, but it seems to work. What I understand is that not everything is at the highest level of security, but the whole is more secure than remaining with no CSP at all. |
Beta Was this translation helpful? Give feedback.
-
|
Just a quick update of the CSP since the map tiles provider changed in #11374. The urls from the |
Beta Was this translation helpful? Give feedback.
-
|
since crowdsec causes some headaches, i switched to the GeoBlock traefik Plugin by Pascal Minder: (https://github.com/PascalMinder/geoblock) |
Beta Was this translation helpful? Give feedback.
-
|
I have immich on my TrueNAS and reach it through my Tailscal-net. Here is a guide to set out up: And here is a guide to share the self-hosted services on your Tailnet with friends and family: |
Beta Was this translation helpful? Give feedback.
-
|
What if you want to share a photo or video to someone using public link that is not on tailscale? |
Beta Was this translation helpful? Give feedback.
-
|
Hello, I tried to follow this discussion to setup fail2ban with immich but I'm stuck. I'm using SWAG as my fail2ban, nginx and other stuff container on unraid. Right now, what I do is for all the logfile that is required by fail2ban to check, I just mount them readonly in swag container. This work fine. However, I cannot find anything related to that in immich. Where is the log file? If there's no log file, how can I setup fail2ban? Thank you! edit: well, turns out I already had some logging from nginx unauthorized log. It's not going into immich jail, but at least it's jailing. in nginx access.log, when a bad password is entered in immich, I get something like that I already have a filter for any 401 in the default fail2ban in swag |
Beta Was this translation helpful? Give feedback.
-
|
Just use Oauth and you can avoid Fail2ban completely. Disable auto register and password login. |
Beta Was this translation helpful? Give feedback.
-
|
You might not have heard of one very used vulnerability right now in the wild used by phishers where user are redirected to google but they get the token. I'm not saying using oauth isn't secure, in saying your statement is wrong about fail2ban not needed because of oauth. Vulnerabilities exist regardless of what auth you used. Fail2ban is there to help prevent some of them... It's like saying I don't need a firewall cause I use a passwordless windows account.... |
Beta Was this translation helpful? Give feedback.
-
|
phishing and oauth.... Yes, that is indeed a thing but fail2ban will not save you against that. Claims, scopes, separate clients, two fact auth, and so on, yes that will. I still stand by what I said but dont get me wrong, I never said fail2ban is not nice to have, but it wont make IMO immich more secure. Speaking of attacks, if you use oauth, a handy guide: |
Beta Was this translation helpful? Give feedback.
-
|
I don't like to rely on external services like google on my selfhosted instances, thats why I use Authentik but with a local user on it. I still use fail2ban but only on Authentik, where all failed attempts on my different services are centralized there. |
Beta Was this translation helpful? Give feedback.
-
|
@ThowZzy |
Beta Was this translation helpful? Give feedback.
-
It’s all about finding the sweet spot between convenience and security. I agree that vulnerabilities that aren't protected by authentication will still be exploitable with Authentik. But that's not 100% true also, because I could have configured authentik on the reverse proxy directly instead of inside the app. This way, no request will hit the original app unless authorized by authentik. Using a VPN means that you give up any sharing feature from immich, and also a big inconvenience for family members. |
Beta Was this translation helpful? Give feedback.
-
|
Hi Before I explain, here's my setup. Crowdsec is configured with the environment variable So my goal was to look at the problem the other way around and format my log file so that it would be correctly interpreted by the crowdsec parser So I edited the nginx file In the log format, it is IMPORTANT not to modify You will then get log lines like this Finally, all that's left is to put the whitelist file And restart crowdsec and VOILA |
Beta Was this translation helpful? Give feedback.
-
|
This seems to have worked well for me thank you :) does modifying the swag/nginx log structure mess with any other aspects of SWAG or any other crowdsec detections? |
Beta Was this translation helpful? Give feedback.
-
|
Glad it works for you too! Regarding the nginx log modification, for me, it only adds |
Beta Was this translation helpful? Give feedback.
-
|
That's perfect, thank you :) |
Beta Was this translation helpful? Give feedback.
and others
Uh oh!
There was an error while loading. Please reload this page.
-
Hello,
I want to share my experience for others and maybe look for inspiration.
The main question is in the title "How do you secure public facing Immich?"
I use Traefik and wanted to use Crowdsec. It worked great... untill you try to scroll down, then it flags the trafik as enumeration attempt and blocks your IP, which isn't ideal. If anyone wants to try it for everything else it worked great. If anyone wants to try it out I reccomend this video tutorial, but don't use it with Immich, I recommend to secure other projects with it, just not Immich.
Beta Was this translation helpful? Give feedback.
All reactions