How do you secure public facing Immich? #3243
Replies: 11 comments 24 replies
-
|
I run my setup with Traefik as reverse proxy and Crowdsec. |
Beta Was this translation helpful? Give feedback.
-
|
Did a little tuning now: |
Beta Was this translation helpful? Give feedback.
-
|
What do you mean? |
Beta Was this translation helpful? Give feedback.
-
|
When i share a album to friends and they just scroll through it, it is banning them. |
Beta Was this translation helpful? Give feedback.
-
|
I didn't run into this issue. You can use |
Beta Was this translation helpful? Give feedback.
-
|
[Nest] 7 - 03/03/2024, 5:10:54 PM ERROR [AuthService] Error in OAuth discovery: OPError: expected 200 OK, got: 403 Forbidden how to resolve this ? |
Beta Was this translation helpful? Give feedback.
-
|
thank you @Allram !! |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I'm using the swag reverse-proxy with fail2ban that should properly secure immich and ban IPs if they attempt to login for ~5 times. Did anyone find a way to work around that yet? |
Beta Was this translation helpful? Give feedback.
-
|
I set up immich + fail2ban successfully. When there is a failed login, a log line in I set up fail2ban to pick up that line and ban the corresponding ip. Here is my setup:
services:
immich-server:
logging:
driver: "journald"
options:
tag: "immich-server"
$ vim /etc/fail2ban/filter.d/immich.local
[Definition]
failregex = immich-server.*Failed login attempt for user.+from ip address\s?<ADDR>
journalmatch = CONTAINER_TAG=immich-server
$ vim /etc/fail2ban/jail.d/immich.local
[immich]
enabled = true
filter = immich
backend = systemd
chain = DOCKER-USER
Debug tips:
|
Beta Was this translation helpful? Give feedback.
-
|
Can i retrospectively change the logging driver in the docker compose file and not destroy anything? If that is the case, will future updates to immich also work fine with the edited docker compose file? |
Beta Was this translation helpful? Give feedback.
-
|
@clintjk It will affect how logs are gathered, but it will not affect how immich app works. |
Beta Was this translation helpful? Give feedback.
-
|
@Jurrer Thanks that worked perfectly! @simone-viozzi The fail2ban setup was a little confusing in comparison. Turns out you must append the immich jail file with |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, that worked really well! An fyi for people that aren't on systems with
|
Beta Was this translation helpful? Give feedback.
-
|
The original works wonder ! But if anyone want to save some hours of troubleshooting, you may want to try and not set an iptables chain like in the example jail, so like this : $ vim /etc/fail2ban/jail.d/immich.local In my case, it would cause the IP to be banned as expected, but the said IP could still connect to the server.. |
Beta Was this translation helpful? Give feedback.
-
|
I spent couple hours to get it working, but here is the nginx version. The modified Now the NGINX side, let's modify how nginx writes access logs. Add this part within the Let's define variable describing our upstream app: location / {
include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
+ set $upstream_app immich-server;
set $upstream_port 3001;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}reload/restart nginx; open immich to generate traffic; check if your nginx log looks as intended: For the final part, let's fix that nginx-logs parser, so it notices our upstream server. look for the If not, replace the pattern in
save the file, and test it again done, you should see Edit1: disable nginx logging rewrites |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much for pointing me in the right direction. I have a Nginx Proxy Manager server that is my proxy. I could't quite figure out how to get the 'Target Server' part of the log to work with the NPM configuration. I look a look at the parser for NPM and keyed on filtering based on the target server. If it will help anyone else... The modified I restarted crowdsec and lastly tested |
Beta Was this translation helpful? Give feedback.
-
|
That really helped me!
I am sure, I will need to add few more lines (maybe for .wellknown etc when I have to add another device and http probing will kick in another ban. Will update if there are any changes in my configs in this thread. cat /etc/crowdsec/parsers/s02-enrich/immich-whitelists.yaml |
Beta Was this translation helpful? Give feedback.
-
|
unfortunately this doesn't seem to work for me, I've got immich, nginx and crowdsec in separate containers (with nginx-proxy-manager as my reverse proxy setup), but for some reason I cannot get then to interact. I've tried on the side to go with fail2ban which does work and does pick up the failed immich log in attempts but can't get that to communicate with nginx either. Any support would be most welcome. |
Beta Was this translation helpful? Give feedback.
-
|
@Kein90 First and foremost, are the containers on the same network? |
Beta Was this translation helpful? Give feedback.
-
|
Right you are, my apologies. Yes, everything is on the same network. The issue that I'm facing particularly is with nginx-logs.yaml, can't get it right somehow: log file reads Hope this gives you a general idea. Thank you for the help. |
Beta Was this translation helpful? Give feedback.
-
|
Do any of these schemes allow file sharing by link? I use swag and couldn't seem to get that to work so I bypassed it for now. I mean work without having to give people a swag/authelia login. |
Beta Was this translation helpful? Give feedback.
-
|
I know, this is too late a response. But, I was looking for solution for this issue and wanted to report that this works for shared links as well. I just created a large shared link album (I've 2FA OIDC setup as well) . Opened up that link on private browser on cellphone network, scrolled up / down / page refresh multiple times within seconds. Didn't get a ban. For http probing, I had to add another line. Added my config in the same discussion, elsewhere. |
Beta Was this translation helpful? Give feedback.
-
|
What about this that I did on my nginx? I don't really understand how that thing is configured, but I got it a bit secured this way. This in nginx site config: .conf files contain just configuration for proxy_pass (and for php for one URI). And auth.php in the server root directory: <?php
//not sure this line works - my Immich runs on different machine, so I'm getting logs different way.
$logs = shell_exec("docker logs immich_server --since 30m 2>&1");
if (substr_count($logs, "from ip address " . $_SERVER['REMOTE_ADDR']) > 10)
{
http_response_code(403);
}
else
{
http_response_code(200);
}
?>Every time I access login page or api endpoint for login, it gets logs from last 30 minutes, checks whether your IP is there more than 10 times (as failed attempts) and if it is, it blocks access to the page. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, has anyone built a successful content security policy ? When I try with my usual |
Beta Was this translation helpful? Give feedback.
-
|
I manage to have a usable Content-Security-Policy using However, it should be noted that this CSP is not really secure as it contains "unsafe-inline" and "unsafe-eval". But in any case, it still narrows the scope of what resources can be loaded from an Immich instance. Ideally, Immich should be adapted in such a way that these unsafe inline and eval() can be removed, further securing the CSP. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @amadeous , I am not sure that I understand it all, but it seems to work. What I understand is that not everything is at the highest level of security, but the whole is more secure than remaining with no CSP at all. |
Beta Was this translation helpful? Give feedback.
-
|
Just a quick update of the CSP since the map tiles provider changed in #11374. The urls from the |
Beta Was this translation helpful? Give feedback.
-
|
since crowdsec causes some headaches, i switched to the GeoBlock traefik Plugin by Pascal Minder: (https://github.com/PascalMinder/geoblock) |
Beta Was this translation helpful? Give feedback.
-
|
I have immich on my TrueNAS and reach it through my Tailscal-net. Here is a guide to set out up: And here is a guide to share the self-hosted services on your Tailnet with friends and family: |
Beta Was this translation helpful? Give feedback.
-
|
Hello, I tried to follow this discussion to setup fail2ban with immich but I'm stuck. I'm using SWAG as my fail2ban, nginx and other stuff container on unraid. Right now, what I do is for all the logfile that is required by fail2ban to check, I just mount them readonly in swag container. This work fine. However, I cannot find anything related to that in immich. Where is the log file? If there's no log file, how can I setup fail2ban? Thank you! edit: well, turns out I already had some logging from nginx unauthorized log. It's not going into immich jail, but at least it's jailing. in nginx access.log, when a bad password is entered in immich, I get something like that I already have a filter for any 401 in the default fail2ban in swag |
Beta Was this translation helpful? Give feedback.
-
Hello,
I want to share my experience for others and maybe look for inspiration.
The main question is in the title "How do you secure public facing Immich?"
I use Traefik and wanted to use Crowdsec. It worked great... untill you try to scroll down, then it flags the trafik as enumeration attempt and blocks your IP, which isn't ideal. If anyone wants to try it for everything else it worked great. If anyone wants to try it out I reccomend this video tutorial, but don't use it with Immich, I recommend to secure other projects with it, just not Immich.
Beta Was this translation helpful? Give feedback.
All reactions