How do you secure public facing Immich? #3243
Replies: 8 comments 18 replies
-
|
I run my setup with Traefik as reverse proxy and Crowdsec. |
Beta Was this translation helpful? Give feedback.
-
|
Did a little tuning now: |
Beta Was this translation helpful? Give feedback.
-
|
can you add for share link also in this ? |
Beta Was this translation helpful? Give feedback.
-
|
What do you mean? |
Beta Was this translation helpful? Give feedback.
-
|
When i share a album to friends and they just scroll through it, it is banning them. |
Beta Was this translation helpful? Give feedback.
-
|
I didn't run into this issue. You can use |
Beta Was this translation helpful? Give feedback.
-
|
[Nest] 7 - 03/03/2024, 5:10:54 PM ERROR [AuthService] Error in OAuth discovery: OPError: expected 200 OK, got: 403 Forbidden how to resolve this ? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, I'm using the swag reverse-proxy with fail2ban that should properly secure immich and ban IPs if they attempt to login for ~5 times. Did anyone find a way to work around that yet? |
Beta Was this translation helpful? Give feedback.
-
|
I set up immich + fail2ban successfully. When there is a failed login, a log line in I set up fail2ban to pick up that line and ban the corresponding ip. Here is my setup:
services:
immich-server:
logging:
driver: "journald"
options:
tag: "immich-server"
$ vim /etc/fail2ban/filter.d/immich.local
[Definition]
failregex = immich-server.*Failed login attempt for user.+from ip address\s?<ADDR>
journalmatch = CONTAINER_TAG=immich-server
$ vim /etc/fail2ban/jail.d/immich.local
[immich]
enabled = true
filter = immich
backend = systemd
chain = DOCKER-USER
Debug tips:
|
Beta Was this translation helpful? Give feedback.
-
|
Can i retrospectively change the logging driver in the docker compose file and not destroy anything? If that is the case, will future updates to immich also work fine with the edited docker compose file? |
Beta Was this translation helpful? Give feedback.
-
|
@clintjk It will affect how logs are gathered, but it will not affect how immich app works. |
Beta Was this translation helpful? Give feedback.
-
|
@Jurrer Thanks that worked perfectly! @simone-viozzi The fail2ban setup was a little confusing in comparison. Turns out you must append the immich jail file with |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, that worked really well! An fyi for people that aren't on systems with
|
Beta Was this translation helpful? Give feedback.
-
|
I spent couple hours to get it working, but here is the nginx version. The modified Now the NGINX side, let's modify how nginx writes access logs. Add this part within the Let's define variable describing our upstream app: location / {
include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
+ set $upstream_app immich-server;
set $upstream_port 3001;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}reload/restart nginx; open immich to generate traffic; check if your nginx log looks as intended: For the final part, let's fix that nginx-logs parser, so it notices our upstream server. look for the If not, replace the pattern in
save the file, and test it again done, you should see Edit1: disable nginx logging rewrites |
Beta Was this translation helpful? Give feedback.
-
|
Thank you very much for pointing me in the right direction. I have a Nginx Proxy Manager server that is my proxy. I could't quite figure out how to get the 'Target Server' part of the log to work with the NPM configuration. I look a look at the parser for NPM and keyed on filtering based on the target server. If it will help anyone else... The modified I restarted crowdsec and lastly tested |
Beta Was this translation helpful? Give feedback.
-
|
That really helped me!
I am sure, I will need to add few more lines (maybe for .wellknown etc when I have to add another device and http probing will kick in another ban. Will update if there are any changes in my configs in this thread. cat /etc/crowdsec/parsers/s02-enrich/immich-whitelists.yaml |
Beta Was this translation helpful? Give feedback.
-
|
Do any of these schemes allow file sharing by link? I use swag and couldn't seem to get that to work so I bypassed it for now. I mean work without having to give people a swag/authelia login. |
Beta Was this translation helpful? Give feedback.
-
|
I know, this is too late a response. But, I was looking for solution for this issue and wanted to report that this works for shared links as well. I just created a large shared link album (I've 2FA OIDC setup as well) . Opened up that link on private browser on cellphone network, scrolled up / down / page refresh multiple times within seconds. Didn't get a ban. For http probing, I had to add another line. Added my config in the same discussion, elsewhere. |
Beta Was this translation helpful? Give feedback.
-
|
What about this that I did on my nginx? I don't really understand how that thing is configured, but I got it a bit secured this way. This in nginx site config: .conf files contain just configuration for proxy_pass (and for php for one URI). And auth.php in the server root directory: <?php
//not sure this line works - my Immich runs on different machine, so I'm getting logs different way.
$logs = shell_exec("docker logs immich_server --since 30m 2>&1");
if (substr_count($logs, "from ip address " . $_SERVER['REMOTE_ADDR']) > 10)
{
http_response_code(403);
}
else
{
http_response_code(200);
}
?>Every time I access login page or api endpoint for login, it gets logs from last 30 minutes, checks whether your IP is there more than 10 times (as failed attempts) and if it is, it blocks access to the page. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, has anyone built a successful content security policy ? When I try with my usual |
Beta Was this translation helpful? Give feedback.
-
|
I manage to have a usable Content-Security-Policy using However, it should be noted that this CSP is not really secure as it contains "unsafe-inline" and "unsafe-eval". But in any case, it still narrows the scope of what resources can be loaded from an Immich instance. Ideally, Immich should be adapted in such a way that these unsafe inline and eval() can be removed, further securing the CSP. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @amadeous , I am not sure that I understand it all, but it seems to work. What I understand is that not everything is at the highest level of security, but the whole is more secure than remaining with no CSP at all. |
Beta Was this translation helpful? Give feedback.
-
Hello,
I want to share my experience for others and maybe look for inspiration.
The main question is in the title "How do you secure public facing Immich?"
I use Traefik and wanted to use Crowdsec. It worked great... untill you try to scroll down, then it flags the trafik as enumeration attempt and blocks your IP, which isn't ideal. If anyone wants to try it for everything else it worked great. If anyone wants to try it out I reccomend this video tutorial, but don't use it with Immich, I recommend to secure other projects with it, just not Immich.
Beta Was this translation helpful? Give feedback.
All reactions