Remote Access Security

[mikefromnj]

Hi all,

I have ChannelsDVR running in a Docker container. I have port 8089 forwarded to my NAS running the DVR. It appears that anyone who goes to mypublicip:8089 can access my ChannelsDVR server and has full access to it. While using the apps to access ChannelsDVR requires a log in, directly connecting to my server via a web browser does not. Is this normal? I have tried accessing my server using multiple devices on different ISPs and myip:8089 always gets firect access to my server even if "Remote Streaming" is off. Thanks for any insight.

[eric]

It sounds like a configuration issue, but as I said in email, we’ll need you to go to Support -> Troubleshooting -> Submit Diagnostic Logs from the web interface of the DVR and let us know the identifier is so we can help further.

[mikefromnj]

Thanks for the quick reply. The response provided was correct. If you run Channels in Docker in Bridge mode it appears that the container can be accessed by anyone without the need to authenticate. If you run it is host mode then remote access requires authentication. Thanks again for the quick reply. Hopefully, this will help anyone else who may be running docker with networking set to bridge. Thanks again.

[eric]

@mikefromnj We're rolling out a fix to make sure this doesn't happen to anyone in the future. Thanks again for reporting this and helping us track down what was happening.

⚠️ Security Resolution Incoming ⚠️

Hey everyone. We're getting ready to roll out an update that has a big change that closes an existing hole in security for your Channels DVR Server. We aren't going to detail it until we've released the update, but we wanted to give you a heads up. Once the update is out, we'll release a post about it in more detail. Read below to see if you're effected and how to fix it. Am I affected? If you are NOT running Channels DVR Server via Docker, you are NOT affected. You can ignore this po…

[mikefromnj]

Hi Eric,

Thanks for addressing the issue so quickly,

Mike