Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Any suggestions on simple auth methods to avoid running an open Jitsi server?

Last time I tested it, it seemed to be very open by default, letting anyone create meetings. I got lost when digging deeper.

If I install-and-forget, I want to avoid situations where strangers are using my Jitsi server and overloading the system, or pretending to be our company. Last I checked, it was not possible to have simple auth, or monitor/list calls.

I also run an Asterisk VoIP server with a WebRTC bridge (because most Linux SIP clients have terrible usability). That can make one pretty paranoid :)



Yes, I installed Jitsi Meet over the weekend and enabled auth so you need credentials to start a new conference, but anyone with the link (and optionally password too) can join unauthenticated.

I followed these instructions to add the auth https://github.com/jitsi/jicofo#secure-domain


I've been experimenting with Asterisk WebRTC (video & audio) and developing a SIP + P2P webphone for some time now. Quite close to something that's useable imho. See https://github.com/garage11/ca11 in case you're interested



You could use something like the Duo Network Gateway or Cloudflare Access to protect it.


my university' setup has something asking for "host credentials" before starting the session, so I think it's possible. If it's just for internal use, one could just put basic HTTP(s)-auth in front?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: