Removing --net=host bypasses login

[magicknot]

Whenever I remove --net=host the login screen seems to disappear, allowing anyone to see the server as my user (I'm the owner).

[wernight]

I think you're logged in. Try to close all windows and start an incognito. It's also not likely an issue with this containerize image.

[magicknot]

I tried it on incognito before opening this issue.

[wernight]

No sure if you're using latest or autoupdate tag and which environment variables you're setting.

[magicknot]

I'm sorry for the lack of information in my post. I'm using the latest tag and doing docker inspect on the container, the env is the following:

            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "PLEX_MEDIA_SERVER_MAX_PLUGIN_PROCS=6",
                "PLEX_MEDIA_SERVER_MAX_STACK_SIZE=3000",
                "PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR=/config",
                "PLEX_MEDIA_SERVER_HOME=/usr/lib/plexmediaserver",
                "LD_LIBRARY_PATH=/usr/lib/plexmediaserver",
                "TMPDIR=/tmp"
            ],

[wernight]

Looks like you're running with the default settings.

It seems something changed in the way Plex is initially set up. Now unclaimed servers are accessible without log in if the port is open. It's a big security issue. I'm trying to understand yet how and when a server may get unclaimed as it seems to happen.

[wernight]

It seems that this issue only happens with --net=host. If people can confirm I'll update the README to make it much more prominent that there is a security risk. I do not understand why it doesn't remember that it was claimed though. Unless the apk install has something to do with it, or I'm not saving some directory...

I've added a script to help retrieve the X-Plex-Token, but I found that installing without --net=host to be still a pain.