Announcement

**Apesbrain** · 2019-09-25, 17:18

Very cool! But I need it for Google Home.

**Paul Webster** · 2019-09-25, 17:28

Interesting approach.
The https section at https://smartskills.tech/mediaserver/#tab2 does a good job of describing things.
It does mean that no LMS addon is required to be added into the local LMS.
Will be interesting to see how many people go through the steps.

**mherger** · 2019-09-25, 18:20

[Announce] 'MediaServer' *certified*Alexa skill for LMS

But doesn't this require to expose your LMS to the internet? Don't be
soothed by the use of https: if there's no password protection
whatsoever, then I and John Doe would be able to control your players,
too. https only protects the transfer from your door to the recipient (or
the other way around), but not the door itself.

Which brings us back to this:
https://forums.slimdevices.com/showt...o-the-internet!

--

Michael

**philchillbill** · 2019-09-25, 18:29

Yes Michael, but a reverse proxy or ssl tunnel DOES implement password protection. It’s certainly not the same as exposing your LMS directly to the outside. The online docs for the skill explain this very clearly.

Note: As of Feb 2021 there's a completely automated installation procedure for the ngrok proxy - see the announcement at https://forums.slimdevices.com/showt...e-Alexa-skills

**slartibartfast** · 2019-09-25, 18:40

Originally posted by philchillbill

Yes Michael, but a reverse proxy or ssl tunnel DOES implement password protection. It’s certainly not the same as exposing your LMS directly to the outside. The online docs for the skill explain this very clearly.

Sent from my iPhone using Tapatalk

Is there a username/password in the Serveo set up? The instructions say to leave them blank.

Sent from my SM-G900F using Tapatalk

**d6jg** · 2019-09-25, 19:25

This looks very interesting. The serveo tunnel setup is from the local end so I presume no port opening is required?

**philchillbill** · 2019-09-25, 19:31

Originally posted by slartibartfast

Is there a username/password in the Serveo set up? The instructions say to leave them blank.

Serveo has the option to use SSH public key authentication (PKA) but that involves public/private rsa keys which are not a traditional username and password and explains why they are to be left blank. Their site explains PKA. You can use serveo without PKA to create an unsecured tunnel, and combine it with apache to reverse-proxy towards your LMS machine with basic auth enforced. More involved but very secure. At least there's no need then to get an SSL cert and DDNS name and open ports. If you did things that way, the server path to fill in would still be serveo but you WOULD then fill in the username and password that you configured for the secondary apache.

However, ngrok is by far the easiest option and it's very secure.

**d6jg** · 2019-09-25, 20:13

Originally posted by philchillbill

Serveo has the option to use SSH public key authentication (PKA) but that involves public/private rsa keys which are not a traditional username and password and explains why they are to be left blank. Their site explains PKA. You can use serveo without PKA to create an unsecured tunnel, and combine it with apache to reverse-proxy towards your LMS machine with basic auth enforced. More involved but very secure. At least there's no need then to get an SSL cert and DDNS name and open ports. If you did things that way, the server path to fill in would still be serveo but you WOULD then fill in the username and password that you configured for the secondary apache.

However, ngrok is by far the easiest option and it's very secure.

My router - Draytek Vigor - supports SSL Web Proxy with user/pass.
Https://mypublicipaddress:443 proxies to http://lmsip:9000
Presumably this would also work?

**mherger** · 2019-09-25, 20:27

[Announce] 'MediaServer' *certified*Alexa skill for LMS

> Serveo has the option to use SSH public key authentication but that
> involves public/private rsa keys which are not a traditional username
> and password and explains why they are to be left blank.

It's my understanding that this is not being used to protect access to
the host, but the connection when using a custom domain of yours.

IMHO ngrok is kind of a cloud based reverse proxy with additional
features, whereas serveo is much simpler, but mostly a port forwarding
service. No added http features besides the https wrapper. But your LMS
would be as exposed to the internet as if you did forward the port on
your router.

--

Michael

**castalla** · 2019-09-25, 20:32

Failed at first hurdle ....

This page isn’t working
xxxx.serveo.net is currently unable to handle this request.

502 error

**d6jg** · 2019-09-25, 20:36

Originally posted by mherger

> Serveo has the option to use SSH public key authentication but that
> involves public/private rsa keys which are not a traditional username
> and password and explains why they are to be left blank.

It's my understanding that this is not being used to protect access to
the host, but the connection when using a custom domain of yours.

IMHO ngrok is kind of a cloud based reverse proxy with additional
features, whereas serveo is much simpler, but mostly a port forwarding
service. No added http features besides the https wrapper. But your LMS
would be as exposed to the internet as if you did forward the port on
your router.

--

Michael

Serveo
A portscanner on 9000 wouldn’t find it.
You’d have to guess the unique part of the serveo host name and know that 443 would expose 9000 but yes it must effectively be open.
It’s the simplicity and validity of the SSL cert that makes this attractive if a little risky.

I’ll get myself an SSL cert for my router I think and use it’s in built SSL web proxy

**philchillbill** · 2019-09-25, 20:45

Originally posted by mherger

> Serveo has the option to use SSH public key authentication but that
> involves public/private rsa keys which are not a traditional username
> and password and explains why they are to be left blank.

It's my understanding that this is not being used to protect access to
the host, but the connection when using a custom domain of yours.

IMHO ngrok is kind of a cloud based reverse proxy with additional
features, whereas serveo is much simpler, but mostly a port forwarding
service. No added http features besides the https wrapper. But your LMS
would be as exposed to the internet as if you did forward the port on
your router.

I agree. Serveo is the least attractive option, but I added it to the list because people have preferences for ways of doing things and it's yet another way. I have found it to be flaky as far as availability in my testing.

If I were using serveo myself, I'd always combine it with apache as an extra layer for auth. That way, serveo would handle the 'front-end' of me not having to open a port, not having to do DDNS, not get a cert. And apache would do the 'back end' of forwarding the serveo tunnel through a basic-auth capable local proxy in my network towards LMS as an extra security layer. Rather involved, but hey there's more than one road that leads to Rome.

In the end, it's only the JSON that's tracing these pathways and not audio-streams, so not a big deal to add a layer.

**philchillbill** · 2019-09-25, 20:53

Originally posted by d6jg

My router - Draytek Vigor - supports SSL Web Proxy with user/pass.
Https://mypublicipaddress:443 proxies to http://lmsip:9000
Presumably this would also work?

Absolutely. If you already have a public IP address and cert (the hard parts) then however you proxy that to lmsip:9000 is largely irrelevant. Apache is there for people who don't have fancy routers like you

**mherger** · 2019-09-25, 21:29

[Announce] 'MediaServer' *certified*Alexa skill for LMS

> Serveo
> A portscanner on 9000 wouldnâ€™t find it.

Correct: as you wouldn't get your own IP address, but only a virtual
host name, a simple IP scanner wouldn't find your LMS. A visitor would
need to know your host name. That's different from (and quite a bit more
secure than) simple port forwarding on the router, where an IP scanner
would find you.

--

Michael

Announcement

[Announce] 'MediaServer' certified Alexa skill for LMS

[Announce] 'MediaServer' certified Alexa skill for LMS

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Announcement

[Announce] 'MediaServer' *certified* Alexa skill for LMS

[Announce] 'MediaServer' *certified* Alexa skill for LMS

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

[Announce] 'MediaServer' certified Alexa skill for LMS

[Announce] 'MediaServer' certified Alexa skill for LMS