lock down RTSP Streams for anonymous users

[Bischi1997]

Question

Hi Everyone

I am facing the following Issue:
I have multiple streams, which I want to proxy with MediaMTX (MediaMTX v1.13.1). Each stream should have multiple users that can access the same stream. Each stream needs to be authenticated by a user and password, there should be no "any" user or any stream without user credentials.

The following command gets me a stream even though it should not:
vlc --rtsp-tcp rtsp://someIP:8554/teststream
The following does get me an auth error, as it should ("closed: authentication error"):
vlc --rtsp-tcp rtsp://any:any@someIP:8554/teststream
The following does get me a stream as it should:
vlc --rtsp-tcp rtsp://testUser1:testUser1@someIP:8554/teststream

I tried multiple things to lock down the streams, but somehow I can not figure out how to only allow authenticated users to access the RTSP Streams. It does not matter how I configure it, the stream is always available to a non authenticated user.

What is the correct way to do the above with MediaMTX and local Authentication (or LDAP auth)?

Best regards
Bischi

The following things I already tried:

• create "any" user with permissions to a non existing stream:

- user: any
  # IPs or networks allowed to use this user. An empty list means any IP.
  ips: []
  # List of permissions.
  permissions:
    # Available actions are: publish, read, playback, api, metrics, pprof.
    # Paths can be set to further restrict access to a specific path.
    # An empty path means any path.
    # Regular expressions can be used by using a tilde as prefix.
  - action: publish
    path: none
  - action: read
    path: none
  - action: playback
    path: none
  - action: api
    path: none
  - action: metrics
    path: none
  - action: pprof
    path: none

• remove the any user and allow the createtd testusers to the streams like this:

- user: testUser1
  # Password. Not used in case of 'any' user.
  pass: testUser1
  # IPs or networks allowed to use this user. An empty list means any IP.
  ips: []
  # List of permissions.
  permissions:
    # Available actions are: publish, read, playback, api, metrics, pprof.
    # Paths can be set to further restrict access to a specific path.
    # An empty path means any path.
    # Regular expressions can be used by using a tilde as prefix.
  - action: read
    path: teststream
  - action: playback
    path: teststream

paths:
  teststream:
    source: rtsp://backendUser:backendPass@someIP:554/somestream

[jmduerk]

Did you get this figured out yet? Just looking at this since it's three days old. I don't want to spend time gathering an answer if you don't need it.

[Bischi1997]

Hi @jmduerk,

The issue is still there, however I found that a custom HTTP Server auth does what I need it to do.

Not sure if this still should be looked at, as it seems like this could be a bug in the internal auth?
If I request the URL without any auth, it should ask me for credentials, instead of just providing the rtsp-stream.
From my POV, this could be a boolean toggle or just some configuration.
If this is expected behavior, this can be discarded, I guess.

Best regards
Bischi

[aler9]

Hello, the problem here is that VLC caches credentials, so if you authenticated once, you are authenticated for life.

Other than that, instructions on how to implement authentication are in the README:
https://mediamtx.org/docs/usage/authentication