[solved] Setup restrictions before device hits serviio?

[sleky]

Profile configuration? Is it possible to set the restricted/un-restricted flag for IP addresses (or a range?) in a configuration page someplace? I'm having a little trouble with some of my kids tablets not showing up on the profile rendering page to set them up with the restricted profile. I have their devices in a separate VLAN so I KNOW that they will be getting a 10.0.3.0/24 address and I want to put that whole subnet on the restricted profile so that in case one of their friends (its the default VLAN subnet) tries to get an IP via DHCP that they still won't be able to get into the restricted content. But... Like I said, I can't even see the IP for one of the tablets, but I can browse the content all day long... Argh...

Gracias!

[Iveky]

it is task for your router, not for serviio. if there is no such option in it, then change/buy some able to do the job. dd-wrt routers family is capable and has plenty of options...

[will]

As long as you are running Serviio 1.3, there is an option to either disable access to new devices, or allow access, but put them in the resticted access group from within the console. You won't be able to block some devices, but you can make them all restricted by default, and then open up any devices that you want to give full access.

If a device isn't showing up, but you can access its content, then its probably showing using the IP address of the VLAN gateway, so set that to restricted.

[sleky]

Hmmm... Nope, GW not showing up either. I'm going to ditch the separate vlans (was just playing, seriously, why does my HOUSE need 5 different vlans anyways, lol). I'm going to go on a flat subnet. Lemme setup some reservations and see if I can't get it working that way.

On a side not, when the devices show up in the list, as an IP with no hostname. That's reverse DNS not working, yea? Or is that even dependent on DNS? The "device name"...

[will]

Device name is a friendly model name (usually), not the host name, e.g. 'Sony BDP S370' or XBOX 360 etc... When the device doesn't advertise its model, it comes up as 'Unrecognized device'

[sleky]

Anyway to statically give it a name then? As these devices get added as unknown, and I get just an IP. Be nice to nickname them? Something to identify more than the IP address? Still not able to see my Android tablet tho. Default debug log turnup or is there something specific I can turn up for errors?

[will]

You can do it using ServiiDroid (search on Google Play), but not through the official console. (Note you will also need to completely exit and reload the official console to see any changes made by ServiiDroid).

What are you using to connect from your Android tablet? If you are using ServiiGo, that won't turn up as it doesn't use DLNA.

[sleky]

Time to find an Android emulator (can't put it on my daughters tablet, lol). Speaking of... I still cannot see her tablet. Its on a flat network. No firewall, nothing hindering communication, that I can tell...

Sadly, I don't use the 'official console'. I'm running a headless install.

[will]

OK, so how is your daughter connecting with her tablet, is it a DLNA/UPnP app, or is it ServiiGo?

Are you using the PHP WebUI then? You can still run the offical console and point it to a headless server btw.

[sleky]

Here is what I have running.

OS: Debian 7 x64 headless
IP: 10.0.0.2 (static)

iMac running web browser
IP: 10.0.0.103 (DHCP)

Android tablet running ServiiGo
IP: 10.0.0.97 (reservation)

Android phone running ServiiDroid and ServiiGo (Generic DLNA profile)
IP: 10.0.0.143 (DHCP)

iPad running AirPlay (iPhone profile)
IP: 10.0.0.98 (reservation)

Windows laptop running web browser (Generic DLNA profile)
IP: 10.0.0.99 (reservation)

WD HD TV Live (WDTV Live profile)
IP: 10.0.0.129 (DHCP)

The following devices are seen: WD HD, Android phone, iPad, and Windows laptop. They are all 'enabled'. However, it would appear that NONE of them accept the Limited_Access restriction. Seems everything has full access to all content.

Couple of screen shots!

[will]

The access groups only works for DLNA at the moment, it does not work for ServiiGo or MediaBrowser (i.e. anything that uses the API for remote access).

If you are using ServiiGo or MediaBrowser on a device, and it shows up as Generic Device on the console, thats probably because its running something that suports some form of UPnP discovery.

One solution is for the console (inc ServiiDroid) to be extended to list devices that use the CDS API (ServiiGo/MediaBrowser). However, its not quite that simple, IP address doesn't really work for external access and cookies can be cleared/lost. ServiiGo does send a unique clientId, but MediaBrowser would have to use cookies. Another one would I guess be multiple user accounts, each with different access levels assigned to them.

[sleky]

Is there any thought for opening up authentication mechanisms then? With the plethora of different devices my household uses to access content, its going to be a nightmare trying to keep my kids from seeing EVERYTHING without any way of authentication. RADIUS, LDAP, certificate based... Something?

[will]

Realistically LDAP etc is a bit overkill for a home streaming server, but I can certainly see the benefit of multiple accounts (with different access groups and passwords), that way family members / friends can login and get access to a subset of the media.

Either way, it's got to be added to Serviio first before I can add it to ServiiGo. I think some people have requested multiple user names, but I cannot see anything on the issue tracker.

@zip, what is your current thinking about access groups for CDS API clients?

[sleky]

I agree. Probably overkill. So is ALL the other geeky services I've got running everywhere too.

But, it really isn't anything for me to throw on a RADIUS server, setup a few groups. Owner, Kids, Friends, Guests, ect to restrict all sorts of content. I'd like to keep my family videos personal but share the kids movies with the family next door. I'd love to prevent my kids watching Sliver if at all possible, but I still want them to access The Princess and the Frog. I was ok with restricted vs un-restricted content. But it doesn't sound like it will play nice with other players, if at all.

If I can help with authentication... Lemme know. I'm going to mark this thread as solved. Since... will DID answer it (check Enable access for new devices on the Status page). I got the console working on my iMac. Thanks for that too btw. ;D