Audio Streaming Server associated vulnerabilities

Question

What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff.

The first thing made me think of vulnerabilities was that login users and passwords are not used in hash - at least while using IceCast - and they are all clear text! Is there a way to use hash instead or not? If not so, what vulnerabilities may it cause?

What else may be harmful, - ports and etc - anything?? And what should I be aware of during configuring my streaming server?

More Info on what I’m using:

I’m using IceCast for the server, and EZStream as a source client for the Icecast streaming server (i.e. client/listener(s)).

And I'm Running this project on Both Debian Jessie and CentOS 7 - not launched yet, still in its test-like beta version, so I can change anything.

I’m open to any suggestions, even if it’s about doing things from scratch.

Answer 1

See below example diagram. This way is good because:

• Server to which you push stream is not the same as on the public internet, therefore you can make sure it's properly secured, like there's no public access to it so this way you close a lot of exploits associated with pushing streams and other tricks (you need to have publishing streams enabled on this one)
• On the edge server you do not need to setup any passwords or any access (like pushing streams), just make point to the origin server where's the source stream
• You can then use two edge servers and load balance between with them while using single origin server (DNS can be used to do it)
• You got more stability of your audio push in case your edge server gets swamped, loaded etc

You can do it this way: - Host two servers (origin and edge) on the same box but different ports - Host origin server on the EZStream system and setup port forward on router to static IP address to pull it from there, this method is more stable but requires static IP address - On the edge server disable as much as you can and setup limit to max streams like to 100MBps or less for typical VPS - If you have static IP address on EZStream system, setup firewall to allow only your EZStream to connect to Origin Server. If you don't have, setup Firewall route for your whole class based on WHOIS (whois your IP address).

This kind of setup is most stable and most secure without much doing. Also keep SELinux on the Centos7 box and eventually add additional rules for IceCast if required (audit2allow). This will guarantee you very high level of security for network daemon. This is highly recommended for IceCast servers.