November 7, 20223 yr Hi all, asking for a friend... for real, as I already own an Unraid server. A friend of mine is interested in Unraid, but he questions the security of plugins. For Docker, we both understand how security works in that regard, but we are unsure about plugins. So the concrete questions: What prevents a potentially malicious plugin from being posted (and thereby installed) in the plugin repository? If a non-malicious plugin becomes malicious through an update... would that be caught somehow? Maybe an explanation on what a plugin is or is not actually allowed to do would be helpful, as well as a short summary of a potential plugin review process. Thanks a lot!
November 7, 20223 yr Solution Plugins can do just about anything so in that sense they are a security risk. Users should definitely not install any random plugin. If a malicious user gains access to your server then they could install a rogue plugin. However a plugin will not survive a server reboot unless there is a corresponding .plg file in the ‘config/plugins’ folder on the flash drive so at least it will be visible. it is expected that plugins make their source code publicly available (not sure if there are any that do not conform to this rule). I know that they are not added to CA unless their is a chance to review their code.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.