Agent skill · security · aradotso
jellyfin-security-plugin
Add native two-factor authentication, passkeys, SSO, brute-force protection, and audit logging to Jellyfin media servers via server-side plugin.
Why this skill is useful
Adds comprehensive security features and configurations for Jellyfin that are not commonly known or documented, including multi-factor authentication and brute-force protection scripts.
What it needs
Requires jellyfin installed locally. About 9k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
Jellyfin Security Plugin Skill by ara.so — Security Skills collection. What It Does JellyfinSecurity is a comprehensive authentication and hardening plugin for Jellyfin media servers (10.11+). It adds: Multi-factor authentication: TOTP (Authy/Google Authenticator), passkeys (WebAuthn/FIDO2), email OTP, and recovery codes Single Sign-On: OIDC provider integration (Authentik, Authelia, Keycloak, Pocket ID, etc.) Brute-force protection: IP-based rate limiting and banning with configurable thresholds Device management: TV device pairing via QR code, trusted browser tokens Network controls: LAN bypass, per-user IP allowlist, impossible-travel detection Audit logging: Full login/logout/config-change event tracking Step-up authentication: Re-verify TOTP/passkey/IdP before sensitive admin actions Server-side enforcement works with all Jellyfin clients (web, Android, iOS, Roku, Fire TV, Kodi) and service integrations (Sonarr, Radarr, Tautulli). --- Installation Via Jellyfin Admin Dashboard (Recommended) 1. Open Jellyfin → Admin Dashboard → Plugins → Repositories 2. Add repository: Name: JellyfinSecurity URL: https://raw.githubusercontent.com/ZL154/JellyfinSecurity/main/manifest.json 3. Go to Catalog → search "Security" → Install 4. Restart Jellyfin server Manual Installation Verify installation: --- Configuration Admin Dashboard Settings Navigate to Dashboard → Plugins → JellyfinSecurity → Settings. Core Authentication Brute-Force Protection LAN Bypass ⚠️ Trusted Proxy Pitfall: Do NOT set broad ranges like 10.0.0.0/8 in TrustedProxyCIDRs — the SEC-H3 guard will refuse LAN bypass for direct clients if their IP falls within a trusted-proxy range but no X-Forwarded-For header is present. Use /32 (single IP) or tight /24 subnets for your actual reverse proxy. Device Pairing (TV Clients) Step-Up Authentication --- Usage Patterns End-User Enrollment (TOTP) After installing the plugin, users enroll via Jellyfin web UI: 1. User → Profile → Two-Factor Authentication 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/jellyfin-security-plugin