如何保护 Ant Media 服务器中的 HLS 流？

Question

我正在寻求帮助以了解如何保护 Ant Media 服务器中的 HLS 视频。

我尝试过ip白名单功能，但不起作用。我想阻止未经授权的第三方网站嵌入我的 HLS ant 媒体流

Answer 1

防止 Ant Media HLS 和 DASH 流被未经授权的第三方网站嵌入的解决方法是配置 Nginx 反向代理。

这可以通过在安装了 ant media 的服务器上安装 Nginx 来完成。

现在，您需要自定义

nano /etc/nginx/nginx.conf

文件。这是您需要的示例配置：

   user nginx;
worker_processes auto;
pid /var/run/nginx.pid;
worker_rlimit_nofile 1048576;

events {
    worker_connections 1048576;
    multi_accept on;
    use epoll;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    server_tokens off;
    keepalive_timeout 300s;
    types_hash_max_size 2048;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # ssl settings
    ssl_protocols TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;

    # logs settings
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"'
                      '"$hostname" "upstream: $upstream_addr"';
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    # gzip
    gzip on;
    gzip_disable "msie6";
    gzip_http_version 1.1;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/json application/javascript text/javascript application/x-javascript text/xml application/xml application/xml+rss application/vnd.ms-fontobject application/x-font-ttf font/opentype font/x-woff image/svg+xml image/x-icon;

    # proxy settings
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_read_timeout 10s;
    proxy_send_timeout 10s;
    proxy_connect_timeout 10s;
     
    #redirect all http requests to https
    server {
        listen 80 default_server;
        server_name _;
        return 301 https://$host$request_uri;
    }  

    #Origin Configuration
    #Change {YOUR_DOMAIN} with your fully qualified domain name. 
    server {
            listen 443 ssl;
            ssl_certificate /etc/letsencrypt/live/{YOUR_DOMAIN}/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/{YOUR_DOMAIN}/privkey.pem;
            server_name yourdomain.com;

            location / {
              if ($http_referer !~* "^https?://(www\.)?Whitelisted-domain-name\.com"){
              return 403;
        }
                proxy_pass http://AMS-server-IP:5080;
                proxy_http_version 1.1;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
            }
        }
    
    #Dashboard Configuration (To allow access to your AMS dashboard on different port which should be allowed only for specific IPs)
    #Change {YOUR_DOMAIN} with your fully qualified domain name. 
    server {
            listen 4444 ssl;
            ssl_certificate /etc/letsencrypt/live/{YOUR_DOMAIN}/fullchain.pem;
            ssl_certificate_key /etc/letsencrypt/live/{YOUR_DOMAIN}/privkey.pem;
            server_name yourdomain.com;

            location / {
                proxy_pass http://AMS-Server-IP:5080;
                proxy_http_version 1.1;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";
            }
        }
    }

在上面的代码中，找到以下代码块：

   location / {
          if ($http_referer !~* "^https?://(www\.)?Whitelisted-domain-name\.com"){
          return 403;
    }

此代码块将用于将域列入白名单，允许嵌入您的 HLS Ant Media 流，否则其他域将被阻止

我建议您阅读整个指南以详细了解如何在 Ant Media Server 中保护 HLS 和 DASH 流本指南包含如何轻松完成此操作的分步过程。