Hello, I’m wondering what the consensus is (if there is one) on the best hardware and software (open source very much preferred, runs in Docker is a must) to use for privacy-respecting, self-hosted security cameras. I have always wanted to avoid feeding the surveillance state and have never had a security camera but unfortunately I recently saw evidence of someone trying to break into my home. I searched Lemmy for posts on this topic and only found one from two years ago: https://lemmy.world/post/12726787. I assume things are a bit different now so I’m basically making the same post again as OP. Thanks in advance for any tips anyone may have for me.
PS. My experience level is that I currently run several self-hosted solutions via Docker and have been doing so for a few years. I am not a networking guru but I do understand the basics, and I’ve setup pihole in the past (but deactivated it due to some false-positive issues). If there’s a reason to stand that back up in order to prevent otherwise private cameras from “phoning home”, I can do that.
Firstly, thank you for all this advice.
I think you are a couple paygrades above me when it comes to networking knowledge though. Can you say more about why cameras in particular are specifically such a liability? Is it because they are a hackable thing which is observable from public space?
They use networking software that’s optimized for speed and low resource use (you’d rather be spending those arm/esp cycles handling video, right?) with a slow patch cycle and little chance the user (you!) will actually get up on a ladder and install the damn patches.
Some of them will dial out and try to get their patches, but did it work? Are they still running right after the patch? You don’t know that because you don’t even know they got a patch notification, dialed out, downloaded and installed it, silently changed a default or removed a resolution you relied on and aren’t sending video anymore! Do you even want them doing that?
Even if they weren’t doing all that, there are hundreds of vulnerabilities that allow a user on the local network to silently bypass auth and view them, change settings etc.
The above isn’t because they’re crappy (they are crappy.) but because they’re using some weird .005$ cheaper esp32 variant that needs a modified binary which isnt on anyone’s radar and had support dropped 2 years ago.
I have even run into modern ip cameras that would try to proxy their feed on a public facing ip that used to be owned by the (now defunct) manufacturer but is now some weirdo just slurping up what gets sent to them.
The simple solution is to put them on a derek zoolander vlan for network devices that can’t network good, cut em off from the outside world and check for updates manually.
Peanut gallery here but I have a couple questions about IP cameras and what the recommended setup exactly looks like. If you or someone else could answer them it would be greatly appreciated.
You were saying in your first comment that you would recommend getting one of the infamous 10 year old servers with redundant power supplies specifically for this. On said server:
a. How much RAM would you recommend to start? Most of those servers still use DDR3/4 so it shouldn’t be too god awfully expensive.
b. What OS setup would you recommend? Ubuntu Server/CLI Debian, or something like adding the server to a Proxmox cluster and running a resource-heavy VM with GPU and HDD pass through?
As far as the client end of the monitoring stack, would you recommend a Raspberry Pi with a cheap-ish monitor that acts as a dedicated client for this, or an open port or firewall rule which allows a web client to be accessible via the rest of your LAN?
I would recommend you think critically about what you’re trying to accomplish first and foremost then implement the simplest system that has the fewest points of failure.
I see, I think. When it comes to the updates you’re mentioning, is that primarily the firmware on the devices that is of concern? Whatever software solution I’d go with, I’d stay pretty on top of updating it because that’s something I’ve learned is pretty important.
Apologies for the account change, credential rolling schedule waits for no man.
Yes, it’s device firmware.
Again, if you would like a more practical approach based on the experience of being robbed I will gladly volunteer it.