--- title: Deploying a Hardened Janus Gateway – WebRTC.ventures description: Janus is a great, lightweight piece of software that allows you to scale video conferencing quickly. While Janus documentation isn’t very easy to decipher to a newer user of the platform, it’s still a powerful tool that can be leveraged to overcharge your WebRTC infrastructure. Our WebRTC Engineer Jacob Greenway sheds light on some of the more difficult aspects of Janus security and shares best practices for hardening a Janus gateway to security attacks. image: https://blog.webrtc.ventures/hubfs/Imported_Blog_Media/Deploying-a-Hardened-Janus-Gateway.png --- [Skip to content](https://blog.webrtc.ventures/2021/08/hardened-janus-gateway#main-content) ![WebRTC.ventures](https://blog.webrtc.ventures/hubfs/logo-main-light.svg) - [WebRTC Services](https://webrtc.ventures/webrtc-development-services/) Show submenu for WebRTC Services - [Assess](https://webrtc.ventures/services/assess/) - [Build](https://webrtc.ventures/services/build/) - [Integrate](https://webrtc.ventures/services/integrate/) - [Test](https://webrtc.ventures/services/test/) - [Manage](https://webrtc.ventures/services/manage/) - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/) - Our Partners Show submenu for Our Partners - [Amazon Chime SDK](https://webrtc.ventures/partners/amazon-chime-sdk/) - Stories of Success Show submenu for Stories of Success - [Remote Video Interpreting Platform with Agent Routing](https://webrtc.ventures/successes/remote-video-translation-platform/) - [WebRTC to SIP Gateway for ASL Interpreters](https://webrtc.ventures/successes/webrtc-to-sip-gateway-for-asl-interpreters/) - [Audio Listening Device to Improve Surgical Outcomes](https://webrtc.ventures/successes/audio-listening-device-to-improve-surgical-outcomes/) - [Albania’s First Telemedicine Platform](https://webrtc.ventures/successes/albanias-first-telemedicine-platform/) - [Automated Video Storytelling with the Amazon Chime SDK](https://webrtc.ventures/successes/automated-video-storytelling-with-the-amazon-chime-sdk/) - [Large Scale Video Conferencing](https://webrtc.ventures/successes/large-scale-video-conferencing/) - [Broadcasting and Webcast Control Room](https://webrtc.ventures/successes/live-video-broadcasting-and-webcast-control-room/) - WebRTC Resources Show submenu for WebRTC Resources - [WebRTC Live](https://webrtc.ventures/webrtc-live/) - [WebRTC Tips](https://www.youtube.com/playlist?list=PLayYqdnyegt3QvxX-Rt6wbFIK8727Z5Oz) - [WebRTC.ventures Blog](https://webrtc.ventures/blog/) - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/) - [WebRTC.ventures Training Program](https://webrtc.ventures/webrtc-ventures-training-program/) - [About Us](https://webrtc.ventures/our-team/) Show submenu for About Us - [Blog](https://webrtc.ventures/blog/) - [Our Team](https://webrtc.ventures/our-team/) - [Jobs](https://webrtc.ventures/jobs/) Open main navigation Close main navigation - [WebRTC Services](https://webrtc.ventures/webrtc-development-services/) Show submenu for WebRTC Services - [Assess](https://webrtc.ventures/services/assess/) - [Build](https://webrtc.ventures/services/build/) - [Integrate](https://webrtc.ventures/services/integrate/) - [Test](https://webrtc.ventures/services/test/) - [Manage](https://webrtc.ventures/services/manage/) - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/) - Our Partners Show submenu for Our Partners - [Amazon Chime SDK](https://webrtc.ventures/partners/amazon-chime-sdk/) - Stories of Success Show submenu for Stories of Success - [Remote Video Interpreting Platform with Agent Routing](https://webrtc.ventures/successes/remote-video-translation-platform/) - [WebRTC to SIP Gateway for ASL Interpreters](https://webrtc.ventures/successes/webrtc-to-sip-gateway-for-asl-interpreters/) - [Audio Listening Device to Improve Surgical Outcomes](https://webrtc.ventures/successes/audio-listening-device-to-improve-surgical-outcomes/) - [Albania’s First Telemedicine Platform](https://webrtc.ventures/successes/albanias-first-telemedicine-platform/) - [Automated Video Storytelling with the Amazon Chime SDK](https://webrtc.ventures/successes/automated-video-storytelling-with-the-amazon-chime-sdk/) - [Large Scale Video Conferencing](https://webrtc.ventures/successes/large-scale-video-conferencing/) - [Broadcasting and Webcast Control Room](https://webrtc.ventures/successes/live-video-broadcasting-and-webcast-control-room/) - WebRTC Resources Show submenu for WebRTC Resources - [WebRTC Live](https://webrtc.ventures/webrtc-live/) - [WebRTC Tips](https://www.youtube.com/playlist?list=PLayYqdnyegt3QvxX-Rt6wbFIK8727Z5Oz) - [WebRTC.ventures Blog](https://webrtc.ventures/blog/) - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/) - [WebRTC.ventures Training Program](https://webrtc.ventures/webrtc-ventures-training-program/) - [About Us](https://webrtc.ventures/our-team/) Show submenu for About Us - [Blog](https://webrtc.ventures/blog/) - [Our Team](https://webrtc.ventures/our-team/) - [Jobs](https://webrtc.ventures/jobs/) - [Contact us](https://webrtc.ventures/contact/) [Contact us](https://webrtc.ventures/contact/) Aug 3, 2021 12:00:00 AM # Deploying a Hardened Janus Gateway ![Picture of Jen Oppenheimer](https://blog.webrtc.ventures/hs-fs/hubfs/Our-Team-Jen.jpg?width=50&name=Our-Team-Jen.jpg) [Jen Oppenheimer](https://blog.webrtc.ventures/author/jen-oppenheimer) Share: [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.webrtc.ventures/2021/08/hardened-janus-gateway) [X Twitter icon](https://twitter.com/intent/tweet?url=https://blog.webrtc.ventures/2021/08/hardened-janus-gateway) [envelope icon](mailto:?body=https://blog.webrtc.ventures/2021/08/hardened-janus-gateway) If you’ve searched for a solution to [scaling your WebRTC application](https://webrtc.ventures/2021/07/webrtclive-scaling/), then more than likely you’ve been pointed towards [Janus](https://janus.conf.meetecho.com/). Janus is a great, lightweight piece of software that allows you to scale video conferencing quickly. Janus also provides a plethora of security features that your team can take advantage of, but can be challenging to properly configure. Where Janus can start to show it’s not-so-user-friendly side is when you dig into the details of connecting clients, setting up [TURN servers](https://webrtc.ventures/2020/12/webrtc-signaling-stun-vs-turn/), or using any of the other extensible features. While Janus documentation isn’t very easy to decipher to a newer user of the platform, it’s still a powerful tool that can be leveraged to overcharge your [WebRTC](https://webrtc.ventures/2021/01/what-is-webrtc/)infrastructure.  In this post we’ll go over some of the more difficult to understand aspects of Janus security and what [our team at WebRTC.ventures](https://webrtc.ventures/our-team/) have learned through our experience to give you a clearer insight on some best practices for hardening a Janus gateway to security attacks. While this post falls mainly in the scope of securing a Janus instance, we’ll briefly touch on the initial setup of Janus to get you started. There are two main ways to build your Janus gateway. The first is building from the source found in one of the releases on the [official github page](https://github.com/meetecho/janus-gateway). Documentation on the readme provides steps to installing the dependencies and build tools, but this can require a bit of legwork. The preferred solution might be to spin up one of the many [community-maintained Janus docker images](https://janus.conf.meetecho.com/docs/resources.html#docker) you can find on the official Janus site. You can determine which image best suits your needs. Just remember to mount the configuration files we’ll go over in the next sections to apply what we discuss. ## Basic TLS Configuration The first step these days to securing any web server or gateway is ensuring that the client and server can establish a tunneled connection. Janus is no different. We recommend setting up a reverse proxy with [NGINX](https://www.nginx.com/) to sit in front of your Janus gateway. In this example, we’ll use [Let’s Encrypt](https://letsencrypt.org/) on [Ubuntu 20.04](https://releases.ubuntu.com/20.04/) and set up a free TLS certificate. First, make sure that the domain name you intend to use is pointing to your server and that both port 80 and 443 are accessible to the open internet. Make sure to shut down any services already running on those ports before continuing. For purposes of brevity, we’ll be using the [certbot](https://certbot.eff.org) docker container. If you can’t or don’t want to set up [docker](https://www.docker.com/) on your server, follow the [instructions on using certbot natively](https://certbot.eff.org/instructions). Now we can begin by generating the certificates and saving them locally by running the certbot docker image with the following command: ``` docker run -p 80:80 -it --rm --name certbot -v "/path/to/cert:/etc/letsencrypt" \ -v "/path/to/lock:/var/lib/letsencrypt" \ certbot/certbot certonly -d your.domain.name --non-interactive \ --agree-tos -m your@email.com --standalone ``` JavaScript Copy This will generate a fullchain1.pem and and privkey1.pem for your domain name. These are the cert and key files you will need respectively. If you copy these files, make sure to copy the files from the **archive** directory as the ones in **live** are symlinks and not the actual files. Put these two files to a path you want them and make sure to set permissions of least privilege on them, preferably 0644 or stricter depending on your situation. They can then be referenced in an NGINX configuration file. We’ll save the following configuration to /etc/nginx.conf.d/default.conf. ``` server { listen 443 ssl; server_name ; ssl_certificate /path/to/fullchain1.pem; ssl_certificate_key /path/to/privkey1.pem; location /janus { proxy_pass http://localhost:8088 proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header Host $http_host; } } ``` JavaScript Copy This is assuming you are using the default configuration found [in janus.transport.http.jcfg](https://github.com/meetecho/janus-gateway/blob/be316330817cd85d42e70b6851b4b003c1f4eb08/conf/janus.transport.http.jcfg.sample#L14-L19) and that your Janus gateway is running on the same machine as the NGINX reverse proxy. Once you reload NGINX, all connections will require TLS, keeping clients secured when setting up voice or video calls! Just make sure any ports other than 443 are blocked with either an external firewall or a firewall running on the server to force traffic through NGINX. ## Janus Administration Options This is a shorter section, as we will just discuss the options available to enable access to the admin dashboard. The admin dashboard can be a useful tool for monitoring your Janus gateway, but could be considered a security risk if leaving it open in production. Consider securing the admin dashboard by setting similar location block in your NGINX configuration as below to maintain HTTPS connections for the admin dashboard. ``` location /admin { proxy_pass http://localhost:7088; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header Host $http_host; } ``` JavaScript Copy Further documentation on the admin dashboard can be found [here](https://github.com/meetecho/janus-gateway/blob/be316330817cd85d42e70b6851b4b003c1f4eb08/conf/janus.transport.http.jcfg.sample#L27-L49). ## Deploying and Securing CoTURN TURN is an essential part of hosting a reliable WebRTC application. In order to provide for customers with non-traversable NAT configurations we need to allow them to connect through a backup relay server. Janus can establish a connection through TURN, but it’s not very clearly defined how that process works. Janus and Janus clients can connect to CoTURN STUN/TURN servers with limited-time tokens so you don’t have to share a static user/password credential with the client. Using Janus with CoTURN ephemeral token authentication has a few requirements to get working properly. 1. CoTURN does not allow the mixing of long-term static credentials and token-based authentication, meaning both the client and Janus need to be issued temporary token-based creds. 2. Janus has [configuration parameters](https://github.com/meetecho/janus-gateway/blob/9f57b3246ca7cff04dd071f032d915068acde97a/conf/janus.jcfg.sample.in#L313-L316) that allow it to use token-based auth, but you will need to provide a REST API that generates these tokens with the shared secret key. See [this RFC](https://datatracker.ietf.org/doc/html/draft-uberti-behave-turn-rest-00) for details on how to implement it. (This REST API is NOT provided by CoTURN, the RFC is merely a guideline for implementing it yourself.) Note in special cases where the Janus gateway is on a restrictive NAT, you will need both the Janus client and Janus to connect to the same TURN server to establish a connection. This edge case is covered in the instructions below but is not necessary for public-facing Janus deployments. A sequence diagram that might make this process a little easier to visualize in context is shown below. ![Janus and CoTURN token-based authentication diagram](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/Janus-and-Coturn.png?width=523&height=584&name=Janus-and-Coturn.png) ![Janus and CoTURN token-based authentication diagram](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/Janus-and-Coturn.png?width=523&height=584&name=Janus-and-Coturn.png) We’ll go over an example of setting up token-based ephemeral authentication for a CoTURN server and connecting Janus using that authentication method. Password-based static credentials are out of scope of this post as they are not as secure and in order to connect clients you have to expose plaintext passwords to them. This section assumes that you’ve already set up a CoTURN server and we are updating an existing installation. Please see the [github](https://github.com/coturn/coturn/) for instructions on setting one up if you haven’t already. To enable token-based authentication on your CoTURN server, you’ll need to modify the turnserver.conf file with the following settings: ``` listening-port=3478 tls-listening-port=443 static-auth-secret= server-name= oauth realm= # NOTE: The reason we use the archive directory and not live here is because coturn has known issues with symlinks cert=/desired/path/cert/archive//fullchain1.pem pkey=/desired/path/cert/archive//privkey1.pem ``` JavaScript Copy The cert and private key used in this step can be the same we generated in the first section with Let’s Encrypt from before. The secret key can be set to whatever you want here and will be used to generate tokens for clients to connect with. Now we can configure Janus to get generated tokens to authenticate to CoTURN by setting the following configuration in janus.jcfg: ``` turn_server = "myturnserver.com" turn_port = 3478 turn_type = "udp" turn_rest_api = "http://yourbackend.com/path/to/api" turn_rest_api_key = "anyapikeyyoumayhaveset" turn_rest_api_method = "GET" turn_rest_api_timeout = 10 ``` JavaScript Copy Remember, the REST API set here should follow the previously mentioned CoTURN RFC and will need to be written to return a token generated from the secret key shared with CoTURN we set earlier. This API endpoint can also be used to generate tokens for browser clients connecting to the same TURN server. A quick example to replicate the functionality of this endpoint can be done using the openssl package on Ubuntu. By passing in a timestamp (expiration time) and the secret key we can generate a base64 token: ``` echo -n 1622564905 | openssl dgst -binary -sha1 -hmac | openssl base64 ``` JavaScript Copy Once setup, this configuration will allow Janus to automatically authenticate by grabbing a new token when needed! ## Conclusion There are a lot of hidden gems to hardening Janus. Once implemented, the combination of a TLS tunnel and ephemeral generated credentials will provide the best chance at dealing with potential attacks on your WebRTC infrastructure while still enabling high scalability with Janus as the backend. ***If you are looking for more ways to scale and secure your WebRTC applications like this,*** [***contact us at WebRTC.ventures***](https://webrtc.ventures/contact/) ***for a quote!*** [CPaaS](https://blog.webrtc.ventures/tag/cpaas), [Managed Services](https://blog.webrtc.ventures/tag/managed-services), [Events](https://blog.webrtc.ventures/tag/events), [Video Conferencing](https://blog.webrtc.ventures/tag/video-conferencing), [Real Time Weekly](https://blog.webrtc.ventures/tag/real-time-weekly), [WebRTC Architecture](https://blog.webrtc.ventures/tag/webrtc-architecture), [Broadcasting](https://blog.webrtc.ventures/tag/broadcasting), [Medical](https://blog.webrtc.ventures/tag/medical), [WebRTC Live](https://blog.webrtc.ventures/tag/webrtc-live), [Showcase](https://blog.webrtc.ventures/tag/showcase), [Thoughts](https://blog.webrtc.ventures/tag/thoughts), [Vonage](https://blog.webrtc.ventures/tag/vonage), [Daily](https://blog.webrtc.ventures/tag/daily), [Jobs](https://blog.webrtc.ventures/tag/jobs), [Contact Centers](https://blog.webrtc.ventures/tag/contact-centers), [Telehealth](https://blog.webrtc.ventures/tag/telehealth), [Education](https://blog.webrtc.ventures/tag/education), [Technical](https://blog.webrtc.ventures/tag/technical), [General](https://blog.webrtc.ventures/tag/general), [Story of success](https://blog.webrtc.ventures/tag/story-of-success), [The WebRTC.ventures Blog](https://blog.webrtc.ventures/tag/the-webrtc-ventures-blog), [Testing](https://blog.webrtc.ventures/tag/testing), [Gaming](https://blog.webrtc.ventures/tag/gaming), [DevOps](https://blog.webrtc.ventures/tag/devops), [Symbl.ai](https://blog.webrtc.ventures/tag/symbl-ai) ## Related posts [![](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/Building-a-Video-Conferencing-App-Using-Janus.png?height=200&name=Building-a-Video-Conferencing-App-Using-Janus.png)](https://blog.webrtc.ventures/2020/12/janus-webrtc-media-server-video-conference-app) ## [Building a Video Conferencing App Using Janus WebRTC Media Server](https://blog.webrtc.ventures/2020/12/janus-webrtc-media-server-video-conference-app) [Alberto Gonzalez](https://blog.webrtc.ventures/author/alberto-gonzalez) Dec 4, 2020 12:00:00 AM For basic one to one video communications on the web, we could just use WebRTC and connect peers... [Read more](https://blog.webrtc.ventures/2020/12/janus-webrtc-media-server-video-conference-app) [![](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/Copy-of-Automatic-Configuration-for-WebRTC-Part-II.png?height=200&name=Copy-of-Automatic-Configuration-for-WebRTC-Part-II.png)](https://blog.webrtc.ventures/2022/08/automating-configuration-for-webrtc-part-ii-the-code) ## [Automating Configuration for WebRTC (Part II: The Code)](https://blog.webrtc.ventures/2022/08/automating-configuration-for-webrtc-part-ii-the-code) [Hector Zelaya](https://blog.webrtc.ventures/author/hector-zelaya) Aug 11, 2022 12:00:00 AM In part one of this series, we discussed how automation can be helpful to deal with the complexity... [Read more](https://blog.webrtc.ventures/2022/08/automating-configuration-for-webrtc-part-ii-the-code) [![](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/Alberto-Gonzalez-to-speak-at-JanusCon-on-WebRTC-Janus-and-LLMLAMs.png?height=200&name=Alberto-Gonzalez-to-speak-at-JanusCon-on-WebRTC-Janus-and-LLMLAMs.png)](https://blog.webrtc.ventures/2024/03/alberto-gonzalez-to-speak-at-januscon-on-webrtc-janus-and-llm-lams) ## [Alberto Gonzalez to speak at JanusCon on WebRTC, Janus, and LLM/LAMs](https://blog.webrtc.ventures/2024/03/alberto-gonzalez-to-speak-at-januscon-on-webrtc-janus-and-llm-lams) ![Picture of Jen Oppenheimer](https://blog.webrtc.ventures/hs-fs/hubfs/Our-Team-Jen.jpg?width=50&name=Our-Team-Jen.jpg) [Jen Oppenheimer](https://blog.webrtc.ventures/author/jen-oppenheimer) Mar 14, 2024 12:00:00 AM The Janus WebRTC Media Server turns ten this year. Its author, Meetecho, is celebrating with... [Read more](https://blog.webrtc.ventures/2024/03/alberto-gonzalez-to-speak-at-januscon-on-webrtc-janus-and-llm-lams) ### WebRTC.Ventures Services ... - Assess - Build - Integrate - Test - Deploy & Manage ### Contact Us ... **Video should be an opportunity, not a headache.** We’re here to build, integrate, assess and optimize, test, and even deploy and manage your live video application. [Contact us](https://blog.webrtc.ventures/2021/08/hardened-janus-gateway#contact) ### WebRTC Live ... View [past episodes](https://blog.webrtc.ventures/webrtc-live/) of our webinar interview series about the latest webRTC use cases and technical updates. Join our mailing list to learn about upcoming episodes! ![WebRTC Live](https://blog.webrtc.ventures/hs-fs/hubfs/Template%20Images/widged-bannet.webp?height=90&name=widged-bannet.webp) ![logo-main-light](https://blog.webrtc.ventures/hubfs/logo-main-light.svg "logo-main-light") We’re one of the few agencies in the world dedicated to WebRTC development. This dedication and experience is why so many people trust us to help bring live video application dreams to life.   ### Let's get started! ###### **[Contact us today](https://webrtc.ventures/contact/)** **[info@webrtc.ventures](mailto:info@webrtc.ventures)** ### Join our mailing list We don't e-mail often (a few times a month max), and it will be worth it when we do! Of course, we respect your privacy and will not share your contact information. © 2023 WebRTC.ventures, an [AgilityFeat](https://agilityfeat.com/) company / [Privacy Policy](https://webrtc.ventures/privacy-policy//) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Jen Oppenheimer", "url" : "https://blog.webrtc.ventures/author/jen-oppenheimer" }, "dateModified" : "2024-04-03T18:38:42.051Z", "datePublished" : "2021-08-03T04:00:00.000Z", "headline" : "Deploying a Hardened Janus Gateway – WebRTC.ventures", "image" : [ "https://blog.webrtc.ventures/hubfs/Imported_Blog_Media/Deploying-a-Hardened-Janus-Gateway.png" ], "mainEntityOfPage" : { "@id" : "https://blog.webrtc.ventures/2021/08/hardened-janus-gateway", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.webrtc.ventures/hubfs/logo-main-light.svg" } } } ```