BigBlueButton is a multi-service stack (web, media, recording, TURN, API). Hardening should focus on exposed ports, API secret protection, and update discipline.
| Attribute | Details |
|---|---|
| License | LGPL-3.0 |
| Security Policy | GitHub Security Policy |
| Documentation | docs.bigbluebutton.org |
| Port | Protocol | Service | Exposure |
|---|---|---|---|
| 80 | TCP | HTTP redirect | Public |
| 443 | TCP | HTTPS web | Public |
| 1935 | TCP | RTMP (recording) | Internal only |
| 3478 | UDP/TCP | TURN/STUN | Public |
| 7443 | TCP | SIP TLS | Internal only |
| 8888 | TCP | Media proxy | Internal only |
| 9123 | TCP | FreeSWITCH | Internal only |
| 10000 | TCP/UDP | Media (WebRTC) | Public |
# Enable UFW firewall
sudo ufw enable
# Allow required ports
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 3478/udp
sudo ufw allow 3478/tcp
sudo ufw allow 10000/udp
sudo ufw allow 10000/tcp
# Deny internal-only ports from external access
sudo ufw deny 1935/tcp
sudo ufw deny 7443/tcp
sudo ufw deny 8888/tcp
sudo ufw deny 9123/tcp
# Check status
sudo ufw status verbose
# Display current API secret
sudo bbb-conf --secret
# The secret is stored in:
# /usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties
# Secure API secret file
sudo chmod 640 /usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties
sudo chown root:bigbluebutton /usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties
# Check recording directory permissions
ls -la /var/bigbluebutton/recording/
# Set restrictive permissions
sudo chmod 750 /var/bigbluebutton/recording
sudo chown -R bigbluebutton:bigbluebutton /var/bigbluebutton/recording
# Backup recordings and configuration
sudo tar -czf bbb-backup-$(date +%Y%m%d).tar.gz \
/var/bigbluebutton/recording \
/etc/bigbluebutton \
/usr/share/bbb-web/WEB-INF/classes/bigbluebutton.properties
# Check current version
sudo bbb-conf --version
# Update packages
sudo apt update
sudo apt upgrade bigbluebutton-*
# Verify after update
sudo bbb-conf --check
sudo bbb-conf --restart
Re-test these workflows after patching:
# Check firewall status
sudo ufw status numbered
# Verify open ports
sudo ss -tulpn | grep -E ':80|:443|:1935|:3478|:7443|:8888|:9123|:10000'
# Check for exposed API secrets
sudo grep -R "securitySalt" /usr/share/bbb-web/WEB-INF/classes/ /etc/bigbluebutton 2>/dev/null
# Review recent authentication failures
sudo journalctl -u bbb-web --since "24 hours ago" | grep -i 'auth\|fail\|error'
# Check service health
sudo bbb-conf --status
sudo bbb-conf --check
| Resource | URL |
|---|---|
| BigBlueButton Documentation | docs.bigbluebutton.org |
| Firewall Configuration | docs.bigbluebutton.org/administration/firewall-configuration |
| Security Policy | GitHub Security Policy |
| Security Advisories | GitHub Advisories |
Any questions?
Feel free to contact us. Find all contact information on our contact page.