So I'm playing with camera security for the very first time so this is all new to me although I am a quick study.
Being a Linux guy I've been looking at various camera security software designed for Linux and I came across Shinobi which I'm leaning about now although that's probably not all that relevant to my question.
I noticed that when I use the ONVIF detect in Shinobi on my IP3M-941B with the default user admin it picks up the ONVIF details. However, when I create a new user, give it full permissions and the same group as the default admin user it does not pick up the ONVIF details of my IP3M-941B. Obviously I double and triple checked my user name and password settings.
Is this this by design or am I missing something?
Also, if I can't use ONVIF on a different user to the default, and I do want a user just for the security software, it's good security practice to separate out the main admin user from everything else and limit access to only what's necessary for each user, what is the protocol for for the PTZ? Without the ONVIF setting for PTZ it's asking whether the protocol is GET, PUT, POST, whether it requires a stop command, and all the commands for Up, Down etc. none of which I know the answer.
IP3M-941B ONVIF and User Management
Re: IP3M-941B ONVIF and User Management
Welcome to the Forum, I am only going to be able to make a Guess here....
Seeing that it is a 3rd Party Product it could be that as a safe guard it has to be setup with the Admin account. I know that there can be issues with Ip OnVif cameras from all brands when it comes to 3rd party. While your not saying that it can't connect means that it is a compatible OnVif ver. Another thing to note is that at times if your using 3rd party products what works today may not work after the next IP camera FW update or even the 3rd Party product may update and that can at times change the ability to use it.
I know that one of the DVR's that I have has a list of maybe 40 Ip Cameras that is known to work with.. Meaning that if you have one that works only 1/2time or for a min they will be it isn't on the list.... Funny thing is the Parent company cameras are listed not even one of their own lol... My Amcrest camera isn't on that list but I was able to get it to load. However only under ADMIN, a normal user with admin rights won't work and a normal user with normal rights don't work either... So that is where I got my guess it is because it is 3rd party and not their product.
Seeing that it is a 3rd Party Product it could be that as a safe guard it has to be setup with the Admin account. I know that there can be issues with Ip OnVif cameras from all brands when it comes to 3rd party. While your not saying that it can't connect means that it is a compatible OnVif ver. Another thing to note is that at times if your using 3rd party products what works today may not work after the next IP camera FW update or even the 3rd Party product may update and that can at times change the ability to use it.
I know that one of the DVR's that I have has a list of maybe 40 Ip Cameras that is known to work with.. Meaning that if you have one that works only 1/2time or for a min they will be it isn't on the list.... Funny thing is the Parent company cameras are listed not even one of their own lol... My Amcrest camera isn't on that list but I was able to get it to load. However only under ADMIN, a normal user with admin rights won't work and a normal user with normal rights don't work either... So that is where I got my guess it is because it is 3rd party and not their product.
Be Safe.
-
nybbles2bytes
- Posts: 2
- Joined: Fri Jul 12, 2019 12:20 am
Re: IP3M-941B ONVIF and User Management
Hi James and thanks for the reply.
That's not a bad guess but I'm going to have to go with the Amcrest camera treating the admin user differently for a couple of reasons. First, if you are getting a similar result with your DVR and camera then the commonality here is the brand of camera and second I know of no programmer that would make such a limitation, it would be the equivalent of building in a bug and I can't believe your DVR and my software are both built as such.
It could be that the camera runs on a cut down version of LInux, as most devices these days run on LInux, and that the admin user is the Linux root user. It's easy for a programmer to make a mistake and not give a regular user all the permissions of the root user and this happens often enough to be a reasonable possibility.
Anyway, there's not much we can do about it so I'll just work with the knowledge that that's the way it is with Amcrest cameras for now.
That's not a bad guess but I'm going to have to go with the Amcrest camera treating the admin user differently for a couple of reasons. First, if you are getting a similar result with your DVR and camera then the commonality here is the brand of camera and second I know of no programmer that would make such a limitation, it would be the equivalent of building in a bug and I can't believe your DVR and my software are both built as such.
It could be that the camera runs on a cut down version of LInux, as most devices these days run on LInux, and that the admin user is the Linux root user. It's easy for a programmer to make a mistake and not give a regular user all the permissions of the root user and this happens often enough to be a reasonable possibility.
Anyway, there's not much we can do about it so I'll just work with the knowledge that that's the way it is with Amcrest cameras for now.
Re: IP3M-941B ONVIF and User Management
You may be able to use Amcrest Web UI on Linux by using Chrome and the Chrome Amcrest Web View extension. I have seen posts where it worked. User names, authorities, and PTZ should work there.
Also see the Amcrest API for controlling Amcrest cameras.
https://s3.amazonaws.com/amcrest-files/ ... 3.2017.pdf
Also see the Amcrest API for controlling Amcrest cameras.
https://s3.amazonaws.com/amcrest-files/ ... 3.2017.pdf
-
chadbaldwin
- Posts: 14
- Joined: Wed Apr 06, 2016 9:28 am
Re: IP3M-941B ONVIF and User Management
Bumping this up, because I'm experiencing this exact same issue. I thought I was going crazy.
Admin account....ONVIF works fine.
Any other account, even if they are also in the admin group, and have full permissions....ONVIF does not work.
@nybbles2bytes, I ran into this for the same reason as you...trying to separate out users for security. I guess for my use case, I just won't use ONVIF as I only need it for authentication.
Note, I'm experiencing this issue on an IP2M-841B
Admin account....ONVIF works fine.
Any other account, even if they are also in the admin group, and have full permissions....ONVIF does not work.
@nybbles2bytes, I ran into this for the same reason as you...trying to separate out users for security. I guess for my use case, I just won't use ONVIF as I only need it for authentication.
Note, I'm experiencing this issue on an IP2M-841B
Re: IP3M-941B ONVIF and User Management
I've got the same exact issue as @chadbaldwin. Same camera as well (IP2M-841B). It really seems like a firmware bug to me.
Re: IP3M-941B ONVIF and User Management
Yep, getting the same issue. Just upgraded and checked with the latest firmware version too: Amcrest_IPC-Consumer-Web-Mao-Molec_Eng_N_AMCREST_V2.800.00AC001.0.R.210331
Works on the web UI, but can't be access via any app or API that I've managed to get working anyway.
Works on the web UI, but can't be access via any app or API that I've managed to get working anyway.
Re: IP3M-941B ONVIF and User Management
Well Personally I am not sure how or why. I personally don't use anything out side Amcrest for Viewing my Amcrest Cameras..
I did make a Revo2Maxx user on my 841v3 for testing and I can add it to my Amcrest NVR with that user and pass
So I also wanted to test out my 941 however it is on an older FW. Made same user name and password for that camera and I was able to add the user to my NVR without an issue..
So I thought ok lets try my Dahua DVR and I was able to add my 841V3 to it, my 941 is over the Encode of my Dahua recorder so only could try the 841v3 and that worked so far with Dahua type and 37777 as the Port using the Revo2Maxx account... However it does seem that the account will not work under normal ONVIF setting on this and as such I thought ok I like to punish my self so I tried to setup the account on my Hikvision DVR and it will not work using ONVIF so this brings me back to what I said in older Post of 2019 that it must be something that is setup in Dahua and Amcrest to support the user for like hardware using the normal Amcrest Port of 37777 and not the RTSP feed and HTTP ports that would be needed for setting up the Onvif. So I am guessing that it is a Protection that is put in place for Amcrest/Dahua.. Setting up the 841v3 and the 941 on my Hikvision did work under the admin account on both cameras. Admin yes Revo2Maxx no..
I did make a Revo2Maxx user on my 841v3 for testing and I can add it to my Amcrest NVR with that user and pass
So I also wanted to test out my 941 however it is on an older FW. Made same user name and password for that camera and I was able to add the user to my NVR without an issue..
So I thought ok lets try my Dahua DVR and I was able to add my 841V3 to it, my 941 is over the Encode of my Dahua recorder so only could try the 841v3 and that worked so far with Dahua type and 37777 as the Port using the Revo2Maxx account... However it does seem that the account will not work under normal ONVIF setting on this and as such I thought ok I like to punish my self so I tried to setup the account on my Hikvision DVR and it will not work using ONVIF so this brings me back to what I said in older Post of 2019 that it must be something that is setup in Dahua and Amcrest to support the user for like hardware using the normal Amcrest Port of 37777 and not the RTSP feed and HTTP ports that would be needed for setting up the Onvif. So I am guessing that it is a Protection that is put in place for Amcrest/Dahua.. Setting up the 841v3 and the 941 on my Hikvision did work under the admin account on both cameras. Admin yes Revo2Maxx no..
Be Safe.
Re: IP3M-941B ONVIF and User Management
@Revo2Maxx if you have an Android phone, try the app Onvier. It'll work fine when using the admin account, but if you create another account, even with the same permissions as the admin, it will not work with ONVIF. It will say bad username and password (with 0 attempts left). Normally with a bad username and password it'll say 29 attempts left.
The reason I need multiple accounts is to not give full admin ability to everything that interfaces with the cameras. I have a IoT setup at home, and the cameras are a small part of it. I also have multiple types of cameras that connect to MotionEye. I use Onvier to quickly check the cameras on my phone. I'd rather not give out the admin account's details to other people living with me, but do want to give them view and PTZ capabilities (for all the cameras, not just Amcrest).
The reason I need multiple accounts is to not give full admin ability to everything that interfaces with the cameras. I have a IoT setup at home, and the cameras are a small part of it. I also have multiple types of cameras that connect to MotionEye. I use Onvier to quickly check the cameras on my phone. I'd rather not give out the admin account's details to other people living with me, but do want to give them view and PTZ capabilities (for all the cameras, not just Amcrest).
Re: IP3M-941B ONVIF and User Management
Against my better judgement I did download the program and yes as you had said on my Revo2Maxx it wouldn't work and on my admin it would. While I don't know what the program is designed for as it is a 3rd party program and there is nothing stating that the Amcrest cameras will work and or are supported 100% on 3rd party programs.
So giving someone access to the camera and not wanting to give them Admin access I would personally just have them use the Amcrest Family of Apps that was built for the cameras and Amcrest Devices. Making accounts in the camera for users and having the Users access the camera over a Computers WebUI will give them access, They could log in using the Amcrest View Pro on a Cell phone and there are many many options for people to have access to the camera or Amcrest Recorders from software designed and able to run as many user accounts as your Device supports..
So something that kind of bother me about that software is from what I could tell it has more info then I would care to share when using the admin account. Not only info on my Camera but info about my phone, UUID's and Serial numbers and then I give out the password to my camera and now I have to go and change all my passwords for my whole system seeing I don't like using passwords for 3rd party apps. I don't even like using Amcrest own Cloud or Live view website because that is 2 server data bases that I would have to store my cameras and recorders Passwords.. So while I have in the past used them for a limited time I have since removed my accounts and changed all my passwords to may devices..
So I use the Amcrest View Pro app, I do use the Smart home app for the Smart Home devices the systems use P2P with passwords hidden and sure the servers have the Serial Number of the Device stored as it waits for a Ping when I want to access the device, I know that the system never uses my password and there is no local storage of passwords. When that data is entered it is on a Peer to Peer connection between my camera or recorder and my phone the server never sees my password and for me is the most secure connection for access to my cameras and recorders..
So giving someone access to the camera and not wanting to give them Admin access I would personally just have them use the Amcrest Family of Apps that was built for the cameras and Amcrest Devices. Making accounts in the camera for users and having the Users access the camera over a Computers WebUI will give them access, They could log in using the Amcrest View Pro on a Cell phone and there are many many options for people to have access to the camera or Amcrest Recorders from software designed and able to run as many user accounts as your Device supports..
So something that kind of bother me about that software is from what I could tell it has more info then I would care to share when using the admin account. Not only info on my Camera but info about my phone, UUID's and Serial numbers and then I give out the password to my camera and now I have to go and change all my passwords for my whole system seeing I don't like using passwords for 3rd party apps. I don't even like using Amcrest own Cloud or Live view website because that is 2 server data bases that I would have to store my cameras and recorders Passwords.. So while I have in the past used them for a limited time I have since removed my accounts and changed all my passwords to may devices..
So I use the Amcrest View Pro app, I do use the Smart home app for the Smart Home devices the systems use P2P with passwords hidden and sure the servers have the Serial Number of the Device stored as it waits for a Ping when I want to access the device, I know that the system never uses my password and there is no local storage of passwords. When that data is entered it is on a Peer to Peer connection between my camera or recorder and my phone the server never sees my password and for me is the most secure connection for access to my cameras and recorders..
Be Safe.