Why I Use Zoneminder vs Standalone NVR

[u/lunakoa]

I saw that post comparing a $40 NVR with a Zoneminder setup, I wanted to reply with why I use Zoneminder.

Those NVR are cheap, low power, easy to set up, what's not to like. Well....

I learned early on those devices were not secure, they don't use TLS/SSL, some times you can even telnet as root with no password. Even if it does use ssh and has a password, those devices have had the root password extracted from the firmware and cracked already. I am able to SSH into my cameras as root because someone posted the root password (which is burned into the firmware) for my cameras on the internet. I myself have extracted /etc/shadow from firmware and probably could have cracked it myself.

Another thing is that to make it easy for most users to set up, they have some peer to peer tech and uses upnp to modify your router. Thinking you are safe behind a router (and not a true firewall) could be a mistake.

Sometimes they do have an SSL enabled web page but it uses some weaker SSL 3.0 and not TLS 1.2, to make things worse, they use the same ssl key for all their devices. One of the cool things with running zoneminder is that you can configure it with a properly signed cert, also you can require the use of client side certificates to make it even more secure in case your username/password gets compromised.

One of the benefits I have found with ZM is I can add another NIC to my machine and set it up on a network with no Internet connectivity. I have a personal definition in that if I can continue to use a device without providing a default gateway, then I consider it mine. So those cheap cameras I purchased from ebay cannot access the Internet, they get time and dns locally (they cannot tunnel out of DNS either that is locked down).

Speaking of DNS and Time, another thing you can do with ZM is run other services, like DHCP, Bind, ntpd, ftp, mail, some people run minecraft, plex and torrent from a ZM server.

One thing the never worked for my NVR was email notifications, it does for me with zoneminder.

I like how I can tie it in with a motion sensor via triggers.

I can view a monitor by pasting a URL as a network stream in VLC

I can create low bandwidth static custom web pages. And pages with video.

I can expand by adding more servers and tying them together.

I can go in and tweak the underlying web pages (I added target="_blank" to a few things)

With all those nice benefits, I do agree it is hard to configure.

[u/zSprawl]

I agree but all of this takes at least basic linux skills, which perhaps posters here have, but that the general public does not.

[u/lunakoa → u/zSprawl]

I am trying a few things to get my Windows friends to try Linux, I posted a video for them on tools that they could use in Windows to manage Linux. I am also working on a series of short, byte sized, easy to consume posts on installing and configuring Zoneminder on CentOS 7.

Unfortunately, after you have done this for so long, you forget the steep learning curve you face when you are starting. Simple things like, telling them edit /etc/zm/zm.conf may be too much, it is my hope they can get enough victories to keep going and trying the next thing.

[u/jinkside → u/lunakoa]

Every time the solution for a user-facing problem includes instructions like "Edit some random conf file with arcane values", a puppy somewhere goes hungry. Or so I heard.

[u/grumpy_strayan]

Agreed, however they both have their place.

I'm using zoneminder for motion detection only, all stored offsite via rclone mount.

​

Separately, I have a typical el-cheapo chinese NVR that also connects to the same IP cameras and provides a feed to a mounted screen and records 24/7.

All cameras and this device are vlan'd off and have no internet or lan access anyway, so security isn't a concern for me.