# Securing incoming RTSP streams

**URL:** <https://community.wowza.com/t/securing-incoming-rtsp-streams/41543>\
**Category:** Wowza Streaming Engine\
**Created:** [June 30, 2014, 8:46pm UTC](https://community.wowza.com/t/securing-incoming-rtsp-streams/41543 "2014-06-30T20:46:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Majid\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Majid\_Khan](https://community.wowza.com/u/Majid_Khan)\
**Post date:** [June 30, 2014, 8:46pm UTC](https://community.wowza.com/t/securing-incoming-rtsp-streams/41543/1 "2014-06-30T20:46:33Z")

</div>

I am using wowza media server to pull RTSP live streams from axis video encoders. I provide username and password as part of stream path in .stream file. This information is exchanged in **plain text** which makes it insecure. Is there anything i can do to secure the atleast the stream path? The full path is rtsp://username:password@ip/axis-media/media.amp

---

<div class="post-metadata">

**Author:** ![sal\_jefferson](https://avatars.discourse-cdn.com/v4/letter/s/6de8d8/32.png) [@sal\_jefferson](https://community.wowza.com/u/sal_jefferson)\
**Post date:** [June 30, 2014, 2:42pm UTC](https://community.wowza.com/t/securing-incoming-rtsp-streams/41543/2 "2014-06-30T14:42:42Z")

</div>

Hello there,

If you have set the /RTP /Authentication /PublishMethod to “digest” in your Application.xml file, then it is not sent as plain text.

I hope this is helpful.

Salvadore

---

<div class="post-metadata">

**Author:** ![Richard\_Lanham](https://avatars.discourse-cdn.com/v4/letter/r/c68b51/32.png) [@Richard\_Lanham](https://community.wowza.com/u/Richard_Lanham)\
**Post date:** [July 2, 2014, 5:00pm UTC](https://community.wowza.com/t/securing-incoming-rtsp-streams/41543/3 "2014-07-02T17:00:52Z")

</div>

Does it work if you use AuthenticationMethod “basic” ?

Is the camera on a public IP? We might have to take a closer look. Re-start Wowza, start the stream and test playback in Wowza RTMP test player. Then zip up /conf and current access log showing re-start, stream start, and playback tests to support@wowza.com. Include a link to this thread for reference.

Richard

---

<div class="post-metadata">

**Author:** ![Majid\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Majid\_Khan](https://community.wowza.com/u/Majid_Khan)\
**Post date:** [July 1, 2014, 11:34pm UTC](https://community.wowza.com/t/securing-incoming-rtsp-streams/41543/4 "2014-07-01T23:34:49Z")

</div>

I have set RTP / Authentication / PublishMethod and PlayMethod to digest in Application.xml file. I restarted the wowza service. This time i also removed username and password from the axis rtsp url in the .stream file. The new stream file looks like : rtsp://ip/axis-media/media.amp

When i try to publish the stream, it doesn’t connect to the RTSP stream source. I am using rtp-live application type.

---

<div class="post-metadata">

**Author:** ![Majid\_Khan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Majid\_Khan](https://community.wowza.com/u/Majid_Khan)\
**Post date:** [July 2, 2014, 5:51pm UTC](https://community.wowza.com/t/securing-incoming-rtsp-streams/41543/5 "2014-07-02T17:51:21Z")

</div>

Running wireshark shows the url exchanged is rtsp://ip/axis-media/media.amp and shows rtsp DESCRIBE and TEARDOWN events.

Wowza logs show server comments for the request RTSP path mentioned above. It then issues a warning for Authentication requirement i.e. Username password not available. The session is finally close after RTSP/RTP re-streaming timeout.