Streaming MP4s Securely and Preventing Hotlinking

If you’ve ever wanted to stream MP4s securely over the internet while preventing hotlinking and unauthorized sharing of your content, this guide should help you get started. We’ll walk you through installing Ubuntu, setting up Apache with H.264 pseudo-streaming, and finally enabling token authentication with mod_auth_token.

1. Install Ubuntu

For a fresh server setup, use the latest Ubuntu LTS. You can download Ubuntu from the official Ubuntu website. Install Ubuntu as you normally would.

2. Install LAMP Components

We’ll assume you want to keep things quick and simple. First, install MySQL and PHPMyAdmin. If Apache isn’t installed yet, we’ll include that too.

1. Install Apache & MySQL
   sudo apt-get update
sudo apt-get install apache2 mysql-server
2. Secure your MySQL installation (highly recommended)
   sudo mysql_secure_installation
   Follow the prompts to set a root password and improve MySQL security defaults.
3. Install PHP and PHPMyAdmin
   sudo apt-get install php php-mysql libapache2-mod-php phpmyadmin
   When prompted, choose “apache2” as the server for PHPMyAdmin.

By now, you should be able to navigate to http://<your-server-ip>/phpmyadmin and log into PHPMyAdmin.

3. Install the H.264 Streaming Module

The H.264 streaming module (mod_h264_streaming) adds support for HTTP pseudo-streaming, letting you seek within MP4 files without re-downloading the entire file.

1. Install Apache development tools
   sudo apt-get install apache2-dev
   Note: In older Ubuntu versions, the package might be called apache2-threaded-dev. On newer releases, it’s usually just apache2-dev.
2. Download and extract the H.264 streaming module
   cd ~ wget http://h264.code-shop.com/download/apache_mod_h264_streaming-2.2.7.tar.gz
tar -zxvf apache_mod_h264_streaming-2.2.7.tar.gz
cd mod_h264_streaming-2.2.7
3. Compile and install
   ./configure --with-apxs=$(which apxs2)
make sudo make install
4. Enable the module
   Edit your Apache config (e.g., /etc/apache2/apache2.conf or a site-specific config in /etc/apache2/sites-available/) and add:
   LoadModule h264_streaming_module /usr/lib/apache2/modules/mod_h264_streaming.so
AddHandler h264-streaming.extensions .mp4
5. Restart Apache
   sudo service apache2 restart

You should now have HTTP pseudo-streaming for your .mp4 files. Next, let’s secure your content so only authorized links can access those MP4s.

4. Install mod_auth_token

mod_auth_token allows you to generate time-limited URLs, so links can “expire” after a certain period. This is crucial to prevent hotlinking, as anyone trying to share the direct link will soon find it invalid.

1. Download and extract mod_auth_token
   cd ~ wget "http://mod-auth-token.googlecode.com/files/mod_auth_token-1.0.5.tar.gz"
tar -xvzf mod_auth_token-1.0.5.tar.gz cd mod_auth_token-1.0.5/
2. Fix missing files and configure (some Ubuntu setups require these symlinks)
   sudo rm missing
sudo ln -s /usr/share/automake-1.16/missing missing
sudo rm config.guess
sudo ln -s /usr/share/automake-1.16/config.guess config.guess
sudo rm config.sub
sudo ln -s /usr/share/automake-1.16/config.sub config.sub
sudo rm COPYING
sudo ln -s /usr/share/automake-1.16/COPYING COPYING
sudo rm install-sh
sudo ln -s /usr/share/automake-1.16/install-sh install-sh
sudo ./configure
sudo make
sudo make check
   Note: If your version of automake is different (e.g., 1.15, 1.16, etc.), adjust the commands accordingly.
3. Install mod_auth_token
   sudo make install
sudo service apache2 restart

5. Configure Apache

Let’s configure token-based access for your MP4 directory. For example, assume your files will live in /var/www/downloads.

Edit your Apache site config
Open /etc/apache2/sites-available/000-default.conf (or another .conf file you use) and add something like:

# Disable direct directory indexing
<Directory /var/www/downloads>
    AllowOverride None
    Require all granted
</Directory>

ScriptAlias /downloads/ /var/www/downloads/

<Location /downloads/>
    AuthTokenSecret       "mysecretstring"
    AuthTokenPrefix       /downloads/
    AuthTokenTimeout      60
    AuthTokenLimitByIp    off
</Location>

Restart Apache sudo service apache2 restart

At this point, direct requests to /downloads/mymp4file.mp4 will no longer work unless a valid time-limited token is provided.

6. Usage Example in PHP

Below is a quick PHP snippet you can use to generate time-sensitive URLs. This should be placed somewhere in your site’s code (e.g., index.php or a dedicated script) where you control who has access to download or view the video.

<?php
// Settings to generate the URI
$secret         = "mysecretstring";  // Must match AuthTokenSecret in Apache config
$protectedPath  = "/downloads/";     // Must match AuthTokenPrefix
$hexTime        = dechex(time());    // Current Unix time in Hex
$fileName       = "/mymp4file.mp4";  // The file you want to serve

// Generate the token
$token = md5($secret . $fileName . $hexTime);

// Build the full URL
$url = $protectedPath . $token . "/" . $hexTime . $fileName;

// Output or redirect to this URL to serve the MP4
echo $url;
?>

When a user accesses the generated $url, mod_auth_token validates that it’s valid and not expired. After 60 seconds (in our example), the URL becomes invalid, thwarting hotlinkers.

7. Conclusion

That’s it! With H.264 pseudo-streaming and mod_auth_token, you can securely stream MP4 files over the internet while preventing unauthorized sharing of your content.

Remember:

• Keep your secrets truly secret. Don’t hardcode them in public repositories.
• Increase or decrease the AuthTokenTimeout based on your needs.
• For extra security, consider enabling HTTPS and requiring authentication before generating the URL.

If you run into any issues or have suggestions for improvements, drop them in the comments below or reach out on forums. Happy streaming!