There is an unknown person accessing my server through one of the accounts that I have included in my Plex Home (my girlfriend's account). I live with my girlfriend, so I know that it is not her accessing the server.
It would appear to me that server is not actually blocking the device from accessing the server even though I have set it to do so.
I have changed the password on the account twice, and checked the option to sign out the user, but the user was able to continue accessing the device. I am reasonably confident that the user has not correctly guessed or somehow managed to obtain the password both times that I changed it. I have also set a PIN on the account in the Plex Home, which has not stopped the user.
I have also removed the device from the Account Settings of that user, yet the person continues to be able to access the server. How can it be the case that a device that is not in the "Devices" list can still be accessing media from a server?
Most recently, I used the "Stop Playback" function (is this brand new?) but this obviously isn't a permanent solution.
The client is a Roku 3, but I do not know more than that beyond the IP of the connecting user.
I am not positive as to how this client gained initial access to the server, but it is possible that an account was left logged in while we were on vacation on someone's Roku. However, I have taken precautions and changed passwords on all of her accounts that I know of in the event she's been hacked.
I would prefer not to disable remote access to the server as it is used legitimately by other remote users on a regular basis.
The server is version 1.4.2.3400 running on Ubuntu 16.10. I set the logs to Verbose after stopping the playback of the user.
Any thoughts?