Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

41–50 of 311 posts

Re: My NAS exposes itself over the internet without permission

#41

Post by philo23 »

tyingq wrote: post #29
diarrhea wrote: post #17

The JSON config is strange, the keys contain type information. But any JSON parser worth its salt should not require that since JSON is natively typed, no?

Where? I don't see that. What type info is below? Do you mean "mapList"? I suspect it's just what they chose to name the key. "triestimes": 3, "mapList": [ { "desc": "ftp", "nExternalPort": 6221, "nInternalPort": 21, "sProtocol": "TCP", "bEnable": 0 },...

I suspect they mean the letter prefixes: _n_ExternalPort + _n_InternalPort for number, _s_Protocol for string and _b_Enable for boolean.

It's probably just a convention they use in the source code that's made its way into the JSON by serializing something? Either that or old habits die hard.

Re: My NAS exposes itself over the internet without permission

#43

Post by takeda »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

Re: My NAS exposes itself over the internet without permission

#44

Post by kn100 »

bunnyfoofoo wrote: post #7
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Edited: deleted my comment as I was unintentionally offensive.

To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep playing those with it disabled. Sysadminning at home is only fun for a short while, I do this stuff at work, I'd rather keep my home setup as simple as I can help it.

As usual, various solutions are available, I described one here. Disabling uPnP is an option for some, and I encourage those who want to go that route to go that route.

Re: My NAS exposes itself over the internet without permission

#45

Post by the8472 »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Opening ports for a specific machine with dynamic IPv6 addresses can be difficult though.

If the suffix stays stable then with iptables you can use netmasks where you mask out the prefix rather than the suffix.

If both prefix and suffix are dynamic you need a solution that takes dhcp or host names into account. Not all router firmwares support something like that.

Another alternative is to use UPnP or PCP with authentication.

Re: My NAS exposes itself over the internet without permission

#46

Post by hluska »

kn100 wrote: post #44
bunnyfoofoo wrote: post #7

Earlier quoted context omitted.

Edited: deleted my comment as I was unintentionally offensive.

To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…

I agree with bunnyfoofoo’s conclusion - maybe not the tone but certainly the conclusion. It’s tough to trust an article that makes security claims while ignoring so many self imposed security holes.

Re: My NAS exposes itself over the internet without permission

#47

Post by sdflhasjd »

Tepix wrote: post #39
sdflhasjd wrote: post #33

Earlier quoted context omitted.

UPNP is pretty important for a lot of online games.

Which ones? I have it turned off and haven't had any issues with games.

Games that use Peer-to-peer lobbies instead of dedicated servers, more popular with multiplayer co-op games.

Typically, it can be possible to join another lobby, but impossible to host (insofar as other people can't connect to it)

Re: My NAS exposes itself over the internet without permission

#48

Post by tyingq »

philo23 wrote: post #41
tyingq wrote: post #29

Earlier quoted context omitted.

Where? I don't see that. What type info is below? Do you mean "mapList"? I suspect it's just what they chose to name the key. "triestimes": 3, "mapList": [ { "desc": "ftp", "nExternalPort": 6221, "nInternalPort": 21, "sProtocol": "TCP", "bEnable": 0 },...

I suspect they mean the letter prefixes: _n_ExternalPort + _n_InternalPort for number, _s_Protocol for string and _b_Enable for boolean. It's probably just a convention they use in the source code that's made its way into the JSON by serializing something? Either that or old habits die hard.

Oh, ok, that makes sense. I assumed that was from some cargo culted code on how to name members of a struct.

Re: My NAS exposes itself over the internet without permission

#49

Post by hluska »

nobody9999 wrote: post #40
my123 wrote: post #32

Earlier quoted context omitted.

Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...

>Without UPnP, you specifically have to configure your NAT for this... While I realize that configuring nftables/iptables is beyond most folks, there are many firewalls out there that have a GUI/webui which makes this dead simple. Not sure why this should be an issue in 2021, except for users' trained-in helplessness.

Ugh, users trained in helplessness. I just had an utterly annoying conversation with my cell phone provider whose reps have been trained in helplessness and thus fail to follow really simple security procedures.

This phrase is a thing of nightmares now. Stay tuned for a really scary Haunted House full of users trained in helplessness...coming Halloween 2021.

Re: My NAS exposes itself over the internet without permission

#50

Post by edoceo »

kn100 wrote: post #44
bunnyfoofoo wrote: post #7

Earlier quoted context omitted.

Edited: deleted my comment as I was unintentionally offensive.

To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…

It's not offensive. But you were offended.

Big difference.

Post reply on HN