My NAS exposes itself over the internet without permission • Hacker News Board

Re: My NAS exposes itself over the internet without permission

#141

Post by kaylynb » Sat, Apr 03, 2021, 7:20 PM UTC

ancarda wrote: post #15

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Do you have a router you recommend? Ideally something running free software

OPN/pfSense have been mentioned.

Don't waste time with WiFi on the gateway itself as most WiFI chips you can buy are crippled in firmware for regulatory reasons. Just use a dedicated commercial AP hooked up directly or VLANed.

Once you get comfortable with something like pfSense I highly recommend switching to regular Free/OpenBSD, or Linux depending on what you're comfortable with. I find it much easier to manage a gateway with the entire configuration in version control than a GUI. There aren't that many services that a gateway needs to run.

If you feel like you'll miss pf on the *BSDs check out nftables on Linux. It's not as well documented but it's much less painful than iptables.

To loop this into the UPnP discussion: when you build your own gateway from scratch you have to add a UPnP daemon and configure it yourself, instead of forgetting to disable it and exposing poorly configured IOT stuff.

Re: My NAS exposes itself over the internet without permission

#142

Post by geocrasher » Sat, Apr 03, 2021, 7:21 PM UTC

The article focuses on the security issues surrounding his new NAS, and that's fine. But the problem isn't security. It's Trust.

Consumers generally trust that manufacturers will follow Best Practices and that security is part of the deal: I pay you money, you give me a quality product that Just Works and is Secure.

False.

Products are made to be sold at a profit. You can imagine that some engineer at that company knows about this problem, put in a Jira bug for it and since it didn't affect overall functionality, and because the product needed to be released as soon as possible, they rejected the bug and sent it off.

By default, we should NOT trust that things are Good and Secure. If we are security conscious, then it's on us as consumers to figure out how to mitigate these problems. Or is it?

If I was this guy, I'd box that thing up and send it back and give the company feedback as to why, and then I'd show them this very blog post.

The manufacturer probably won't care. They know that until the average consumer cares about security and knows how to mitigate problems it won't matter. And we all know that the average consumer, even of technical products, has security habits.

Now if you'll excuse me, I need to go take care of some security stuff on my boxes, this really got me thinking about it!

  sudo passwd root
  greatnewpassword11
  greatnewpassword11

Re: My NAS exposes itself over the internet without permission

#143

Post by DarkmSparks » Sat, Apr 03, 2021, 7:24 PM UTC

takeda wrote: post #43

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that.

IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.

Re: My NAS exposes itself over the internet without permission

#144

Post by starky » Sat, Apr 03, 2021, 7:29 PM UTC

Interesting, I have the 4 bay version of this NAS (F4-210) and I don't see anything along the lines of what the author is showing.

Re: My NAS exposes itself over the internet without permission

#145

Post by alias_neo » Sat, Apr 03, 2021, 7:30 PM UTC

kn100 wrote: post #116

bunnyfoofoo wrote: post #75

Earlier quoted context omitted.

I'm sorry, I didn't mean to come off as offensive. I agree that it would be bothersome to convert from uPnP to non-uPnP, but you really only need to set it up once. Then any new devices you add to your network don't require individual workarounds.

It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in…

Try it and see what happens.

I build secure communications solutions for a living, so I'm speaking from experience.

Any solution worth its salt doesn't want or need UPnP on your network, it doesn't need anything other than for you to let it hit the internet and for the traffic to come back the other way.

I also run and have run other solutions in my day to day working from home and private life, many SIP flavours, Teams, Zoom (once, because it was the only option), Jitsi, BBB, Google Duo, Hangouts, Houseparty they all work with no effort from me.

There is a lot of hypothetical about what will and won't work, but take it or leave it when I say that some of us, the people building these solutions, have a bit of a clue about networking and how to build solutions around security best-practice.

I also game online with PC, Nintendo Switch and PlayStation 4/5, not one has given me issues, nor have I needed any custom firewall rules for the consoles.

My wife works from home on a government issues laptop, she's never complained of issues with video conferencing or her work VPN.

There may be some exceptions, sure, but it's less of an issue than people think.

Re: My NAS exposes itself over the internet without permission

#146

Post by mercora » Sat, Apr 03, 2021, 7:32 PM UTC

lostlogin wrote: post #65

KozmoNau7 wrote: post #18

Earlier quoted context omitted.

The issue is letting untrusted or badly behaved devices on the network. UPnP works great, if you control which devices get on your network . Static port forwarding combined with DHCP gets annoying quickly, you end up having to set up static assignments for every device that may need a port forwarded, which can be a lot, with modern multiplayer gaming and p2p. And for applications that select a random port on startup,…

> And for applications that select a random port on startup, such as some bittorrent clients, you either have to manually forward the port every time or select a static port. What if you run them over a VPN? I don’t use torrents much but have a client containerised with OpenVPN. I’m not a networking expert but I had assumed (with all the dangers that comes with) that this moved the problem to the VPN provider?

it will work as long as you are the one initiating the connection. if some peer suspects you have a wanted piece available i.e. from another peer in the swarm it can not communicate the intent to get that piece from you to your client directly. i think BitTorrent can relay messages through intermediate peers to make your client establish the connection to that other peer (reversing the initiator). Otherwise peers will exchange other peers that are visible to them so that your client might eventually learn how the other peer that wanted that piece is reachable and connects to it. So it actually will work without port forwarding but reaching your client will be harder and thus less peers inside the swarm will be available to you or them, likely making it slower.

Re: My NAS exposes itself over the internet without permission

#147

Post by yesco » Sat, Apr 03, 2021, 7:36 PM UTC

DarkmSparks wrote: post #143

takeda wrote: post #43

Earlier quoted context omitted.

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that. IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.

> IPv6 is overly complex

I'm being a bit pedantic about this since you're right that in practice, setting up stuff for IPv6 is in-fact complex since support for it is all over the place.

But I want to stress that IPv6 as a protocol is much simpler, more intuitive and much more versatile than IPv4. I'd even go so far as to say that it's actually fantastically suited for local networks, especially so in complicated setups with multiple subnets (in an alternate reality where everything supports it).

It's really, truly, a genuine shame that it never gained the momentum it could have.

Re: My NAS exposes itself over the internet without permission

#148

Post by cbsks » Sat, Apr 03, 2021, 7:37 PM UTC

bscphil wrote: post #135

rubatuga wrote: post #72

Earlier quoted context omitted.

Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.

Aren't these two points slightly contradictory? > the author depends on NAT as a security feature, when it was never designed to be one > UPnP is a convenience feature, and is disabled in all security focused networks. uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your netwo…

> I suppose some routers might automatically add a firewall exception when doing uPnP hole punching

Every consumer router I’ve ever had will open up a port in the firewall when uPnP is enabled and a request is received. Is that not standard?

Re: My NAS exposes itself over the internet without permission

#149

Post by the8472 » Sat, Apr 03, 2021, 7:43 PM UTC

mnd999 wrote: post #95

the8472 wrote: post #45

Earlier quoted context omitted.

Opening ports for a specific machine with dynamic IPv6 addresses can be difficult though. If the suffix stays stable then with iptables you can use netmasks where you mask out the prefix rather than the suffix. If both prefix and suffix are dynamic you need a solution that takes dhcp or host names into account. Not all router firmwares support something like that. Another alternative is to use UPnP or PCP with authen…

Suffix should always be static with SLAAC because it’s your MAC address. Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. If you’re using DHCPv6 then the DHCP server should take care of DNS as it would for v4.

> Suffix should always be static with SLAAC because it’s your MAC address.

Except for devices that randomize mac addresses. Normally even those that do that only try do so when connecting to a new network but that's not always reliable.

> Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one.

I'm doubtful that all applications make that distinction and advertise the right address. If they just use some external "what is my IP" service to determine their address because that's what they did for IPv4 then they'll get the privacy address and advertise that to peers because that'll be picked by default for outgoing connections.

Being able to allow incoming connections to a port for any address belonging to a particular machine would be less error-prone.

Re: My NAS exposes itself over the internet without permission

#150

Post by lanstin » Sat, Apr 03, 2021, 7:46 PM UTC

zippergz wrote: post #134

kn100 wrote: post #116

Earlier quoted context omitted.

It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in…

FWIW I have never had upnp enabled and I don't recall any cases where it's caused a problem for me. Certainly my wife and I are on videoconferences all day and they work fine. I am completely with you that I can't have network configurations that make the network unusable, confusing, or inconvenient for my family, but are you sure that upnp falls into that category? I'm sure you have different applications than I do,…

This article pissed me off so I went to check on uPNP and I had disabled it when moving into this home. Never had any problem where uPNP was the solution, we have gamers, video calls, VPNs, BitTorrent, etc etc. all work fine. We even have a printer that works. I think it is calling home to Google or HP or whatever.