about admin account

---

Leventh wrote:

---

---

SMB, HTTP and HTTPS

 

---

What is the purpose of allowing these to run over the internet?

 

I don't recommend allowing either SMB or HTTP over the internet.  HTTPS is encrypted, but you still need a strong passwords if you enable it remotely.  You can require transport encryption for SMB in the NAS, and if for some reason you must use SMB remotely you really need to do that.  But I wouldn't (and don't).  If for some reason you must use HTTP remotely, then you really need to disable access to the admin interface over HTTP.

 

If this remote access is just for you, then I recommend deploying a VPN for remote access.  Many routers (including Netgear Orbi and Nighthawks) include openVPN, and you can install it on Windows, MacOS, Android, and iOS.  That will give you full access to your home network and is much more secure.

 

If you are providing remote access to others, then another option is to use ReadyCloud or purchase OwnCloud from rnxtras.com (OwnCloud has similar features).  ReadyCloud does require you to trust the security of Netgear's cloud servers, and there have been outages/periods of poor performance.  

 

---

Leventh wrote:

---

The "admin" account is the first weak share that hackers are look in the first stage (and ransomware attacks)

maybe I am wrong, now but I thougt, I've forgotten the HTTPS is secured with SSL encryption isn't it?

 

So, can it be secure any important data in ReadyNAS (without SSL certificate) goes to public lan & wan?

Just thinking...

 

 

---

The share and the account are different attack vectors.  If someone hijacks your admin account (by cracking the password), then they have administrative access to your NAS via https.  They can install malware on it, change all the settings using the web interface, etc. 

 

Writing malware or viruses to the admin share can also cause problems, but generally the threat there isn't much different than writing those files to any other share.

 

HTTPS is encrypted, but that is only part of the story.  You still need strong account passwords, and there is still a threat that security vulnerabilities in linux could be used to get into the NAS.