Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Buffalo LinkStation Pro Duo that we use can be pretty easily hacked into. The good thing about this is that this NAS runs Linux and can therby be improved in features, e.g. running an NFS or LDAP service as well. The bad thing is, anyone with access to the LAN can become root on the device - I tested that (using a program called ACP Commander which basically allowed me to run one shell command as root at a time to inject my public SSH key into /root/.ssh/allowed_keys). It also seems to be possible to flash the NAS to use a modified firmware, although I did not verify this. How can I secure the LinkStation to no longer provide these exploits? Maintaining the capability to update the firmware if necessary, preferably without loosing my root access, would be nice...

share|improve this question

2 Answers 2

A few days ago I did some changes at the linkstation that we use in our companies network. The ACP Commander uses root as user and the default password of the firmeware to login. By changing the root password the ACP Commander isn't able to login already. Another way to do this would be to disable password authentication generally. In that case you should take good care of your key.

The system running on your Linkstation is BusyBox (custom linux kernel). In order to prevent users from obtaining root rights you need to set up a so called jailed shell (users with limited rights). For a detailed howto just search it. The following link should give you an idea how it's done and what it is:

http://www.jmcresearch.com/projects/jail/howto.html

By the way you don't have to flash you firmeware to obtain root access. The ACP Commander also provides you the needed features to "unlock" the firmeware of the manufacturer.

share|improve this answer
1  
I'm not sure that this answers "how to harden the Buffalo Linkstation Pro?". Could you edit the answer to more explicitly answer the question? –  Mark C. Wallace Nov 20 '12 at 10:55

Maybe I'm missing something here but this seems pretty simple to me: use the standard ACL list to limit access to /root/.ssh/allowed_keys so that only root has access then put a strong password on your root account and block/remove all services like telnet which allow you to administrate the machine without SSH.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.