I've ‘inherited’ (it's now my responsibility to take care of it) a WD My Cloud EX2 with a public IP and since it's exposed to the internet, I want to make sure that the data and other machines on the local network are secure.
I've read that certain services are inherently vulnerable because the traffic isn't encrypted and the authentication methods (signing algorithms?) are weak. Unfortunately, I know fairly little about networking, let alone networking security, so please bear with me.
When I run Nmap on the public IP of the NAS from outside the local network, I get the following list of open ports:
21/tcp open ftp 80/tcp open http 139/tcp open netbios-ssn 443/tcp open https 445/tcp open microsoft-ds 548/tcp open afp 3306/tcp open mysql 3689/tcp open rendezvous 4443/tcp open pharos 8080/tcp open http-proxy 8181/tcp open intermapper
Sure enough, I can connect from OS X via afp, smb, ftp, and who knows what's Windows using when I boot up a W10 virtual machine and choose to map a network drive as
\\ip_address\share (netbios-ssn and microsoft-ds are basically smb, right? this legacy MS stuff is completely beyond me) and I see it just as if it were on a local network.
To me, this doesn't seem safe because I don't know how the authentication and encryption works (unlike ssh, for example) and thus I don't have confidence in this implementation.
I believe some of these services should be behind a firewall because they provide a lot of information about the local network and could possibly be used for an attack. However, the question then is how do I ensure the same functionality, i.e. that any user will be able to map a share as a network drive over the internet and work with files as if they were on a local drive.
Again, I believe I should use a VPN to have clients securely connect to the local network and then access the NAS, or possibly at least isolate the NAS from the rest of the local network (DMZ?).
What are the risks of having a NAS with these ports exposed to the internet and what steps should I take to mitigate these risks?
Thank you in advance.