"> Secure Archives - Engr Kabir Saleh

Posts Tagged

Secure

What’s the Most Secure Way to Handle OS Upgrades?

Your computer’s operating system may or may not be designed with security in mind, but without ongoing software updates, your computer is vulnerable. How do operating systems handle sending out these updates and which approaches are the most secure?

Why Do We Need Software Updates?

There are three key reasons software updates are important.

  • New Features: OS developers provide new features all the time. We want them. Gone are the days when you buy a new box to get the new code. Now you get the goods via software updates.
  • Security Patches: It’s impossible to know all of the vulnerabilities in a program before releasing it into the wild. Updates containing security patches bolster the defenses of the code running on our devices. You can mitigate much of your risk by running the latest versions of software.
  • Ongoing Support: These days we declare a device alive or dead not based on whether it still works, but rather if it still receives updates. A device that no longer receives updates is one that will gradually lose access to newer apps, successfully loads fewer websites, and becomes increasingly vulnerable to exploitation.

There are two ways to distribute these updates. One approach is a centralized model, where a single company manages all of the updates that go to your device, regardless of which brand or model you use.

In a decentralized model, the components that go into your OS come from many sources. There is a degree of separation between the developers and those who package all those various parts together for users.

Both approaches have their pros and cons. Proprietary desktop OSes such as Microsoft Windows, Apple macOS, and Google Chrome OS all take a centralized approach. GNU/Linux has a decentralized model.

How Microsoft Windows Distributes OS Updates

Windows 10 on a Dell convertible laptop
Image Credit: Microsoft

Microsoft distributes OS updates to anyone with a Windows PC. These updates go out based on what version of Windows you run.

For most of Windows’ history, switching to a new version of the OS was expensive. This encouraged many people to continue using older versions. With Windows 10, the situation is different. Microsoft provided Windows 10 for free initially and has said that rather than release another major upgrade, the company will now focus on iterating the desktop through software updates.

Microsoft has traditionally supported popular versions of Windows well after the release of one or two successive releases. Windows 7, for example, still received updates half a decade after the release of Windows 10.

Windows Update automatically downloads updates


How to Manage Windows Update in Windows 10




How to Manage Windows Update in Windows 10

For control freaks, Windows Update is a nightmare. It works in the background, and keeps your system safe and running smoothly. We show you how it works and what you can customize.
Read More

and forces users to install them. This can be frustrating, but it keeps computers up to date. Just make sure you create regular backups. While unlikely, system updates can botch your installation of Windows (or any other OS for that matter).

Security Assessment

Microsoft is transparent about how long Windows releases will receive support. This helps users make informed decisions about their hardware purchases. Forced updates also keep users patched and up-to-date, protecting more of us from exploits.

Still, a large number of Windows users aren’t using Windows 10. Some are using versions that are severely out of date, making the Windows landscape as a whole a vulnerable and easy target.

How Apple macOS Distributes OS Updates

macOS on an Apple MacBook

Apple provides OS updates directly to users via a dedicated Software Update tool. Unlike Windows, macOS does not automatically update your OS, but you can turn that feature on. Manual updates give you time to backup your data before getting new software.

Apple doesn’t explicitly state how long it will support each version of macOS. Generally, the three most recent releases will receive security patches. With new versions arriving every year


macOS Catalina Update: 6 Key Steps to Preparing Your Mac




macOS Catalina Update: 6 Key Steps to Preparing Your Mac

Before you install the latest macOS update and move to Catalina, here’s what you should do to ensure a successful upgrade.
Read More

, that means you can expect roughly three years of support.

Unfortunately, the end of life for older releases can arrive at any time without any heads up or official announcement. Apple’s security updates page shows what updates have arrived but not how long they will keep coming.

This doesn’t tell the whole story. Generally speaking, there’s little reason not to upgrade to the latest version of macOS. Changes tend to be more iterative compared to the revolutionary changes that took place between Windows 7 to 8 and Windows 8 to 10. Upgrades were relatively cheap in the past, and now they’re free.

Since macOS is only available on Apple hardware, the company can explicitly list which devices it will support. Unfortunately, if your MacBook or iMac is not on the list, you’re out of luck. You must now replace macOS with Windows or Linux to have an OS with ongoing updates, even if your hardware is technically perfectly capable of running the latest version of macOS.

Security Assessment

Manual updates give you time to back up your data, but many people choose to never install updates, leaving them more vulnerable to exploits. Apple also doesn’t tell us when a given OS release will reach the end of its support period.

On the flip side, Apple generally supports a given computer model for many years. Just make sure you consistently upgrade to the latest OS. You can check out Apple’s list of obsolete products.

How Google Chrome OS Distributes OS Updates

Google Chrome OS on a Samsung convertible laptop

On a Chromebook, updates are quiet and automatic. It doesn’t matter which device you buy, if your model is supported, you will receive each update in a matter of days. Google manages most of the software experience, so Chrome OS feels the same regardless of which Chromebook you buy.

Google provides updates on a regular schedule. Maybe OS updates come roughly every six weeks, with security patches and software updates arriving twice as frequently. You have the option to turn off automatic updates if you prefer.

But Google is not transparent about how long each Chromebook or Chromebox will receive support. The company doesn’t actually base support times on operating system version (like Microsoft) or specific devices (like Apple). Instead, Chrome OS support depends on which chipset sits inside your machine. Google promises to support each chipset for six and a half years after launch.

That poses a problem. Most of us do not know what hardware lies underneath our keyboards. We can easily buy a Chromebook using a chipset that’s been around for five years already, without knowing we will only receive one and a half years of support.

Thanks to Chrome OS’s design, the danger of going without software updates is magnified. Since Chrome OS combines the web browser with the rest of the OS, when OS updates stop, your web browser will no longer receive updates. This is not the case on other platforms, where you can update apps separately.

Security Assessment:

Chrome OS strikes a nice balance between keeping users up to date with automatic updates while giving us the freedom to upgrade at our own pace by doing things manually. But the company’s support period is largely obscure and, given Chrome OS’s design, substantially more important.

How GNU/Linux Desktops Distribute OS Updates

Purism Librem 13 privacy laptop
Image Credit: Purism

We usually refer to GNU/Linux simply as Linux, but in this case it’s important to clarify things. Google’s Chrome OS is based on Linux, but how it operates is fundamentally different from other versions of Linux based on GNU software.

There are hundreds of different GNU-based desktops you can download. Most give you a degree of freedom on how you approach software updates. Generally, notifications will arrive automatically, but you must manually download and install the update. You can do so using a simple app or the command line.

How often you receive updates depends on the size of your chosen Linux distribution. You can use a given version of Linux until your machine no longer meets the minimal system requirements, which for a growing number of Linux desktops means a 64-bit processor.


Why Linux Distros Are Ending 32-Bit Versions (And What That Means for You)




Why Linux Distros Are Ending 32-Bit Versions (And What That Means for You)

More and more Linux distros are discontinuing their 32-bit versions. Why are they doing this? And how does it affect you? Here’s all you need to know.
Read More

If you use a more niche version of Linux, you have a greater risk of losing access to updates due to the project ceasing to exist. Under such circumstances, you’re free to switch to another version of Linux and keep on trucking.

Security Assessment

GNU desktops have the longest support life. Your desktop will continue to work for as long as your hardware meets system requirements. And if your preferred Linux distribution does end support, you can just switch to another.

Updates are not automatic, but there are other aspects of the way free software gets distributed that have a larger impact on whether the various parts of your OS are truly up-to-date. Since software is not produced in a central location, new updates and patches may be available for months or years before the people who make your version of Linux get around to packaging and releasing them.

Which Method Is the Most Secure?

In this case, the means is less important than the ends. If you manually update your PC every day or two and keep software up-to-date, then your machine is effectively as secure as one that receives automatic updates.

Making updates automatic primarily prevents machines from going months and years without updates, becoming susceptible to long-fixed vulnerabilities that make not only those machines but, due to botnets


What Is a Botnet and Is Your Computer Part of One?




What Is a Botnet and Is Your Computer Part of One?

Botnets are a major source of malware, ransomware, spam, and more. But what is a botnet? How do they come into existence? Who controls them? And how can we stop them?
Read More

, the rest of us less safe.



Source link

1Password is changing the way enterprises secure their data

Data breaches are a nightmare for any company. The expenses for mitigation and the loss of trust from customers and clients can be devastating, even putting some companies out of business. That’s why it’s so important to put security at the very core of your enterprise; it shouldn’t be an afterthought. 

That’s where 1Password Business can help: it’s easy to implement, cost-effective, and can provide a measurable impact on security just days after roll out. 1Password Advanced Protection provides extensive monitoring tools, giving you — and not the malicious actors threatening your business —  control of your security.

The biggest security threat to companies is human error. Employees hold valuable data in their hands, and sometimes it goes astray. Whether it’s a mistake or negligence, people can’t be perfect all the time. 1Password can fill in those gaps and immediately make your company more secure.

The real key to security is having control over your sensitive information, and that’s where Advanced Protection is crucial. This new suite of security features allows administrators to examine or block logins from specific locations, IP addresses, and more. You also can set rules for Master Passwords and force two-factor authentication for all team members.

1Password Business allows you to securely share passwords across teams and departments; every member of your organization has access to the information they need when they need it. But just as crucially, 1Password Business makes it easy to ensure that only the people who need access have it, so you aren’t unnecessarily sharing sensitive information across your company.

Watchtower, included with 1Password, also plays a vital role in keeping businesses safe: it keeps track of data breaches and alerts you to compromised passwords. If one of your passwords is breached, or a site where you hold an account is hacked, Watchtower will let you know that it’s time to change your password. It also alerts you to reused passwords, insecure passwords, and weak passwords, so you know where your team’s password problems are and can easily take corrective action.

If you’re looking to increase your company’s security, join the 50,000 businesses that already use 1Password to protect their sensitive information. Learn more about what 1Password Business can do for your enterprise and request a custom quote for your company.

This story, “1Password is changing the way enterprises secure their data” was originally published by

CIO.

Copyright © 2019 IDG Communications, Inc.



Source link

Are Teslas Secure? How Hackers Can Attack Connected Cars

It seems like everything is connected to the internet these days, from kettles to doorbells. Even cars are increasingly manufactured with some degree of internet connectivity. But no cars are quite as internet-connected as Teslas.

In general, Teslas are very secure vehicles. However, whenever any kind of device is connected to the internet, even a car, it will introduce some security vulnerabilities. To show you the different ways in which security issues can affect connected cars, we’ll share some examples of how people have tried and sometimes succeeded at hacking Teslas.

Vulnerabilities in Tesla Key Fobs

tesla-model-s

Of all the ways that criminals use technology to hack or steal cars


5 Ways Criminals Use Technology to Hack and Steal Cars




5 Ways Criminals Use Technology to Hack and Steal Cars

One million cars are stolen every year in the US. Here are some of the common tactics you need to be aware of to stay safe and secure.
Read More

, one security aspect you might not consider is a key fob. Teslas have a keyless entry system. This uses a small device attached to a key ring which you carry on your person. When you approach your Tesla, it detects the key fob and unlocks the doors for you.

Cloning Attacks on Tesla Key Fobs

There have been security issues with Tesla key fobs. In 2018, researchers from the Belgium university KU Leuven announced they were able to copy a Tesla key fob.

They could wirelessly read signals from a nearby key fob, then clone a copy of it. That meant it was possible for hackers to stand near to Tesla owners and copy their keys without them knowing, then steal the car. Tesla swiftly fixed the issue with a new type of key fob which removed the vulnerability.

However, one year later in 2019, the same researchers discovered another security flaw in the new fobs. This time, the hacker had to be closer to the fob than previously and the attack took a little longer. But it could still be performed wirelessly without the target knowing.

Although Tesla had introduced more encryption in the new fobs, this was not enough to prevent the hack. The good news is that Tesla was able to patch this issue with a software update soon after news of the new hack broke.

Repeater Attacks on Tesla Key Fobs

It’s worth noting that as far as we’re aware, no one has ever used the cloning vulnerability to actually steal a Tesla. However, hackers can also perform other attacks on key fobs, such as a repeater attack.

Here, a hacker picks up the presence of a key fob from inside a Tesla owner’s house when their car is parked outside and amplifies it. This is the method that thieves likely used in a much-circulated video (above) purporting to show two people stealing a Tesla in the UK.

Hacking Tesla’s Autopilot Feature

One of the most scary ideas people have when they think about the security of internet-connected cars


How Secure Are Internet-Connected, Self Driving Cars?




How Secure Are Internet-Connected, Self Driving Cars?

Are self driving cars safe? Could Internet-connected automobiles be used to cause accidents, or even assassinate dissenters? Google hopes not, but a recent experiment shows there is still a long way to go.
Read More

is what happens if a hacker takes control of a vehicle. Tesla’s Autopilot feature allows the car to perform some self-driving maneuvers such as cruising or changing lanes on the highway.

But in 2019, a group of Chinese hackers were able to manipulate the Autopilot feature. In a nightmare scenario for drivers, the hackers were able to take control and direct the car into oncoming traffic.

To perform the hack, the team used small, brightly colored stickers attached to the road surface. This created a “false lane” which the Tesla’s systems read as a real driving lane and followed. This all took place on a test track, but theoretically the same system could be used in the real world to direct a car into the oncoming traffic lane.

The trick here is that this hack requires changes to the outside environment around the car. It doesn’t actually target the car itself. Plus, drivers should still be attentive when using Autopilot and be ready to take control of the vehicle from the automated systems.

That means it’s not very likely to be a problem in most scenarios. Tesla thought so too, putting out a statement saying that the vulnerability was “not a realistic concern.”

Hacking a Tesla’s Entertainment System

Are Teslas Secure? How Hackers Can Attack Connected Cars tesla touchscreen

A less serious hack on Teslas was demonstrated by Team Fluoroacetate at the security event Pwn2Own in 2019. The team were able to use a bug in the car’s web browser to access the car’s firmware and run their own code. They were then able to show a message on the Tesla entertainment system.

This hack isn’t going to help anyone steal your car or cause a crash. However, it does show how any seemingly small part of a car’s software can be a security risk, even the web browser. Tesla says it is working on a software fix for this security issue.

Protecting Your Data When You Sell Your Tesla

Finally, there’s a security issue with Teslas which is not due to a vulnerability as such.

Instead, it’s due to the collection of data that you might not even think about. If you own a Tesla and later decide to sell it, you should be aware of the amount of data about you contained within the car. Just like when you sell an old PC, you should be sure to wipe the hard disk drive before passing it on to the buyer.

When you sell a connected car, you need to get rid of private data before handing it over to someone else.

In 2019 two security researchers purchased a wrecked Tesla Model 3. They were able to access the car’s computer and download all sorts of information about the previous owners. In the computer they found phonebooks with contacts’ numbers and email addresses, plus calendar entries. They were also able to see recent locations entered into the car’s navigation system. There was even video footage recorded by the vehicle’s cameras.

There is a way to delete personal information from a Tesla by performing a factory reset. This should be a reminder to Tesla owners that if their car is ever wrecked or sold, they should perform a factory reset before getting rid of the car. This will prevent anyone from accessing their data.

Connected Cars Come With Security Risks

Overall, cars today are safer than ever before. Teslas have security features which make crashes less likely and protect the people inside if they do occur. But it’s worth thinking about the ways that new technologies can create security risks.

To learn more about the risks of connected cars, see our article on terrifying scenarios that self-driving cars make possible


7 Terrifying Scenarios Self-Driving Cars Make Possible




7 Terrifying Scenarios Self-Driving Cars Make Possible

Some of the risks inherent with self-driving cars range from physically dangerous to morally questionable. Here are seven potential dangers lurking in a self-driving future.
Read More

.



Source link

The Best Ways to Secure Your SSH Server

A stylized SSH prompt in a terminal window on a laptop.
Eny Setiyowati/Shutterstock.com

Secure your Linux system’s SSH connection to protect your system and data. System administrators and home users alike need to harden and secure internet-facing computers, but SSH can be complicated. Here are ten easy quick-wins to help protect your SSH server.

SSH Security Basics

SSH stands for Secure Shell. The name “SSH” is used interchangeably to mean either the SSH protocol itself or the software tools that allow system administrators and users to make secure connections to remote computers using that protocol.

The SSH protocol is an encrypted protocol designed to give a secure connection over an insecure network, such as the internet. SSH in Linux is built on a portable version of the OpenSSH project. It is implemented in a classic client-server model, with an SSH server accepting connections from SSH clients. The client is used to connect to the server and to display the session to the remote user. The server accepts the connection and executes the session.

In its default configuration, an SSH server will listen for incoming connections on Transmission Control Protocol (TCP) port 22. Because this is a standardized, well-known port, it is a target for threat actors and malicious bots.

Threat actors launch bots that scan a range of IP addresses looking for open ports. The ports are then probed to see if there are vulnerabilities that can be exploited. Thinking, “I’m safe, there are bigger and better targets than me for the bad guys to aim at,” is false reasoning. The bots aren’t selecting targets based on any merit; they’re methodically looking for systems they can breach.

You nominate yourself as a victim if you haven’t secured your system.

Security Friction

Security friction is the irritation—of whatever degree—that users and others will experience when you implement security measures. We’ve got long memories and can remember introducing new users to a computer system, and hearing them ask in a horrified voice whether they really had to enter a password every time they logged in to the mainframe. That—to them—was security friction.

(Incidentally, the invention of the password is credited to Fernando J. Corbató, another figure in the pantheon of computer scientists whose combined work contributed to the circumstances that led to the birth of Unix.)

Introducing security measures usually involves some form of friction for someone. Business owners have to pay for it. The computer users may have to change their familiar practices, or remember another set of authentication details, or add extra steps to connect successfully. The system administrators will have additional work to do to implement and maintain the new security measures.

Hardening and locking down a Linux or Unix-like operating system can get very involved, very quickly. What we’re presenting here is a set of easy to implement steps that will improve the security of your computer without the need for third-party applications and without digging through your firewall.

These steps aren’t the final word in SSH security, but they’ll move you a long way forward from the default settings, and without too much friction.

Use SSH Protocol Version 2

In 2006, the SSH protocol was updated from version 1 to version 2. It was a significant upgrade. There were so many changes and improvements, especially around encryption and security, that version 2 is not backward compatible with version 1. To prevent connections from version 1 clients, you can stipulate that your computer will only accept connections from version 2 clients.

To do so, edit the /etc/ssh/sshd_config file. We’ll be doing this a lot throughout this article. Whenever you need to edit this file, this is the command to use:

sudo gedit /etc/ssh/sshd_config

sudo gedit /etc/ssh/sshd_config in a terminal window

Add the line:

Protocol 2

sshd_config in gedit with the edits highlighted

And save the file. We’re going to restart the SSH daemon process. Again, we’ll be doing this a lot throughout this article. This is the command to use in each case:

sudo systemctl restart sshd

sudo gedit /etc/ssh/sshd_config in a terminal window

Let’s check that our new setting is in force. We’ll hop over to a different machine and try to SSH onto our test machine. And we’ll use the -1 (protocol 1) option to force the ssh command to use protocol version 1.

ssh -1 [email protected]

ssh -1 dave@howtogeek.local in a terminal window

Great, our connection request is rejected. Let’s ensure we can still connect with protocol 2. We’ll use the -2 (protocol 2) option to prove the fact.

ssh -2 [email protected]

ssh -2 dave'howtogeek.local in a terminal window

The fact that the SSH server is requesting our password is a positive indication that the connection has been made and you are interacting with the server. Actually, because modern SSH clients will default to using protocol 2, we don’t need to specify protocol 2 as long as our client is up to date.

ssh [email protected]

ssh dave@howtogeek.local in a terminal window

And our connection is accepted. So it is only the weaker and less secure protocol 1 connections that are being rejected.

Avoid Port 22

Port 22 is the standard port for SSH connections. If you use a different port, it adds a little bit of security through obscurity to your system. Security through obscurity is never considered a true security measure, and I have railed against it in other articles. In fact, some of the smarter attack bots probe all open ports and determine which service they are carrying, rather than relying on a simple look-up list of ports and assuming they provide the usual services. But using a non-standard port can help with lowering the noise and bad traffic on port 22.

To configure a non-standard port, edit your SSH configuration file:

sudo gedit /etc/ssh/sshd_config

SSH config file in gedit with edits highlighted

Remove the hash # from the start of the “Port” line and replace the “22” with the port number of your choice.  Save your configuration file and restart the SSH daemon:

sudo systemctl restart sshd

Let’s see what effect that has had. Over on our other computer, we’ll use the ssh command to connect to our server. The ssh command defaults to using port 22:

ssh [email protected]

ssh dave@howtogeek.local in a terminal window

Our connection is refused. Let’s try again and specify port 470, using the -p (port) option:

ssh -p 479 [email protected]

ssh -p  479 dave@howtogeek.local in a terminal window

Our connection is accepted.

Filter Connections Using TCP Wrappers

TCP Wrappers is an easy to understand access control list. It allows you to exclude and permit connections based on characteristics of the connection request, such as IP address or hostname. TCP wrappers should be used in conjunction with, and not instead of, a properly configured firewall.  In our specific scenario, we can tighten things up considerably by using TCP wrappers.

TCP wrappers was already installed on the Ubuntu 18.04 LTS machine used to research this article. It had to be installed on Manjaro 18.10 and Fedora 30.

To install on Fedora, use this command:

sudo yum install tcp_wrappers

sudo yum install tcp_wrappers in a terminal window

To install on Manjaro, use this command:

sudo pacman -Syu tcp-wrappers

sudo pacman -Syu tcp-wrappers in a terminal window

There are two files involved. One holds the allowed list, and the other holds the denied list. Edit the deny list using:

sudo gedit /etc/hosts.deny

sudo gedit /etc/hosts.deny in a terminal window

This will open the gedit editor with the deny file loaded in it.

hosts.deny file loaded into gedit

You need to add the line:

ALL : ALL

And save the file. That blocks all access that hasn’t been authorized. We now need to authorize the connections you wish to accept. To do that, you need to edit the allow file:

sudo gedit /etc/hosts.allow

sudo gedit /etc/hosts.allow in a terminal window

This will open the gedit editor with the allow file loaded in it.

hosts.allow file loaded in gedit with edits highlightsd

We’ve added in the SSH daemon name, SSHD,  and the IP address of the computer we’re going to allow to make a connection. Save the file, and let’s see if the restrictions and permissions are in force.

First, we’ll try to connect from a computer that isn’t in the hosts.allow file:

SSH connection refused by TCP wrappers

The connection is refused.  We’ll now try to connect from the machine at IP address 192.168.4.23:

SSH connection permitted by TCP wrappers

Our connection is accepted.

Our example here is a bit brutal—only a single computer can connect. TCP wrappers is quite versatile and more flexible than this. It supports hostnames, wildcards, and subnet masks to accept connections from ranges of IP addresses. You are encouraged to check out the man page.

Reject Connection Requests With No Passwords

Although it is a bad practice, a Linux system administrator can create a user account with no password. That means remote connection requests from that account will have no password to check against. Those connections will be accepted but unauthenticated.

The default settings for SSH accept connection requests without passwords.  We can change that very easily, and ensure all connections are authenticated.

We need to edit your SSH configuration file:

sudo gedit /etc/ssh/sshd_config

SSH config file loaded in gedit with the edits highlgihted

Scroll through the file until you see the line that reads with “#PermitEmptyPasswords no.” Remove the hash # from the start of the line and save the file. Restart the SSH daemon:

sudo systemctl restart sshd

Use SSH Keys Instead of Passwords

SSH keys provide a secure means of logging into an SSH server. Passwords can be guessed, cracked, or brute-forced. SSH keys are not open to such types of attack.

When you generate SSH keys, you create a pair of keys. One is the public key, and the other is the private key. The public key is installed on the servers you wish to connect to. The private key, as the name would suggest, is kept secure on your own computer.

SSH keys allow you to make connections without a password that are—counterintuitively—more secure than connections that use password authentication.

When you make a connection request, the remote computer uses its copy of your public key to create an encrypted message that is sent back to your computer. Because it was encrypted with your public key, your computer can unencrypt it with your private key.

Your computer then extracts some information from the message, notably the session ID, encrypts that, and sends it back to the server. If the server can decrypt it with its copy of your public key, and if the information inside the message matches what the server sent to you, your connection is confirmed to be coming from you.

Here, a connection is being made to the server at 192.168.4.11, by a user with SSH keys. Note that they are not prompted for a password.

ssh [email protected]

SSH request being authenticated by SSH key in a terminal window

SSH keys merit an article all to themselves. Handily, we have one for you. Here’s how to create and install SSH keys.

RELATED: How to Create and Install SSH Keys From the Linux Shell

Disable Password Authentication Altogether

Of course, the logical extension of using SSH keys is that if all remote users are forced to adopt them, you can turn off password authentication completely.

We need to edit your SSH configuration file:

sudo gedit /etc/ssh/sshd_config

gedit editor with the ssh config file loaded, and edits highlighted

Scroll through the file until you see the line that starts with “#PasswordAuthentication yes.” Remove the hash # from the start of the line, change the “yes” to “no”, and save the file. Restart the SSH daemon:

sudo systemctl restart sshd

Disable X11 Forwarding

X11 forwarding allows remote users to run graphical applications from your server over an SSH session. In the hands of a threat actor or malicious user, a GUI interface can make their malign purposes easier.

A standard mantra in cybersecurity is if you don’t have a bonafide reason to have it turned on, turn it off.  We’ll do so by editing your SSH configuration file:

sudo gedit /etc/ssh/sshd_config

gedit editor with the ssh config file loaded, and edits highlighted

Scroll through the file until you see the line that starts with “#X11Forwarding no.” Remove the hash # from the start of the line and save the file. Restart the SSH daemon:

sudo systemctl restart sshd

Set an Idle Timeout Value

If there is an established SSH connection to your computer, and there has been no activity on it for a period of time, it could pose a security risk. There is a chance that the user has left their desk and is busy elsewhere. Anyone else who passes by their desk can sit down and start using their computer and, via SSH, your computer.

It’s much safer to establish a timeout limit. The SSH connection will be dropped if the inactive period matches the time limit. Once more, we’ll edit your SSH configuration file:

sudo gedit /etc/ssh/sshd_config

gedit editor with the SSH config file loaded and edits highlighted

Scroll through the file until you see the line that starts with “#ClientAliveInterval 0” Remove the hash # from the start of the line, change the digit 0 to your desired value. We’ve used 300 seconds, which is 5 minutes. Save the file, and restart the SSH daemon:

sudo systemctl restart sshd

Set a Limit For Password Attempts

Defining a limit on the number of authentication attempts can help thwart password guessing and brute-force attacks. After the designated number of authentication requests, the user will be disconnected from the SSH server. By default, there is no limit. But that is quickly remedied.

Again, we need edit your SSH configuration file:

sudo gedit /etc/ssh/sshd_config

gedit editor with the ssh config file loaded, and edits highlighted

Scroll through the file until you see the line that starts with “#MaxAuthTries 0”. Remove the hash # from the start of the line, change the digit 0 to your desired value. We’ve used 3 here. Save the file when you made your changes and restart the SSH daemon:

sudo systemctl restart sshd

We can test this by attempting to connect and deliberately entering an incorrect password.

User being disconnected after two bad authentication attampts in a terminal window

Note that MaxAuthTries number seemed to be one more than the number of tries the user was permitted. After two bad attempts, our test user is disconnected. This was with MaxAuthTries set to three.

Disable Root Log Ins

It is bad practice to log in as root on your Linux computer. You should log in as a normal user and use sudo to perform actions that require root privileges. Even more so, you shouldn’t allow root to log into your SSH server. Only regular users should be allowed to connect. If they need to perform an administrative task, they should use sudo too. If you’re forced to allow a root user to log in, you can at least force them to use SSH keys.

For the final time, we’re going to have to edit your SSH configuration file:

sudo gedit /etc/ssh/sshd_config

gedit editor with the ssh config file loaded, and edits highlighted

Scroll through the file until you see the line that starts with “#PermitRootLogin prohibit-password” Remove the hash # from the start of the line.

  • If you want to prevent root from logging in at all, replace “prohibit-password” with “no”.
  • If you are going to allow root to log in but force them to use SSH keys, leave “prohibit-password” in place.

Save your changes and restart the SSH daemon:

sudo systemctl restart sshd

The Ultimate Step

Of course, if you don’t need SSH running on your computer at all, make sure it is disabled.

sudo systemctl stop sshd
sudo systemctl disable sshd

If you don’t open the window, no one can climb in.





Source link

Lockly Secure Pro Brings a Fingerprint Reader to Your Smart Lock – Review Geek

Rating:
7.5/10
?

  • 1 – Absolute Hot Garbage
  • 2 – Sorta Lukewarm Garbage
  • 3 – Strongly Flawed Design
  • 4 – Some Pros, Lots Of Cons
  • 5 – Acceptably Imperfect
  • 6 – Good Enough to Buy On Sale
  • 7 – Great, But Not Best-In-Class
  • 8 – Fantastic, with Some Footnotes
  • 9 – Shut Up And Take My Money
  • 10 – Absolute Design Nirvana

Price: $299

A Lockly Secure Pro with keypad activated.
Josh Hendrickson

Between PIN, fingerprint reader, voice commands, an app, and a physical key, the Lockly Secure Pro smart lock has no shortage of ways to unlock your door. And while more options usually mean more convenience, it also means more complications.

Here’s What We Like

  • Fingerprint scanner is faster than a pin
  • App has all the customizations
  • Google Assistant Voice unlock commands!

And What We Don’t

  • Fingerprint scanner doesn’t always work
  • Jumbled keypad is a little frustrating to use
  • Wi-Fi versus Bluetooth connection app differences is annoying

Lockly’s Secure Pro is unlike other smart locks I’ve tried. It doesn’t have a standard keypad. Instead, it features a touch screen that randomly generates numbered circles for you to push.

It also features a fingerprint reader on the side so you can skip the PIN entirely, which is a faster way to unlock your door. For added convenience, the touchscreen serves as a lock button, just touch it anywhere and the door locks. With so many features, this should be one of the most convenient smart locks on the market. But it’s not quite there.

Installing is Fairly Easy for a Smart Lock

When I opened the Lockly box, I felt a little intimidated despite having installed many locks and multiple smart locks. The box includes a giant instruction booklet, complete with guides for measuring your door’s holes and cavities. The good news is, the book is a little bit overkill, I was able to install the lock without much trouble.

Typically the most challenging part of installing a smart lock is balancing the keypad and battery pack on either side of the door before you get them fully secured. The sheer weight of the two pieces will fight you and want to fall out of the door, leaving you trying to clamp them while driving screws awkwardly.

Lockly addressed that issue with two options. They added extra screw holes to the top of the two components so you can secure them directly to the door, which should add stability. I didn’t like that idea, so I went with option two: 3M sticky tape, which worked surprisingly well. Thanks to the tape, I installed the lock in 15 minutes, and without any feelings of frustration.

A Simplisafe, Wyze, and Lockly contact sensors lined up vertically on a door.
In order from top to bottom are Simplisafe, Wyze, and Lockly contact sensors. Lockly’s sensor is huge. Josh Hendrickson

After installing the lock, you plug in the included Wi-Fi hub and connect the largest contact sensor I’ve ever seen to your door. The sensor helps the lock track your door’s open and close state for automated locking.

The battery compartment hardware isn’t very inspiring. It’s plastic, which gives the lock a less premium feel. And the thumb turn is incredibly small, which is only emphasized by the giant plastic box it’s attached to. Every time I turn it to lock or unlock the door, I feel like I’m going to snap it off. To be clear, I highly doubt I could snap it off, but it feels like I could.

The outside hardware, on the other hand, screams smart gadget and feels a little more premium with its large black touchscreen that displays the keypad.

The Keypad is Unique and Mildly Frustrating

A closeup of the Lockly Secure Pro lock, showing four circles full of numbers.
You touch the circle that contains the next number of your PIN, not a number itself. Josh Hendrickson

One of the most unusual aspects of this smart lock is the keypad. Instead of a standard 1-9 keypad for typing codes, you get a random set of numbers on the touchscreen every time it activates. The lock groups the numbers in circles, and you touch those circles (not the number) to enter your code. The next time you use the keypad, the lock will jumble the numbers in the circles.

That means no one can peek from nearby to learn your code. Even if someone were standing directly next to you, they wouldn’t learn your PIN since your touching circles full of numbers. In theory, this works well to prevent PIN theft. In practice, it feels like overkill, especially on my relatively quiet street. I don’t have to worry about anyone trying to spy on my keypad. But I could see the potential usefulness if you installed this lock on an apartment or condo door (whether or not you’d be allowed is another matter). That’s a scenario where someone might have a legitimate reason to be standing close enough to see your type in a PIN.

It’s not very much benefit for me, and using the keypad is a pain. Every time I type my PIN, I have to spend a few moments figuring out where my numbers are now. Did you slip up and hit a wrong circle? Well, they’ll jumble again. It’s mildly annoying. That Lockly requires a six-digit key only adds to that time spent, though admittedly, a six-digit key is more secure than the standard four-digit PIN most smart locks allow.

My family is less patient than I am. When I told them I was writing this review and would soon take the lock off the door, they cheered. They’d rather have a standard keypad that’s simple to use.

A side shot of the Lockly lock, showing a round finger print reader.
When it works, this fingerprint reader is the best part of the lock. Josh Hendrickson

The fingerprint reader, on the other hand, bypasses all that frustration—usually. I try to use this every time instead of the keypad. When it works, it’s great. I put my finger on, and within a second, the door unlocks. That’s faster than a standard PIN on other smart locks.

But you’ll notice the words “when it works.” About 85 percent of the time, the fingerprint reader unlocks the door nearly instantly. But the rest of the time, it doesn’t accept my fingerprint. Sometimes I’ll get lucky if I try again. But usually, the second attempt fails, too, and I have to use the keypad. On those occasions, I’m left frustrated because now I’ve spent a lot of time trying to unlock my door.

In a lot of ways, that’s the story of Lockly Secure Pro: when it works, it’s great. But the clever add-ons lead to moments of frustrations.

When it’s time to lock the door as you’re leaving, just touch the keypad anywhere, and the door will lock. That’s handy for when you’re in a hurry to leave, and you don’t have to spend time searching for a lock button in the dark. But it also meant I occasionally “locked the door” with the door open while I was walking into the house because my hand or arm brushed the screen. So I had to stop, unlock the door, then close it.

Once again, when it works, I like it; when it doesn’t, I’m frustrated. By default, the door locks itself shortly after you unlock it. The door sensor should let the lock know when you close the door, but sometimes that didn’t work correctly, and the lock engaged while the door was open. Thankfully, you can turn that and other features off in the app.

A Competent App Held Up By Two Wireless Standards

The Lockly app, showing locking screen, code access creation, and settings.
You can change nearly any setting you want, as long as you connect to Bluetooth first.

You can’t ask for more controls and options in a smart lock app. The Lockly app (available for iOS and Android) lets you change just about any setting you want. You don’t like that touching the keypad locks the door? You can turn that off. Do you find all the beeps the locks makes when using the app annoying? You can turn that off. Want the keypad to jumble the numbers after every circle push? You can make it do that if you really want to. The only thing you can’t turn off that I would have liked is the keypad scramble feature. You’re stuck with that for better or worse.

You even get the usual smart lock features: remote lock and unlock, ability to generate PINs, and in this case, the ability to create fingerprint scans.

Another thing I like is code generation: You can choose between trusted users, guests, and one-time access PINs. Trusted users keep their codes until you revoke them. You can set guest users to expire automatically and to work just during the times you allow. And one-time access PINs expire immediately after the first use. Lockly lets you generate codes that only by downloading the app, or “offline codes” that are just standard six-digit PINs you tell or text to the person. It’s a lot choice, and the app does good of letting which options does exactly what.

Altogether it’s a well put together app, barring one exception: you can either connect to the lock via Bluetooth or Wi-Fi. Wi-Fi is great for remote access when you’re away from your door. But for some reason, Wi-Fi can’t do everything that Bluetooth can. If the app notifies you of a firmware update, for instance, you’ll need to switch back to Bluetooth to install it. The Bluetooth connection has a very short range, though, so I often need to use the Wi-Fi connection. I never know which connection I need to be in to make changes, and that’s frustrating.

I’d be remiss if I didn’t mention Alexa and Google Assistant integrations. When it comes to Alexa, you get what you’d expect out of it. You can lock by voice and unlock by voice with a PIN. By default, unlocking by voice is off.

Google Assistant integration, on the other hand, is something special. Google doesn’t provide much in the way of APIs for locks, and usually, the best you can do is check on the status of the lock and maybe lock the door by voice. It’s up to the company to implement anything more.

And Lockly went above and beyond here; the company added an unlock by voice feature, using a PIN. It’s fast, reliable, and works well. And that makes it the only lock I’ve tested yet with unlocking capabilities for Google Assistant. That’s a massive win if you’re in a Google Home.

The Lockly Secure Pro is Mostly Good

The inside components to the Lockly smart lock, with a quarter just over the thumb turn, showing a relatively similar size.
This thumb turn is just so small. Josh Hendrickson

Overall the Lockly Secure Pro isn’t a perfect lock. I’m not in love with the plastic hardware or the jumbling PN scheme. But I do love the fingerprint scanner—when it works. It falls short of being a great lock for me, in part because I don’t benefit from some of its most unique features.

But if you do worry about someone watching you type in a PIN, you might like this lock a lot. It does a great job of obfuscating your passcode even as you type it. If you think a Wi-Fi lock is another avenue of access for the bad guys, you can leave the Wi-Fi hub unplugged. And if you don’t like any of the default settings, there’s a decent chance you can change its behavior in the app.

Just keep in mind, you’re paying a premium for those extra security features. At $300, this smart lock costs $50 or more than other great smart lock options like the Schlage Encode, the Kwikset Kevo, or the Yale Assure lock. And the Schlage Encode includes a built-in Wi-Fi hub, which is one more reason it’s nearly perfect.

If a customizable smart lock with PIN protection and fingerprint reader sounds like your idea of a smart lock, then you should undoubtedly consider the Lockly Secure Pro. That goes double if you want the most voice control possible with Google Assistant. But if you want something with more simplicity, you should look elsewhere. You might even save money in the process.

Rating: 7.5/10

Price: $299

Here’s What We Like

  • Fingerprint scanner is faster than a pin
  • App has all the customizations
  • Google Assistant Voice unlock commands!

And What We Don’t

  • Fingerprint scanner doesn’t always work
  • Jumbled keypad is a little frustrating to use
  • Wi-Fi versus Bluetooth connection app differences is annoying





Source link

SurfShark VPN Makes Torrenting Easy and Secure, Now 76% Off

With a good torrent client and fast internet, you can enjoy TV shows, movies, music, and more. The only problem is, the world of torrenting can be a little shady. If you want to stay protected, get SurfShark VPN. This impressive service gives you access to over 500 torrent-friendly servers. In addition, your connection is protected by military-grade encryption. You can pick up a two-year subscription now for $69 at MakeUseOf Deals.

Safe Torrenting

Although torrenting is often associated with piracy, there is loads of legit content that is distributed this way. No matter what kind of content you want to access, SafeShark VPN has you covered.

Available for Windows, Chrome, Firefox, Android, and iOS, this service offers complete online protection. By running your traffic through masking servers, the VPN helps you stay anonymous. These servers are spread around the world, meaning you can find a fast local connection or go abroad to bypass restrictions.

In addition, SurfShark keeps no logs and protects your privacy with AES-256-GCM encryption. SurfShark’s CleanWeb feature blocks ads and malware, and the built-in kill switch ensures your IP address won’t leak if your Wi-Fi drops.

As a subscriber, you get unlimited bandwidth and connection speeds on unlimited devices. SurfShark also provides 24/7 customer support.

Two Years for $69

Order now for $69 to enjoy two years of secure torrenting with SurfShark VPN, worth $290.



Source link

Secure Your Online World With a Lifetime Subscription to VPN Unlimited

You can learn a lot by looking through someone’s browsing history —  their tastes, their interests, their budget, and even where they live. Advertisers and social media sites are harvesting this information all the time. If you would prefer to maintain some privacy, try KeepSolid VPN Unlimited. This highly-rated service keeps your data secure, without cramping your style. Right now, lifetime VPN subscriptions are just $39 at MakeUseOf Deals.

Online Privacy

Since the invention of social media, online privacy has become almost impossible. When even your own ISP can sell your data, you know things are bad. Thankfully, it’s pretty straightforward to protect yourself.

With KeepSolid VPN Unlimited, you can take back control in under five minutes. Available to download on all major desktop and mobile platforms, the service uses masking servers to disguise your identity. This makes it virtually impossible for anyone to track you across the web.

But that’s not all. VPN Unlimited applies encryption to all your traffic, making public Wi-Fi much safer. You can also choose from servers in 70 locations around the world, meaning you can bypass local restrictions.

Lifetime subscriptions include unlimited bandwidth and uncapped speeds on up to five devices, with 24/7 customer support available.

Lifetime Protection for $39

Order now for $39 to get your lifetime VPN Unlimited subscription, worth $499.99.



Source link

Can you be mobile AND secure?

Most companies today allow their workforce to employ mobile devices to access corporate back office systems (e.g., email, sale force automation, ERP, HR, data collection, form filling, collaboration, etc.). And while these devices can be convenient, it’s important that organizations know how to maximize the security of these corporately connected devices – both devices furnished by the company and through Bring Your Own Device (BYOD).

In fact, many companies I speak with say that they believe (or are unaware of) any mobile data breaches within their organization. Research we’ve done at J.Gold Associates shows that IT believes about 65 percent of mobile devices have never had a breach or are unaware of one happening (e.g., lost, stolen, attacked by malware), while greater than 50 percent of end users admit to having a breach on their device, although not all exposed corporate data, and most never got reported to IT.

Despite the security challenges mobile devices create, there is no going back. Users demand corporate access from their smartphones (and in some cases tablets), and companies benefit from this access with increased efficiency, better use of time and improved user experience. Indeed, millennials and other digital natives often require a “mobile first”, or even “mobile only” approach when accessing enterprise back office application.

But companies should not be blind to the fact that mobile devices, especially newer devices with massive amounts of onboard storage capability, can present a security threat. 

What should companies do?

It’s no longer possible for companies to turn a blind eye and hope for the best ….. 

Most companies today allow their workforce to employ mobile devices to access corporate back office systems (e.g., email, sale force automation, ERP, HR, data collection, form filling, collaboration, etc.). And while these devices can be convenient, it’s important that organizations know how to maximize the security of these corporately connected devices – both devices furnished by the company and through Bring Your Own Device (BYOD).

In fact, many companies I speak with say that they believe (or are unaware of) any mobile data breaches within their organization. Research we’ve done at J.Gold Associates shows that IT believes about 65 percent of mobile devices have never had a breach or are unaware of one happening (e.g., lost, stolen, attacked by malware), while greater than 50 percent of end users admit to having a breach on their device, although not all exposed corporate data, and most never got reported to IT.

Despite the security challenges mobile devices create, there is no going back. Users demand corporate access from their smartphones (and in some cases tablets), and companies benefit from this access with increased efficiency, better use of time and improved user experience. Indeed, millennials and other digital natives often require a “mobile first”, or even “mobile only” approach when accessing enterprise back office application.

But companies should not be blind to the fact that mobile devices, especially newer devices with massive amounts of onboard storage capability, can present a security threat. This is true in virtually all industries, but is especially problematic in regulated industries. Many companies I speak to have no idea what kind of data or how much data users have loaded onto their personal mobile devices.  Enterprises must have a strategy in place to deal with mobile security and not just hope for the best.

What should companies do?

It’s no longer possible for companies to turn a blind eye and hope for the best. Companies must have a sound mobile security strategy, but this strategy should be an extension of existing corporate security strategy, and not stand alone specifically for mobile devices. This is the only way to rationalize security across all users and devices in the organization.

Companies should place responsibility for mobile security into the same group where the rest of corporate security resides, even though there will be some special skills required specifically to handle mobile. Nevertheless, its imperative that a unified security strategy take hold, especially since there is a such a preponderance or work being done on mobile devices today, and I expect it to continue to grow (indeed, in some companies, as much as 50 percent or more of corporate interactions are now being done through mobile devices).

While there are several enterprise-class third-party security products targeted at mobile devices (e.g., Lookout, Zimperium, Cylance), deploying such services in a vacuum offers less protection that doing so strategically. And deploying mobile security must first and foremost be built on top of a robust mobile management capability.

Many traditional mobile management vendors have now moved to a Unified Endpoint Management (UEM) approach to allow for a combined mobile and PC management approach (e.g., BlackBerry, Citrix, IBM, MobileIron, Vmware), but even if your organization only deploys the more basic Enterprise Mobile Management (EMM) suite of products, it is imperative that this device management capability be closely coupled to any add-on specialized security products. In fact, I estimate the effectiveness of third-party security apps without a robust EMM/UEM suite to monitor and manage them reduces their capabilities by 50-65 percent.

Companies like BlackBerry that has a robust mobile management platform, has seen the writing on the wall and recently acquired Cylance to add a mobile (and other devices) security component which they are in process of integrating into their suite. IBM MaaS360 is coupling its EMM platform with its suite of software services and tools like Watson.

Others (e.g., VMware, Citrix, Microsoft) have partnered with others to create a synergistic unified management and security capability. I expect to see more security acquisitions going forward as UEM and mobile security become even more closely intertwined, and the UEM vendors see this as a strategic need to stay competitive as more mobile management capability make their way into enterprise apps suites.

Are there platform differences between Android and iOS?

Yes. Android and iOS are uniquely distinct when it comes to device security, although despite some claims to the contrary, both platforms have had malware attacks. The biggest challenge is in keeping older devices secure. In the Android-supported environment, there can be as many as 3-5 generations of older Android version in service, primarily on older devices that have never been upgraded, or cannot be. In fairness to Apple, this is less of an issue as most Apple devices several generations old get the OS upgraded once it is release.

Apple makes sure to create a backwards compatible OS, while Google allows the device manufactures to decide if they will allow OS upgrades for older devices (this is beginning to change as Google enforces an upgrade policy, but doesn’t help the existing older devices already in service).

I recommend that companies supporting Android device not allow any devices more than two generation behind in the least version of the OS onto its corporate networks. This can be monitored and enforced by the EMM/UEM suite. In a BYOD environment this may be problematic as companies have much less say in what devices users acquire.

Nevertheless, I encourage companies to enforce the policy and require even BYOD users to have current OS powered products as much as possible. Security feature enhancements are perhaps the biggest reason Android is being upgraded regularly. With BYOD iOS devices, this is less of an issue as indicated earlier.

Still, monitoring and enforcing a current OS strategy is a great enhancement to a security posture within the company. And third party tools on older devices, while helpful, should not be a substitute for having up to date instances of the OS. As a final protection, I recommend organizations, especially in regulated industries, to deploy enhanced Android secured devices, either from Samsung with their Knox features, or with Android for Enterprise added security features available from several smartphone vendors.

Bottom Line: First and foremost in maximizing mobile security, enterprises must enable robust mobile device management to set profiles, enforce polices and manage access as a minimal requirement before deploying additional capabilities. Once such capabilities are in place, enterprises should look to supplement existing EMM/UEM with specific add-ons to further prevent data breaches and malware.

Organizations should also require up to date devices with current OSes to minimize any potential for malware attacks and data breaches. Finally, companies must have a total security strategy that encompasses mobile devices and mobile work, rather than a standalone security strategy for mobile alone. Without these steps, we will be seeing many more mobile data breaches in the near future.



Source link

How to Secure Your Synology NAS from Ransomware

Recently, some Synology owners discovered that all the files on their NAS system were encrypted. Unfortunately, some ransomware infected the NAS demanded payment to restore the data. Here’s what you can do to secure your NAS.

How to Avoid the Ransomware Attack

Synology is warning NAS owners of several ransomware attacks that hit some users recently. The attackers use brute-force methods to guess the default password—essentially, they try every password possible until they get a match. Once they find the right password and gain access to the network-attached storage device, the hackers encrypt all the files and demand a ransom.

You have several options to choose from to prevent attacks like this. You can disable remote access altogether, allowing only local connections. If you need remote access, you could set up a VPN to restrict access to your NAS. And if a VPN isn’t a good option (because of slow networks, for instance), you can harden your remote access options.

Option 1: Disable Remote Access

Synology Control panel showing QuickConnect and External Access options.

The most secure option you can choose is disabling remote connection features entirely. If you can’t access your NAS remotely, then neither can a hacker. You will lose some on-the-go convenience, but if you only work with your NAS at home—to watch movies, for instance—then you may not miss the remote features at all.

Most recent Synology NAS units include a QuickConnect feature. QuickConnect takes care of the hard work for enabling remote features. With the feature turned on, you don’t have to set up router port forwarding.

To remove remote access through QuickConnect log in to your NAS interface. Open the control panel and click on the “QuickConnect” option under Connectivity in the sidebar. Uncheck “Enable Quick Connect” then click apply.

Synology Control panel with arrows pointing to QuickConnect, Enable QuickConnect, and Apply button.

If, however, you enabled port forwarding on your router to gain remote access, you will need to disable that port forwarding rule. To disable port forwarding, you should look up your router’s IP address and use it to log in.

Then consult your router’s manual to find the port forwarding page (every router model is different). If you don’t have your router manual, you can try a web search for your router model number and the word “manual.” The manual will show you where to look for exiting port forwarding rules. Turn off any port forwarding rules for the NAS unit.

Option 2: Use A VPN for Remote Access

Package Center with the VPN Server install showing.

We recommend just not exposing your Synology NAS to the Internet. But if you have to connect remotely, we recommend setting up a virtual private network (VPN). With a VPN server installed, you won’t access the NAS unit directly. Instead, you’ll be connecting to the router. The router, in turn, will treat you as though you were on the same network as the NAS (still at home, for instance).

You can download a VPN server on your Synology NAS from the Package Center. Just search for “vpn” and choose the install option under VPN Server. When you first open the VPN Server, you’ll see a choice of PPTP, L2TP/IPSec, and OpenVPN protocols. We recommend OpenVPN, as it’s the most secure option of the three.

OpenVPN settings in a Synology NAS

You can stick with all the OpenVPN defaults, although if you want to access other devices on the network when connected through VPN, you’ll need to check “Allow clients to access server’s LAN” and then click “Apply.”

You will then need to set up port forwarding on your router to the port OpenVPN is using (by default 1194).

If you’re using OpenVPN for your VPN, you’ll need a compatible VPN Client to access it. We suggest OpenVPN Connect, which is available for Windows, macOS, iOS, Android, and even Linux.

Option 3: Secure Remote Access as Much as Possible

If you need remote access and VPN isn’t a viable solution (perhaps due to slower internet speeds), then you should secure Remote Access as much as possible.

To secure remote access, you should log into the NAS, open Control Panel, then select Users. If the default admin is turned on, create a new admin user account (if you don’t already have one) and turn the default admin user off. The default admin account is the first account ransomware usually attacks. The Guest user is typically off by default, and you should leave it that way unless you have a specific need for it.

Synology control panel Users options with admin profile disabled.

You should ensure that any users you created for the NAS have complicated passwords. We recommend using a password manager to help with that. If you share the NAS and allow other people to create user accounts, then be sure to enforce strong passwords.

You’ll find password settings in the Advanced tab of the User profiles in the Control Panel. You should check the include mixed case, include numeric characters, include special characters, and exclude common password options. For a stronger password, increase the minimum password length to at least eight characters, although longer is better.

To prevent dictionary attacks, a method where an attacker guesses as many passwords as quickly as possible, enable Auto-Block. This option automatically blocks IP addresses after they guess a certain number of passwords and fail in a short amount of time. Auto-block is on by default on newer Synology units, and you’ll find it in Control Panel > Security > Account. The default settings will block an IP address from making another login attempt after ten failures in five minutes.

Finally, consider turning on your Synology firewall. With a firewall enabled only services you specify as allowed in the firewall will be accessible from the internet. Just keep in mind that with the firewall on, you’ll need to make exceptions for some apps like Plex, and add port forwarding rules if you are using a VPN. You’ll find the firewall settings in Control Panel > Security Firewall.

Data loss and ransomware encryption is always a possibility with a NAS unit, even when you take precautions. Ultimately a NAS isn’t a backup system, and the best thing you can do is make offsite backups of the data. That way if the worst should happen (whether that’s ransomware or multiple hard drive failure), you can restore your data with minimal loss.





Source link