Differences

This shows you the differences between two versions of the page.

--- security [2021/04/05 12:41] – [Changing the default root (ssh) password]removed NOTOC, Added a note about the fact this seems to force to use the login credentials to use the windows explorer, I don't know how that even looks tho. fishou
+++ security [2023/09/17 14:36] (current) – Add more detail regarding Enforce Security effects maximumentropy
@@ Line 3: / Line 3: @@
 //Security// is a big name for a retrogaming OS. Batocera is not a designed to be a secure OS. Don't expose it to the open Internet: you are warned and you will take all responsibility for what happens.
-Enabling this will also make it so you need to put the user (root) and password into your batocera when accessing it from the Windows explorer.
+There is the option to **Enforce Security** in Batocera; this will have three effects upon rebooting:
+  - The password for root will be changed from ''linux'' to a randomly generated password, which you can see in System Settings, Security section.
+  - Access to the shared folders from another computer over the network using CIFS (also known as SMB or Samba) will require you to provide the user name ''root'' and the password
+  - The configuration file used by Samba will be `/etc/samba/smb-secure.conf` instead of `/etc/samba/smb.conf`, so any overlay customizations will need to be made in the alternate file.
+However, if you want to change the password yourself you can go to Main Menu > System Settings > Security > Root Password.
+If you would like to do this over SSH:
+  - First, make sure you have **Enforce Security** enabled as explained above
+  - Connect to your Batocera [[access_the_batocera_via_ssh|using SSH]] form another device
+  - Type the following command : ''%%batocera-config setRootPassword [password]%%'' (replace ''[password]'' with the password you want).
+  - Use the ''batocera-config getRootPassword'' command to see if your changes were applied.
+  - Reboot the system, and you should be able to connect to it using the new password.
+<WRAP center alert 60%>
+The Samba protocol (Batocera's userdata network share) as a whole is a major attack surface and should not be trusted on a public network at all (even if **Enforce Security** is turned on). This is among other features Batocera has turned on by default that pose as a security-risk. The gist of it is this: only connect your Batocera machine to your trusted home network, behind a firewall.
+</WRAP>
+<WRAP center round important 60%>
+Certain actions, such as adding or removing an ethernet network interface, may cause the password to be randomized on the next reboot!  Be sure to have another way to access the system if an unexpected randomization occurs, such as [[access_the_batocera_via_ssh#password-less_authentication|Password-less authentication]]
+</WRAP>
-However, if you want to change the password, you can do so by doing the followings:
-  * Connect to your Batocera using SSH on another device
-  * In EmulationStation, go to the [[emulationstation#system_settings|System settings]], then to Advanced, and then to Security.
-  * Enable the ''Enforce Security'' setting.
-  * In the terminal connected using SSH, type the following command : ''%%batocera-config setRootPassword [password]%%'' (replace ''[password]'' by the password you want).
-  * Then, use the ''batocera-config getRootPassword'' command to see if your changes were applied.
-  * Reboot the system, and you should be able to connect to it using the new password.