Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
security [2021/09/08 20:57] – Precision about password change over SSH lbrpdxsecurity [2023/09/17 14:36] (current) – Add more detail regarding Enforce Security effects maximumentropy
Line 3: Line 3:
 //Security// is a big name for a retrogaming OS. Batocera is not a designed to be a secure OS. Don't expose it to the open Internet: you are warned and you will take all responsibility for what happens. //Security// is a big name for a retrogaming OS. Batocera is not a designed to be a secure OS. Don't expose it to the open Internet: you are warned and you will take all responsibility for what happens.
  
-There is the option to **Enforce Security** in Batocera; this will have two effects upon rebooting:+There is the option to **Enforce Security** in Batocera; this will have three effects upon rebooting:
  
   - The password for root will be changed from ''linux'' to a randomly generated password, which you can see in System Settings, Security section.   - The password for root will be changed from ''linux'' to a randomly generated password, which you can see in System Settings, Security section.
   - Access to the shared folders from another computer over the network using CIFS (also known as SMB or Samba) will require you to provide the user name ''root'' and the password   - Access to the shared folders from another computer over the network using CIFS (also known as SMB or Samba) will require you to provide the user name ''root'' and the password
 +  - The configuration file used by Samba will be `/etc/samba/smb-secure.conf` instead of `/etc/samba/smb.conf`, so any overlay customizations will need to be made in the alternate file.
  
 However, if you want to change the password yourself you can go to Main Menu > System Settings > Security > Root Password. However, if you want to change the password yourself you can go to Main Menu > System Settings > Security > Root Password.
Line 20: Line 21:
 <WRAP center alert 60%> <WRAP center alert 60%>
 The Samba protocol (Batocera's userdata network share) as a whole is a major attack surface and should not be trusted on a public network at all (even if **Enforce Security** is turned on). This is among other features Batocera has turned on by default that pose as a security-risk. The gist of it is this: only connect your Batocera machine to your trusted home network, behind a firewall. The Samba protocol (Batocera's userdata network share) as a whole is a major attack surface and should not be trusted on a public network at all (even if **Enforce Security** is turned on). This is among other features Batocera has turned on by default that pose as a security-risk. The gist of it is this: only connect your Batocera machine to your trusted home network, behind a firewall.
 +</WRAP>
 +
 +<WRAP center round important 60%>
 +Certain actions, such as adding or removing an ethernet network interface, may cause the password to be randomized on the next reboot!  Be sure to have another way to access the system if an unexpected randomization occurs, such as [[access_the_batocera_via_ssh#password-less_authentication|Password-less authentication]]
 </WRAP> </WRAP>
  
  
  • security.1631134634.txt.gz
  • Last modified: 5 years ago
  • by lbrpdx