Access security to USB stick ?

[PolarBear]

RT-AC66U, 378.56_2

Hello everyone, I have a question concerning security access to a USB stick in the router. I have read around the topic, but can't find an answer to this specific question.

My router's USB stick is formatted FAT32, in order that can work on it attached to my PC (Windows 7). FAT32 does not allow access permissions to be set, but I assume this is at file level. As the router is relatively inaccessible, I leave the stick mounted in the router.

Does anyone know please, is access to these files sufficiently protected, if I have disallowed guest access to the USB stick in the router settings ? (menu "USB application / Media Services and Server / Network place (Samba) share")

I am unsure if this setting sufficiently controls access to the whole stick, while it is in the router?

Physical access to the router is impossible.

I have done some testing from my PC. The router password is very strong, and I have to enter this password when mapping the USB stick in Windows \\RT-AC66U-1234\myusb\foldername.
However, drive mappings / permissions seem to be rather "sticky" in Windows 7, so the results of my own testing are inconclusive, and I don't have a second PC with me to test with.


The answer is particularly important because the stick contains nvram extracts (using John's nvram tool), which contain the router passwords in clear text.

I also want to set up an OpenVPN server to access the NAS while on the road, so I would like to make sure the router cannot be compromised from the WAN. I would also like to allow https and SSH access via WAN so I can make any configuration changes necessary, without driving 3 hours to the remote location.

I have already taken the usual precautions - not using "admin" as a user name, strong router password, access only via https and SSH using non-standard ports, etc.

Many thanks in advance for any comments.

 

[martinr]

I have already taken the usual precautions ......access only via https and SSH using non-standard ports, etc.
....

A well outlined and interesting topic, which I'll follow with great interest.

Quick question for you, not wishing to divert attention from the main thrust: is it enough to simply select WAN access via https only, or do you need to set up certificates? Recently, out of curiosity I temporarily set https WAN access (normally blocked). Remote login via Safari browser brought up "Cannot verify server identity...." with the options Cancel, Details, Continue. Selecting Continue does indeed bring up the webui login page. Similarly with Chrome, Advanced options ("proceed to .....asuscomm.com - [unsafe] )". So setting WAN access https isn't enough on its own.

 

[PolarBear]

A well outlined and interesting topic, which I'll follow with great interest.

Quick question for you, not wishing to divert attention from the main thrust: is it enough to simply select WAN access via https only, or do you need to set up certificates? Recently, out of curiosity I temporarily set https WAN access (normally blocked). Remote login via Safari browser brought up "Cannot verify server identity...." with the options Cancel, Details, Continue. Selecting Continue does indeed bring up the webui login page. Similarly with Chrome, Advanced options ("proceed to .....asuscomm.com - [unsafe] )". So setting WAN access https isn't enough on its own.

I have the same message, even when accessing from within the LAN (Firefox). I simply press "Ok to continue, I understand the risks" and continue. I haven't bothered with certificates etc. if it works, and I know that this is my router's IP address.

But in the last few days, the login page has started to hang ("Settings have been updated" message) if I access using the router IP address (https://10.xxx.xxx.1:12345), but only with Firefox. I have white listed all 10.xxx.xxx.xxx adresses in Java, Firefox, NoScript and ESET NOD 32 antivirus, but I still get the problem.

Accessing via htts://router.asus.com:12345 displays the log in screen correctly.

Internet Explorer displays the login screen as expected. I haven't tried Chrome.

 

[martinr]

I'll Google the topic. As I say, I don't want to detract from the main thrust of your question and look forwards to reading the comments of those with answers rather than questions!