LOW
The severity is rated LOW as this content does not detail a specific vulnerability but rather describes a setup. However, the potential security risks are present in any networked storage solution, particularly with SSH and SMB services exposed without proper hardening.

The content describes a DIY NAS setup using a Steam Deck with Debian 12 minimal installed, primarily aimed at providing network storage capabilities for both Linux and Windows systems. The setup includes two drives: one formatted in ext4 (6TB) for Linux backups and another in NTFS (4TB) for Windows backups. Network connectivity is achieved through a 2.5GbE connection via a USB NIC with the r8152 driver, offering impressive transfer speeds of up to ~560 MB/s on Linux clients and ~280 MB/s on Windows systems. While this setup demonstrates a creative use of hardware for network storage purposes, it highlights the importance of securing such devices against potential vulnerabilities, especially considering the SSH access and SMB shares that could be exploited if not properly configured.

Affected Systems
  • Debian 12 minimal
  • Windows 11
Affected Versions: All versions of Debian 12 minimal and Windows 11 used in the described setup
Remediation
  • Configure SSH to use public key authentication instead of password-based access: `sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config` followed by restarting SSH service with `sudo systemctl restart sshd`.
  • Ensure SMB is configured securely, disable guest access and enable encryption: Add `server min protocol = SMB3` and `guest ok = no` to `/etc/samba/smb.conf`, then restart Samba services.
  • Apply all available security updates for Debian 12 minimal and Windows 11 through their respective package managers or update mechanisms.
Stack Impact

The setup is specifically impactful in homelab environments where custom network storage solutions are common. The use of Debian 12 with SSH and SMB services means that configuration files such as `/etc/ssh/sshd_config` and `/etc/samba/smb.conf` need careful attention to security settings.

Source →