Guest User security concerns on My Cloud 2TB Personal Cloud Storage

My Cloud OS 3 Personal & Network Attached Storage My Cloud
1

Hello…Can I prevent “guest” access to WD My Cloud ??

FYI, I use Apple devices and I discovered that one of my tenants with a MacBook Pro (with approved access to my home metwork - Netgear modem and separate netgear router and access point) could see my files on WD My Cloud as a “guest” and didn’t even need a password to see my files.

2

Well, yeah, if you set your permissions on your shares correctly…

3

ConcerenedUser wrote:

Hello…Can I prevent “guest” access to WD My Cloud ??

To fully make a folder private you must disable both “Media Serving” and “Public Access” on the folder, then enable per user access (no access, read only access, full access) to the private folder.

Any content in the “Public” folder will be visible to all. Move all content you want private out of the “Public” folder into folders that have both “Media Serving” and “Public Access” disabled.

Also note that if you disable “Public Access” while leaving “Media Serving” enabled on a private folder then any and all Twonky DLNA server supported media in that private folder (or its subfolders) will still be visible to anyone usign a DLNA client (like Windows Media Player).

4

Thanks heaps Bennor. Is it also possible to disable the public folder?

5

 Is it also possible to disable the public folder?

Not via the Dashboard, as you cannot change the access options for Public. There’s a clue in the name…

It might be possible to modify access rights using an SSH login and playing with Linux settings, but I don’t remember seeing such a discussion, and it’s not a problem I have.

6

ConcerenedUser wrote:
Is it also possible to disable the public folder?

Yes you can, but apparently its only because of a possible bug in the user interface. As indicated  in this prior thread, if you attempt to change the Public folder “Shared Name” through the WD Administration interface you will be prevented from doing so. However, after attempting to change the Shared Name the “Public Access” option become ungray’d (available) and one can select “Off” to disable public access to the Public folder. Once set to Off one can select the individual users access levels for the Public folder. The change seems to stick after rebooting the WD My Cloud.

Just remember to disable Media Sharing as well if you want the Public folder to be truly private. To reenable public access to the Public folder just repeat the attempt to rename the folder through the administration interface then set “Public Access” to “On”.

1 Like
7

Hah! Excellent bug exploit…

After being refused permission to change the name, and changing the switch, I had to refresh the browser page, and log in to the Dashboard again. The switch was set to ‘off’, but greyed out, but the user access controls were active. Repeating the process set Public access back on.

I don’t have a problem with Public access, but I’ll remember this trick for the future…

[edit]

Interestingly, I found that Twonky had gone mad last night, and was trundling through my map tile data, thus finding hundreds of thousands of ‘pictures’.

Why did it do that?  Because playing with permissions to Public had made MyCloud add ‘Public: All Media Types’ to Twonky’s Sharing configuration.  I wasn’t expecting that, and it was quite persistent, in that I had to edit the /etc/contentdir to remove it, and restore a backed-up twonkyserver.ini

It’s a good job I’m familiar with Twonky, but it was harder than I expected, which reminds I still don’t completely understand how MyCloud and Twonky interact…