SSH security problem

[zalktis]

I am use DS223j , all is updating to newewr version.
But i am receive from my Telecomunication service for secure problem with my NAS DS223j wit trhis text:

Taking care of customers and their data security, Tet maintains and regularly monitors the security of the infrastructure, as well as cooperates with the IT security incident prevention institution CERT.LV.

We have received information from CERT.LV that a cyber security threat open-ssh:cve-2023-48 has been detected in your Internet connection address.

Cybersecurity threats can be caused by an incorrectly configured computer, TV, external hard drive, WiFi router, and other devices connected to the Internet. You can learn more about the detected threat and the steps to be taken to prevent it here....


You received this e-mail because you have a device, which has a publicly available SSH service, that may be vulnerable to CVE-2023-48795.
Successful exploitation of this vulnerability allows remote attackers to bypass integrity checks, leading to a downgrade or disabling of security features. This vulnerability is known as a Terrapin attack and affects various products, including OpenSSH before 9.6, Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, and many others.
What to do:
We suggest that you check all devices, which have SSH services open to the internet, close all unused SSH services and update the necessary SSH software on your devices.

More info:

NVD - CVE-2023-48795

nvd.nist.gov

* If you lack the experience and knowledge to perform these activities – we recommend that you consider using the help of a competent IT specialist.

 

[Rusty]

Looks like you have the SSH default port 22 open on the router facing the Internet. This is a high security issue, so the ISP is warning you. It would be best to shut that down. You can use the ssh and its port internally, just shut it down on the router.

Also it would be recommend to change the default SSH port (22) to some other number in case you do need to use SSH to begin with.

 

[zalktis]

I copy all files from Synology NAS to another Synology NAS. I use this ssh protocol over internet. Please, can you please suggest another secure option to copy all files from one NAS to another NAS over the internet?

 

[fredbert]

Both SSH and its secure file sharing service, SFTP, default to the same TCP port 22. However, in DSM you can change both to be running on different and non-standard TCP ports. This will enable you to treat the services separately, and if you want Internet access to one then you can do that. My setup has access to SSH blocked from the Internet (no port forwarding from my router's firewall) but has source limited access to SFTP. Both use non-standard ports, even for local access.

For any Internet accessible file-sharing service (SFTP and WebDAV) I have applied an access permission, in Control Panel, to block administrators from outside the LAN. What I'm trying to do is to ensure administrator access is from devices on the LAN only, while less privileged standard account can have access (provided they are from places I've allowed in my router's firewall). I also don't allow administrators to VPN into the LAN: first a standard user creates the VPN and then I can use my administrator accesses.

 

[EAZ1964]

It this is for backup, you can use Hyper backup to copy from one NAS to the other and vv.
The syno firewall and backup vault give extra protection for this setup.