|
|
Author
|
Topic: DSS200 FTP credentials ... cannot be changed from factory defaults ... WTF?!
|
Leo Enticknap
Film God
![](http://www.film-tech.com/ubbmembers/534a.jpg)
Posts: 7474
From: Loma Linda, CA
Registered: Jul 2000
|
posted 09-16-2015 07:14 PM
I'm scratching my head over this one.
I'm trying to make a DSS200 accessible for FTP ingestion from a remote Internet location (basically, to enable trailers and that sort of stuff to be swapped between two DSS200s in two theaters without the need to move flash sticks back and forth, and also to ingest short DCPs and keys from home). As part of this, I emailed Dolby customer support to ask them how to change the FTP login credentials from the factory defaults as stated in the manual.
Their reply came back - they cannot be changed and you have to use the defaults!
I find this staggering. As a general rule, the quality of Dolby's products and support is second to none, and so I can't figure out why they would do something as stupid as to deny their customers the ability to apply very basic IT security 101 - don't leave the username and password on the factory default. I could understand why they didn't want to publish the procedure in the manual - to discourage novice owners from reaching beyond their ability and locking themselves out of their own servers, and/or to prevent bad guys (e.g. disgruntled employees) from locking server owners out of their machines maliciously. But I didn't for one moment think that the software was written such that it simply couldn't be done.
As far as I can see, I now have three choices.
1 - Give up on the idea of having remote access to the servers, and keep them disconnected from the Internet.
2 - Mess around with port forwarding in the router firewall settings, such that only incoming connections from specific IP addresses on port 21 are allowed. As one of our theaters and my home has a dynamic IP, that's not going to work unless I update the router settings every time AT&T, Verizon or whoever chooses to change the IP addresses of the places I want to reach the DSS200s from.
3 - Accept that the DSS200s will be left wide open to hackers.
I hope that Dolby will come to their senses and add the ability to change these credentials from their defaults on a future software version. I can't even begin to imagine the rationale behind making them completely fixed.
| IP: Logged
|
|
|
|
|
|
|
|
Leo Enticknap
Film God
![](http://www.film-tech.com/ubbmembers/534a.jpg)
Posts: 7474
From: Loma Linda, CA
Registered: Jul 2000
|
posted 09-17-2015 10:15 AM
I get that by putting extra security infrastructure in place - SSH port forwarding, a VPN or whatever - this issue can be worked around. But for me, it's a case of the security/convenience tradeoff. I'm only looking to be able to transfer small DCPs (e.g. snipes and trailers) and KDMs remotely. I have one projectionist who doesn't use email at all and therefore can't ingest a KDM if it arrives on the day of the show and I'm not there, and times when the programmers need DCPs made from files (e.g. walkin slideshows) at the last minute, when I'm at home 70 miles from the theater. If it takes an hour to transfer 3GB, that's not a problem and a better option than four hours of driving. Adding serious extra network security infrastructure to the booth is not something I have the time or the budget to do, but our IT guy is able to fix things so that these servers have an external IPv4 address.
If I could set up proper usernames and passwords such that only a determined hacker using brute force could get through them, that would be enough security for me (i.e. proportional to the risk, in my judgment). But I can't, because Dolby won't let me, leaving my only options the more time-consuming and expensive ones to implement, as described by Steve and Frank, or putting these servers on the public Internet with their factory default credentials.
It is surely not a massive software engineering task to make these credentials changeable by the end user. Given that even 12-year old schoolkids are taught that the first, most basic rule of IT security is never to leave usernames and passwords on the factory default when you buy or take charge of a new device (not to mention the fact that server credentials left on their factory defaults is reportedly how the Sony hack was done), I'd love to know what line of reasoning led Dolby to make them unchangeable.
| IP: Logged
|
|
|
|
|
|
All times are Central (GMT -6:00)
|
|
Powered by Infopop Corporation
UBB.classicTM
6.3.1.2
The Film-Tech Forums are designed for various members related to the cinema industry to express their opinions, viewpoints and testimonials on various products, services and events based upon speculation, personal knowledge and factual information through use, therefore all views represented here allow no liability upon the publishers of this web site and the owners of said views assume no liability for any ill will resulting from these postings. The posts made here are for educational as well as entertainment purposes and as such anyone viewing this portion of the website must accept these views as statements of the author of that opinion
and agrees to release the authors from any and all liability.
|