I think that the main problem with all D-link firmwares (not only the last one), is the complete inconstitency of the data rights management, which does provide different acces right depending on the protocol that you use then accessing to the NAS.
If you know a little bit about unix, this can be easily fixed using:
- unix groups (or whatever group management with pam.d, but /etc/group should suffice for most needs)
- proper use of unix protections (s right on directories e.g.)
- knowledge of config file (smb.conf file content is appealing, with all umask to 0777 !!!)
The use of 777 (drwxrwxrwx) "protection" on all directories is heretic !!!!
This is what you see then I ssh-connect on my NAS: (burk, I nearly fainted)
% ssh NAS-Pey
jls@NAS-Pey:~$ ls -la /mnt/HD/HD_a2
total 77
drwxrwxrwx 12 root root 4096 Jan 25 15:35 .
drwxrwxrwx 3 root root 4096 Jan 22 21:18 .!@$mmc
drwxr-xr-x 3 root root 1024 Jan 25 00:45 ..
-rwxrwxrwx 1 nobody allaccount 12292 Jan 22 21:09 .DS_Store
-rwxrwxrwx 1 nobody allaccount 4096 Jan 22 21:09 ._.DS_Store
drwxrwxrwx 11 root root 4096 Jan 25 15:43 .systemfile
drwxrwxrwx 3 root root 4096 Jan 22 19:51 Nas_Prog
drwxr-xr-x 5 root root 4096 Jan 25 15:35 P2P
drwxrwxrwx 2 nobody allaccount 4096 Jan 24 19:42 carole
drwxrwxrwx 2 jls allaccount 4096 Jan 25 19:53 jls
drwxrwxrwx 2 root root 16384 Jan 22 19:51 lost+found
drwxr-xr-x 2 root root 4096 Jan 24 18:46 root
drwxrwxrwx 3 nobody allaccount 4096 Jan 25 15:18 shared
This is quite easy to do a mistake and erase all data....
These are mainly 5 R/W protocols provided by the NAS:
- ssh -> relies on user+group unix rights management
- http(s) + php/cgi -> relies on group unix management (some setuid should help, I didn't reverse-ingeneeringed it)
- CIFS -> relies on smb.conf file, then user_group rigths
- WebDav -> same than http(s)
- FTP -> relies on user+group unix rights management
Plus:
- multimedia (uPnP, iTUnes) -> read only (not really a pb)
At the moment, the ssh access (which is very convenient to use, using rsync e.g.) allows you to access to everything on the NAS (and is poorly protected, you only need the 57*****64 code to break the protection).
Please D-link, hire a "security concerned" linux sysadmin and take few hours to solve the pb. It should be fixed in less than 2 days, you only need to manage a proper "basic unix rights + smb.conf + lighthttpd/setuid_scripts" consistency.
P.S.: I still love my DNS-320L NAS, a perfect NAS for my needs (and very easily hackable.... you can really do what you want with this equipment)