Skip to content
isdahl.org

Security

  • Change Aurora’s FTP login. Aurora’s default login (xboxftp / xboxftp) lets anyone on your network read and write the console’s drives. Set your own in Aurora’s settings and enter it on the dashboard’s Settings page (or NETDISC_FTP_USER/NETDISC_FTP_PASSWORD in Docker, or --ftp-user/--ftp-password). FTP sends the login unencrypted, so keep the console on a network you trust. On Windows the settings file keeps the password encrypted for your Windows user; the dashboard never shows it again, and the server never writes it to its log.
  • Keep the NetISO server on your home network. The NetISO protocol has no login: anything that can reach port 4323 can list and read the games you serve. Don’t forward that port from the internet. When Windows Firewall asks, allow NetDisc360.exe on private networks only. The Docker image runs as an unprivileged user and only needs read access to your games.
  • Give the dashboard a password when other devices can open it. On Windows only the PC itself can open it until you turn on Other devices can open it, which needs a password. In Docker it is open to your network, so set one. The password is kept only as a salted hash; logging in gives the browser a cookie for 30 days, and changing the password logs every browser out. Without a password the dashboard only answers to addresses and local names (like nas.local), so a web site can’t reach it through your browser, and it only takes requests from its own page. The login cookie is signed with a random key kept next to the settings file (session.key), not with anything a backup holds. Don’t forward port 8360 from the internet either.
  • Covers on the dashboard. Your browser downloads them from GitHub (the XboxUnity-Scraper archive), asking only for each game’s Title ID. Turn them off under Settings > Dashboard. Latest releases (in the sidebar) asks GitHub for the newest version of NetDisc360, FastFTP360 and NetUsb360 only when you open it. Apart from the update check below, the server itself never goes online.
  • Backups hold Aurora’s FTP login and the dashboard password’s hash, like the settings file (the FTP password is encrypted on Windows, so a backup restored on another PC or in Docker keeps the FTP password already set there). Keep downloaded backups where only you can read them.
  • Updates come only from this project’s GitHub releases. On Windows the server asks GitHub’s API for the newest release and, when you install it, downloads its NetDisc360.exe over HTTPS and installs it only if it comes from this project’s releases and its size and SHA-256 match what GitHub lists for the release. Turn off Look for updates under Settings > Updates to stop it. In Docker the dashboard asks GitHub from your browser instead.
  • The server only reads your game folders; it never writes to them. On the console it writes only inside --xbox-folder and, unless --no-category, the one Aurora script described in Aurora’s Xbox 360 category.