memory: snapshot — run 3c gated, run 4 training, DAC revert, GPU rebalance, NAS exposure

2026-09-05 06:36:56 -07:00
parent 5237efa299
commit 82158e7e36
13 changed files with 958 additions and 651 deletions
@@ -0,0 +1,33 @@
+# `[2026-09-04]` esh-nas SMB account for the AudioGridder box — and the NAS is effectively open to the whole LAN
+
+`10.0.50.50` is **CT 103 on esh-pve-nas**, a hand-rolled Debian NAS (not a Synology). Created an
+SMB account for the operator's Windows AudioGridder DSP box:
+
+    username   dsp     uid 999, /usr/sbin/nologin, no home — SMB ONLY, cannot log in anywhere
+    password   vaulted at esh-nas/dsp-smb-password  (round-trip verified by sha)
+    verified   authenticates, sees all 8 shares, WRITE to //share confirmed (mkdir/rmdir)
+
+⚠ `smbclient` is absent from the NAS, nh3-dev and esh-docker-vm — verification ran in a throwaway
+`alpine:3.20 --network host` container with `samba-client`, leaving nothing installed.
+
+Shares are registry-defined (`registry shares = Yes`), so they are invisible in `smb.conf` — use
+**`testparm -s`**, not grep, or you will conclude there are no shares.
+
+## ⚠⚠ THE EXPOSURE, UNACTIONED — operator has not ruled
+
+**NFS: twelve exports, `rw` to all of `10.0.0.0/8`, `sec=sys`, no authentication.**
+
+    /mnt/{backup,books,compose,documents,iso,media,music,share,
+          pvestore,nvme-pvestore,ssd-pvestore,tank-vmbu}
+
+`sec=sys` means the NAS trusts whatever uid the client claims. **Every VLAN at ESH — IoT,
+cameras, guest — can mount the NAS read-write today.** `/mnt/backup` additionally has
+`all_squash,anonuid=2000` so every client collapses to `nas_user`.
+
+**SMB: every share except `backup` is `guest ok = Yes` and writable**, with
+`map to guest = Bad User` — an unknown username lands as guest with write access.
+
+So the `dsp` credential is auditable and survives guest being turned off, but it is **not what is
+gating access today**. Hardening (narrow exports to `10.0.50.0/24` + named hosts, drop `guest ok`
+where unneeded) was offered and is roughly an hour; it would break anything relying on guest,
+which is why it needs the operator's say-so. **Not actioned. No tracking surface beyond this entry.**