Skip to content

Instantly share code, notes, and snippets.

@thiagoh

thiagoh/batocera_security_checklist.md

Created April 10, 2026 12:56
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save thiagoh/8dcece1b8dfca7a2631c208152caa7bd to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save thiagoh/8dcece1b8dfca7a2631c208152caa7bd to your computer and use it in GitHub Desktop.
Download ZIP
Batocera Security Checklist (redacted)
Raw
batocera_security_checklist.md

BATOCERA SECURITY CHECKLIST

Generated: April 4, 2026
System: Batocera.linux v42
IP Address: <DEVICE_IP>
Network: <LOCAL_SUBNET> (Private LAN)

CURRENT SECURITY STATUS

Exposed Services (Listening on Network)

  • SSH (Port 22): Remote terminal access - DEFAULT PASSWORD: <DEFAULT_PASS>
  • Samba (Ports 139/445): File sharing - DEFAULT PASSWORD: <DEFAULT_PASS>
  • NFS (Port 2049): Network file system
  • RPC (Port 111): Remote procedure calls

Network Configuration

  • Local IP: <DEVICE_IP>
  • Gateway/Router: <GATEWAY_IP>
  • Connection: Wi-Fi (wlan0)
  • Internet Access: Yes (via router)

Risk Level: MEDIUM

  • ⚠️ Default password still active (<DEFAULT_USER>/<DEFAULT_PASS>)
  • ✅ Behind router firewall (not directly exposed to internet)
  • ⚠️ Anyone on local network can access with default credentials

MANDATORY SECURITY STEPS

✅ STEP 1: Change Root Password (CRITICAL)

Command:

passwd

Instructions:

  1. Open terminal (F4 key or SSH into machine)
  2. Type: passwd
  3. Enter new password (won't show on screen)
  4. Confirm new password
  5. You'll see: "Password changed successfully"

This secures:

  • SSH access
  • Samba file sharing
  • Root terminal access

✅ STEP 2: Verify Router Security

Check your router (<GATEWAY_IP>):

  1. Log into router admin panel (usually http://<GATEWAY_IP>)
  2. Look for "Port Forwarding" or "Virtual Server" settings
  3. Verify NO rules forward to <DEVICE_IP>
  4. Common ports to check: 22, 139, 445, 2049, 80, 8080

Why: Port forwarding would expose your Batocera to the internet.

✅ STEP 3: Test External Exposure

From another computer (not on your network):

  1. Find your public IP: https://whatismyipaddress.com/
  2. Test ports: https://www.yougetsignal.com/tools/open-ports/
  3. Check these ports: 22, 139, 445, 2049
  4. All should show "CLOSED"

If any show OPEN: Remove port forwarding rules from your router immediately.

RECOMMENDED SECURITY STEPS

✅ STEP 4: Disable Unused Services

Check running services:

batocera-services list

Disable SSH (if you don't need remote access):

batocera-services disable sshd

Disable Samba (if you only use USB for file transfer):

batocera-services disable smbd

Re-enable if needed:

batocera-services enable sshd
batocera-services enable smbd

✅ STEP 5: Configure SSH Key Authentication (Advanced)

Instead of password, use SSH keys:

On your other computer (Linux/Mac):

ssh-keygen -t ed25519
ssh-copy-id root@<DEVICE_IP>

On your other computer (Windows):

  1. Use PuTTYgen to generate key pair
  2. Copy public key to Batocera: /userdata/system/ssh/authorized_keys

Then disable password authentication:

# Edit SSH config
nano /etc/ssh/sshd_config
# Add: PasswordAuthentication no
# Restart SSH
batocera-services restart sshd

✅ STEP 6: Monitor Network Connections

See who's connected:

# Active SSH sessions
who

# Active Samba connections
smbstatus

# All network connections
netstat -tn

✅ STEP 7: Keep System Updated

Check for updates:

batocera-upgrade --check

Install updates:

batocera-upgrade

Enable automatic update checks:

  • In EmulationStation: Start → System Settings → Updates → Enable

OPTIONAL SECURITY ENHANCEMENTS

Firewall Configuration

Install iptables rules (advanced):

# Allow only local network access
iptables -A INPUT -s <LOCAL_SUBNET> -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -j DROP

# Save rules
iptables-save > /userdata/system/iptables.rules

Note: Batocera resets on reboot. Use custom scripts to persist.

VPN Configuration

If you need remote access, use VPN instead of exposing ports:

  1. Set up VPN server on your router (WireGuard, OpenVPN)
  2. Connect to home network via VPN
  3. Access Batocera at <DEVICE_IP> through VPN tunnel
  4. No ports exposed to internet

SECURITY BEST PRACTICES

✅ DO:

  • Change default password immediately
  • Use strong passwords (12+ characters, mixed case, numbers, symbols)
  • Keep Batocera updated
  • Only enable services you actually use
  • Use VPN for remote access
  • Regularly check router settings
  • Backup important data to external storage

❌ DON'T:

  • Use default password (<DEFAULT_PASS>)
  • Enable port forwarding to Batocera
  • Connect directly to public Wi-Fi without VPN
  • Share your password
  • Disable router firewall
  • Run untrusted scripts as root
  • Expose SSH to internet without key authentication

QUICK SECURITY AUDIT

Run these commands to check your security:

# 1. Check listening ports
netstat -tuln | grep LISTEN

# 2. Check running services
batocera-services list

# 3. Check active connections
netstat -tn | grep ESTABLISHED

# 4. Check SSH login attempts
grep "Failed password" /var/log/messages 2>/dev/null

# 5. Check system users
cat /etc/passwd

# 6. Verify password is changed
grep "^root:" /etc/shadow | cut -d: -f2
# Should NOT be empty or show default hash

INCIDENT RESPONSE

If you suspect unauthorized access:

  1. Immediately change password:

    passwd

  2. Check for suspicious activity:

    # Recent logins
last

# Current users
who

# Running processes
ps aux | grep -v "\[" | head -20

  3. Disconnect from network:

    ifconfig wlan0 down

  4. Review logs:

    dmesg | tail -50
journalctl -n 100

  5. Reboot to clean state:

    reboot

VERIFICATION CHECKLIST

After completing security steps, verify:

  • Root password changed from default
  • Can still access Batocera via SSH/Samba with new password
  • No port forwarding rules on router pointing to <DEVICE_IP>
  • External port scan shows all ports closed
  • Only necessary services are running
  • System is up to date
  • Backup of important data exists

MAINTENANCE SCHEDULE

Weekly:

  • Check for system updates

Monthly:

  • Review router port forwarding settings
  • Check active network connections
  • Review SSH logs for failed attempts

Quarterly:

  • Change password
  • Audit enabled services
  • Test external port exposure

SUPPORT RESOURCES

Batocera Security Documentation:

Community Support:

SUMMARY

Minimum Required Actions:

  1. Change root password: passwd
  2. Verify no port forwarding on router
  3. Test external exposure (all ports should be closed)

Time Required: 10-15 minutes

Difficulty: Easy

Impact: Protects your system from unauthorized access

IMPORTANT: Your Batocera is currently accessible to anyone on your local network (<LOCAL_SUBNET_RANGE>) using the default password. Change it now to secure your system.

Report End
Next Action: Run passwd command to change root password
Status: Awaiting security implementation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment