Moving forward safely after Deadbolt

[davelartigue]

I seem to have recovered from Deadbolt without major issues, which I am relieved for. Now, going forward, I need to know what to do to secure my NAS from future attacks.

Here's where I currently stand:
admin account has changed password and been disabled
alternative admin account with strong password added
HTTP and HTTPS ports have been changed from 8000 and 8001
web server ports have been changed from 80 and 443
SSH and SFTP have been turned off
EZ-Connect is turned off
all services except SMB are turned off
EZ Sync is turned off
DDNS is turned off
under "Settings > Manual Connect > EZ-Router" the only items under Port Forwarding are WebDAV, RSync, and ADM Web Service
I thought I had turned of Emby but it seems to be running, so I guess not. I have changed its ports as well.
(I've backed up the data on the NAS in addition to all this.)

Here is everything I want to be able to do with my NAS at this time:
* back up files on my computer on my home network
* access files on my home network
* use Emby to serve music on my home network

Eventually as I learn more and become more comfortable with things I will certainly be installing more apps and doing more things. For example, eventually I want to be able to access music and files external to the home network. But right now those are the priorities.

Can anyone advise on either:
* additional changes I should make, especially involving my actual web router
* any of the above that shouldn't be disabled

[orion]

As long as you disable DDNS, EZ-Router and EZ-Connect (ADM web -> Settings), your NAS is safe. It means you can only access your NAS within LAN (hackers are the same).