Secure KNULLI Network Access Before Using SMB or SSH

by

Owner testing: NO — documentation-led

Security boundary: Use this guide only when the RG CubeXX/H700 and exactly one test client are on the same trusted private LAN controlled by you. Stop on any public, guest, unknown, or untrusted network. This guide does not cover Internet or WAN access, public IPs, port forwarding, DMZ placement, VPNs, firewall changes, router changes, or general hardening.

In this guide, secure has a narrow meaning: turn on KNULLI’s documented Enforce security protection, use the current generated Root password, and minimize documented services by enabling only the one you need. It does not mean that the device has been comprehensively hardened or certified for hostile networks.

Short Answer

First identify the installed KNULLI release. On the handheld, open Start → System Settings → Security. If Enforce security is off, turn it on and reboot; if it is already on, no sourced mandatory reboot is required. Return to the Security screen and confirm that the current Root password is visible.

Choose only SMB, SSH, or SFTP. Where your release provides a documented switch, enable only that service. Connect from one trusted client with username root and the password currently displayed on the handheld. Stop the check as soon as authentication is proven, disconnect, and turn the selected service off where a documented switch exists.

The generated password can change after an update or major settings change. Read the current value on the device rather than relying on an old saved credential.

Release Matrix: Check This Before Following a Branch

Do not infer features from a newer guide. Identify the installed release first and follow only its documented, visible menus.

Installed release Enforce security SAMBA control SSH control What to do
Firefly 20241204 Supported; reboot after changing the setting No documented user Services switch No documented user Services switch Use the protected credential and one bounded authentication check. Do not promise per-service shutdown.
Gladiator II 20250813 Supported; reboot after changing the setting Services → SAMBA; documented disabled by default No release-proven SSH switch For SMB, enable SAMBA only for the access window and disable it afterward. Do not invent an SSH toggle.
Scarab 20260511 Supported; reboot after changing the setting Services → SAMBA; documented disabled by default Services → SSH Verify the actual SSH state instead of assuming it is off. Enable only the selected service if needed, then disable it after the check.
Identified current/later release with matching menus Follow the same documented Security workflow Follow the matching visible menu Follow the matching visible menu; the dedicated SSH documentation establishes the Scarab-and-later threshold Use only the identified release and menus actually present. Stop if the release or expected menus are uncertain.

Documentation conflict: Current Network Transfer prose contains stale wording that could place the SSH switch in Gladiator II. The dedicated SSH page and release-tagged evidence place the user-facing Services → SSH control in Scarab. Therefore, this guide does not assign an SSH switch to Gladiator II.

“No documented switch” does not mean a service can never be stopped. It means unsupported methods are outside this guide, and no service-off promise is made for that branch.

Eligibility and STOP Conditions

Proceed only when all of these are true:

  • The device is an RG CubeXX/H700 running Firefly 20241204, Gladiator II 20250813, Scarab 20260511, or an identified later release whose menus match current documentation.
  • KNULLI already boots into EmulationStation.
  • You know the installed release before choosing a branch.
  • The handheld and exactly one test client are on the same trusted private LAN controlled by you.
  • You can operate the KNULLI menus directly.
  • Your goal is preparation for local SMB, SSH, or SFTP access—not file transfer, remote administration, or Internet exposure.

STOP immediately if any of these applies:

  • The network is public, guest, unknown, shared with untrusted users, or outside your control.
  • The release cannot be identified.
  • The expected Security menu or release-supported service entry is missing.
  • The Root password is not visible after you enabled Enforce security and completed the required reboot.
  • The SSH/SFTP client shows an unexpected cached host-key change.
  • Access succeeds only after disabling KNULLI security or weakening client security.
  • The task would require a custom password, password rotation, SSH keys, root-login changes, configuration edits, shell hardening, router changes, or broader security work.
  • Authentication still fails after one on-device password reread and one careful retry.

At a STOP condition, do not reset, reflash, update or downgrade, delete configuration, edit service files, run shell commands, broadly purge credentials, reset the router, or weaken security policy.

Inspect the Starting State and Protect Private Details

Before changing anything:

  1. Identify the installed release.
  2. Confirm that the handheld and one client are on the same trusted private LAN controlled by you.
  3. Inspect whether Enforce security is on.
  4. Inspect whether SAMBA appears in Services and note its current state.
  5. Inspect whether SSH appears in Services and note its current state.
  6. View or temporarily note the actual local hostname or current local IP privately, only for use by this client.
  7. Choose exactly one branch: SMB, SSH, or SFTP. Do not enable SAMBA and SSH together for convenience.

Do not put the Root password, Wi-Fi key, IP address, MAC address, SSID, hostname, SSH fingerprint, host key, or key material in screenshots, public notes, support posts, chat, or article examples. Any example or screenshot must use fictional or fully redacted values. Do not capture filenames or personal library contents.

Turn On Enforce Security

  1. Open Start → System Settings → Security.
  2. Check Enforce security.
  3. If it is off, turn it on and reboot the device. The reboot is required for the changed setting to take effect; a service restart is not a substitute.
  4. If it is already on and was not just changed, the reviewed documentation does not require another reboot merely because you viewed it.
  5. Return to Start → System Settings → Security.
  6. Confirm that Enforce security is on and the Root password field is visible.
  7. Use username root. Read the current generated password from the handheld only when entering it into the trusted client.

The generated Root password may change after an update or major settings change. Do not treat it as permanent, substitute an assumed credential, or create a custom-password workflow.

Choose and Enable Only One Service

If you chose SMB

  • Firefly: Do not look for or invent a SAMBA Services switch. Continue only with the bounded authentication check; this guide makes no service-off promise for this release.
  • Gladiator II, Scarab, or a matching identified later release: Open Start → System Settings → Services → SAMBA and enable it only for this access window.

Use the private local hostname/IP, username root, and the current displayed Root password.

If you chose SSH or SFTP

  • Firefly or Gladiator II: Do not instruct or invent an SSH Services switch. Continue only with the bounded authentication check; this guide makes no service-off promise for these branches.
  • Scarab or a matching identified later release: Open Start → System Settings → Services → SSH, inspect its actual state, and enable it only if required. Do not assume its starting state.

Use the private local hostname/IP, username root, and the current displayed Root password. Enter port 22 only if the SSH or SFTP client asks for a port.

If a client is marketed as supporting both SFTP and SCP, select SFTP mode for this no-transfer check. Do not initiate an SCP copy merely to test authentication.

Perform One Bounded Authentication Check

Use only the branch selected above, from the one trusted client.

SMB: confirm the share, not its contents

  1. Authenticate with username root and the current Root password.
  2. Confirm that a network share named share is presented or available. This share maps conceptually to KNULLI’s logical /userdata area.
  3. If the client can prove share availability without opening it, stop there.
  4. If the client necessarily displays a directory listing when it connects, treat that listing as incidental filename and metadata visibility. Do not inspect it, capture it, or use it as permission to browse.
  5. Do not open, preview, read, create, edit, move, rename, or delete any user file.

SSH: open and exit

  1. Authenticate with username root and the current Root password.
  2. Observe that the authenticated session opens.
  3. Exit immediately without entering a command.

SFTP: view and disconnect

  1. Authenticate in SFTP mode with username root and the current Root password.
  2. Observe the authenticated remote session or initial directory view.
  3. Disconnect without upload, download, open, edit, move, rename, or delete.

Do not deliberately try a wrong password, guest login, or anonymous login. Those negative tests are not required and could create misleading results.

If authentication fails

  1. Return to Start → System Settings → Security.
  2. Reread the current Root password on the device.
  3. Carefully retry authentication once.
  4. If that retry fails, STOP. Never disable Enforce security to make access work.

This is a deliberately narrow credential check, not a full client troubleshooting procedure.

Turn Off the Selected Service Where Documented

First close the prior SMB, SSH, or SFTP session completely. Then:

  • SMB on Gladiator II, Scarab, or a matching current/later release: Turn off Services → SAMBA.
  • SSH/SFTP on Scarab or a matching current/later release: Turn off Services → SSH.
  • Firefly SMB/SSH and Gladiator II SSH: There is no documented user switch for this guide to use, so make no service-off claim.

Where you disabled a documented switch, make one fresh connection attempt after the old session is closed. If it is unavailable, report only this: the selected client could not establish a new connection at that moment.

Do not use an already-open or cached session as proof. Do not claim that a port is closed, add a waiting period, scan ports, infer firewall behavior, or generalize the result to every client.

What the Check Proves—and What It Does Not

It proves only

  • KNULLI reports Enforce security as active.
  • If you changed that setting, you rebooted before attempting access.
  • The current displayed credential for user root authenticated one selected service from one trusted client.
  • That selected service was reachable for that bounded session.
  • Where a documented switch exists, disabling it left that client unable to establish one fresh connection at that moment.

This is a protected endpoint check, not proof that every protocol uses identical authentication or that every guest or anonymous path is absent.

It does not prove

  • SMB encryption or signing behavior.
  • SSH cipher strength or host identity beyond the bounded local decision.
  • Encryption at rest or firewall isolation.
  • Safety on hostile networks or for Internet exposure.
  • Key-only authentication, disabled root login, brute-force resistance, or comprehensive hardening.
  • Security certification.
  • Absence of every guest or anonymous path.
  • Absence of cached sessions or credentials.
  • Permanence of the generated password.
  • Transfer or write access, permissions, storage identity, ROM discovery, shell behavior, sustained connectivity, or long-term reliability.

No wrong-password test, guest test, anonymous test, clean client profile, port scan, packet capture, file operation, shell command, throughput test, or long-duration test is required.

Recovery and Less-Protected Rollback

Recover from an outdated saved credential

Return to Start → System Settings → Security and reread the current Root password privately. After an update or major settings change, assume the generated value may have changed. If the client stores a credential, update only the saved credential for this KNULLI host/client; do not purge unrelated saved credentials. Never screenshot, publish, paste, or send the password.

Re-enable a documented service when needed

  • For SMB on Gladiator II, Scarab, or a matching current/later release, re-enable Services → SAMBA only for the required trusted-LAN access window.
  • For SSH/SFTP on Scarab or a matching current/later release, re-enable Services → SSH only for the required trusted-LAN access window.
  • Firefly SMB/SSH and Gladiator II SSH have no documented user service-toggle recovery path in this guide. Stop rather than editing files or running commands.

Understand the rollback boundary

Turning Enforce security off is a reversible configuration rollback, but it requires a reboot to take effect and returns the device to a less-protected state. It is not an authentication fix and is not recommended recovery. After that rollback, this article’s protected endpoint no longer applies.

Do not use a reset, reflash, configuration deletion, shell command, service-file edit, router change, or client-security downgrade as recovery for this procedure.

Keep each adjacent task in its own guide:

This article intentionally does not repeat Wi-Fi repair, SMB troubleshooting, client setup, or transfer steps.

FAQ

Does this make KNULLI safe to expose to the Internet?

No. The procedure is restricted to one trusted private LAN controlled by you. Internet exposure is outside its scope.

Must I reboot if Enforce security was already on?

Not as a sourced requirement merely because you viewed the setting. A reboot is required after you change Enforce security. If you just enabled it and have not rebooted, reboot before attempting authentication.

Which password should I use?

Use username root and the current generated Root password displayed under Start → System Settings → Security. It may change after updates or major settings changes. Do not rely on an assumed or previously saved value.

Should I enable both SAMBA and SSH while testing?

No. Choose one branch and expose only that service where your release provides a documented switch.

Where is the SSH switch on Gladiator II?

This guide does not claim one. Although stale current Transfer prose creates ambiguity, release-proven evidence places the documented user-facing SSH switch in Scarab. Do not project it backward.

Why does the SMB check stop at share?

The purpose is to prove one protected authentication endpoint without using personal data. Even an incidental directory listing can reveal filenames and metadata, so do not inspect or capture it.

Can I use an SCP client for the check?

If the client offers both SFTP and SCP, use SFTP mode, open the initial authenticated view, and disconnect without transfer. Do not test SCP by copying a file.

What if the password is rejected?

Reread the current on-device password and retry once carefully. If it fails again, stop and use the appropriate handoff. Do not turn off Enforce security.

Does a failed fresh connection prove the port is closed?

No. It proves only that this client could not establish a new connection at that moment after the documented service switch was disabled.

Evidence Labels Used in This Article

  • FACT: A bounded technical or procedural statement supported by the reviewed materials, such as using local hostname/IP, user root, and port 22 only when an SSH-family client requests it.
  • SOURCE-CONFIRMED: Explicitly supported by KNULLI documentation or release-tagged evidence, including the Security menu, conditional reboot, generated Root password, and release-specific service controls.
  • COMMUNITY REPORT: No community-reported behavior is used to justify this procedure.
  • UNCONFIRMED: Excluded from the workflow. Examples include a Gladiator II SSH switch, Firefly service switches, or a supported custom-password workflow.

Because owner testing was not required, the procedure is documentation-led. Its conclusions remain limited to the observations listed above.

Sources

Current KNULLI documentation

Release-pinned documentation

Releases and tagged implementation evidence