Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include:

  • ssh, ftp, telnet, mail servers
  • photo gallery (directly from the NAS!)
  • mysql/php (can even run a website from there)
  • and much more

On the specs side it looks awesome as a LAN server but it's possible to access those services also from the Internet. And now, I'm wondering how safe that is, considering you're actually putting multiple servers and, not to forget, all your personal files stored in that device, on the Internet.

I've done a bit a research and ssh access could be hardened using 2-step authentication, but not sure about the other services, unless they all have to go through ssh?

I would appreciate your view on this and other possible ways to make your home NAS secure.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

A NAS is a computer. It has a "smaller" CPU (usually an ARM in the 200 MHz range) but it still runs a "normal" operating system (often a Linux derivative) with all its normal software and assorted vulnerabilities. When a SSH server has a buffer overflow, it is vulnerable, even if the outer box does not "look like" a computer.

To be considered secure, a NAS, just like any other computer, must be managed, with prompt installation of security fixes. This is where the problem lies: contrary to what happens with full-fledge desktop computers, NAS vendors rarely distribute security patches on a daily basis. There is an inherent latency which means that when a vulnerability is found, attackers have a few weeks (or months !) of head start before the fix is packaged and installed in the majority of deployed devices. This is a rather big issue. It turns 0-day exploits into 0-month exploits.

My advice would be to refrain from putting such a device "on the Internet" unless you replace the OS with another one which you control, and offers low-latency security updates (and, of course, you do check them and install them with all due alacrity). For instance, you can install Debian on QNAP NAS.

share|improve this answer
add comment

Don't put on the internet if you don't need it. If you do need it make all the other services only available locally and only allow ssh from the internet. You can then make a tunnel through ssh and access your other services through that tunnel.

Do mind that it is a HOME NAS so better keep it on your LAN.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.