We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption and by default the NAS provides anonymous read-write access via Samba. Setting up user/group restrictions is no problem with the web interface, nor is deactivating the integrated media server etc., but encryption is not officially available.
However, since it runs on Linux (see e.g. here) and it is not too difficult getting root access via LAN I can modify the setup to our needs. So here's my idea of our requirements:
- Encrypt the data on the NAS
- Decryption must require external information (since anyone with LAN access can hack into the root account abusing the firmware mechanism...), so I can't e.g. simply share an automatically mounted TrueCrypt volume
- Ideally, no additional steps to the samba authorization would be required
I was also considering setting up and LDAP server on the device while we're at it, so maybe that authorization can be combined with decryption somehow. If that is not possible, having to temporarilly mount the decrypted volume via SSH plus some timeout would also be acceptable.
What is a typical solution to this?