Running a NAS, Part 6: Sharing and Remote Access

Tuning the NAS Network (Part 5 of Running a NAS) set how fast data can cross the wire. This part covers what travels over it, meaning the protocols that turn a NASNetwork-attached storage is a storage system that gives other computers access to its files over a network.’s disks into shares, the ways to reach the box from outside the house, and the settings its makers publish against the ransomware campaigns that went after QNAP and Synology machines.

Protocol sections here lean on the makers’ own documentation and on standards text. The ransomware history rests on QNAP’s and Synology’s statements about their own products, so it says what each maker found and not how many NAS were hit. How SMB Multichannel lets one client use more of a fast link belongs to Part 5. Here the questions are which protocol a client should use, what it exposes, and what to leave switched off.

Why SMB1 is off and what replaced it

Server Message Block (SMB) is the protocol Windows uses to share folders, and nearly every NAS offers it first. According to Microsoft, SMBv2 and later protocols superseded SMBv1 starting in 2007 and that it publicly deprecated SMBv1 in 2014. SMBv1 stopped being installed by default with Windows 10 version 1709, and its current guidance says SMBv1 has significant security vulnerabilities and isn’t installed by default in any edition of Windows 11 or in Windows Server 2019 and later.

That danger was concrete. CISA’s May 2017 analysis of WannaCry found that its dropper spread through the MS17-010 EternalBlue exploit of SMBv1.0.

NAS software followed Windows. Samba 4.11.0, released September 17, 2019, changed the defaults of both client min protocol and server min protocol to SMB2_02, which turned SMB1 off, and Samba’s current manual still lists SMB2_02 as the server default. Synology strongly advises against SMB1 in DSM because the protocol has known security issues related to ransomware and other malware. A device that only works with SMB1 is one to update or replace, not a reason to turn the protocol back on.

Signing, encryption and the guest-share break

SMB signing puts a signature holding a hash of the whole message in the header, so a message tampered with in transit no longer matches its hash. Algorithms improved with each generation. SMB1 signing used MD5. SMB 2.02 moved to HMAC-SHA-256, and SMB 3.0 added AES-CMAC. Signing also runs automatically as part of pre-authentication integrity, which prevents downgrade attacks. A long, complex, nondictionary password also strengthens signing and encryption, because the session key is derived from it.

Windows now requires it. In Windows 11 version 24H2 and Windows Server 2025, every outbound and inbound SMB connection must be signed by default. Microsoft warns that this can block connections to workgroup computers, guest-authenticated shares and third-party SMB servers that don’t support signing, and it tells admins not to disable signing to work around those failures. Guests get the same treatment. Windows 11 Pro no longer permits SMB client guest connections by default, and guest logons don’t support signing or encryption. A NAS share open to everyone therefore stops working from a current Windows PC, and the better fix is a user account on the NAS, which keeps the share signed.

Encryption is a separate switch. SMB Encryption covers SMB data end to end and protects against eavesdropping on untrusted networks, and it can be set per share or for the whole file server. SMB 3.1.1 negotiates AES-128-GCM by default, and Windows Server 2022 and Windows 11 added the AES-256-GCM and AES-256-CCM suites. How SMB Multichannel lets one client use several links is in Part 5.

NFS suits Linux clients

NFS is the Unix-side counterpart to SMB. The NFSv4 specification folds file locking and the MOUNT protocol into NFS itself and says port 2049 should be the default, so a client doesn’t need the RPC binding protocols and NFS can cross firewalls. It requires implementations to support RPCSEC_GSS for stronger security, but deploying it is optional.

On the client side, with no version option the Linux client tries version 4.2 first and negotiates down until it finds one the server supports. Depending on kernel configuration it may support versions 3, 4.0, 4.1, or 4.2. Synology’s NFS service is for Linux clients, and it supports NFSv2, NFSv3, NFSv4 and NFSv4.1. A ZFS server in an NFS environment is one of the cases for which TrueNAS recommends a separate write-log SSD, which Part 4 covers.

iSCSI shares a disk, not a folder

The IETF’s iSCSI standard describes a transport protocol for SCSI that works on top of TCP. Where SMB and NFS present folders, iSCSI presents a block device, and the client puts its own filesystem on it.

That limits who can use it. TrueNAS’s older user guide says that with a traditional filesystem on an iSCSI block device only one initiator at a time may have read/write access, or the result is filesystem corruption. Synology tells admins who allow multiple sessions to one target to use a shared or cluster file system such as VMFS or OCFS. An iSCSI target works as a disk for one machine, a virtualization host for instance, and a folder that several PCs open is a job for SMB.

Time Machine wants SMB

Time Machine can back up to a third-party NAS that supports Time Machine over SMB, so the NAS has to offer that, and its spec page is the place to check before buying. Backups over the older AFP protocol are not recommended and aren’t supported in macOS 27 or later, according to the same page, and Apple’s Mac guide says to use SMB when given the choice between SMB and AFP.

For a Mac that means SMB, because Time Machine needs it.

Reaching the NAS without opening it up

The risky way in is a router rule that forwards the NAS’s admin page to the internet. DSM’s default web ports are 5000 for HTTP and 5001 for HTTPS, and QNAP’s management ports are 8080 and 443 by default. On January 26, 2022, QNAP said DeadBolt was widely targeting NAS exposed to the Internet without protection. It told owners to disable port forwarding for those management ports and to turn off UPnP port forwarding in myQNAPcloud’s Auto Router Configuration. Options below reach the box with those pages kept off the internet.

Vendor relays

Both big NAS makers run a relay. QuickConnect lets client apps reach a Synology NAS over the Internet without port forwarding rules. Synology’s white paper describes the order as LAN or WAN detection first, then hole punching, and last its relay service for any NAS not reachable those ways. A relayed connection may be slow because of longer network latency. QNAP’s myQNAPcloud Link reaches a NAS through QNAP’s servers without exposing it to the internet, and it can be slow during peak usage. These services put a vendor in the path and can cost speed. Unraid Connect’s Remote Access is not a relay. It publishes the Unraid WebGUI to the internet through UPnP or a manual port-forwarding rule on the router, and Unraid’s own page tells owners who want remote management without that exposure to prefer its official Tailscale integration.

VPN

A VPN puts the remote device on the home network, so file sharing works as it does indoors. Synology’s VPN Server package supports PPTP, OpenVPN and L2TP/IPSec, and its help page lists no WireGuard. QNAP’s QVPN Service supports QBelt, PPTP, L2TP/IPSec, OpenVPN and WireGuard. Unraid has WireGuard built in, with one connection type that reaches the server’s WebGUI, Docker containers, VMs and shares and another that reaches every device on the LAN. Unraid’s documentation points most owners to Tailscale and keeps WireGuard for detailed control over VPN routing, or for server-to-server and LAN-to-LAN links that don’t rely on a third-party service. In the WireGuard protocol description, a server does not respond at all to an unauthorized client, and every packet travels over UDP. One exposed port is a UDP port that gives a scanner nothing to talk to.

Mesh VPNs

Mesh VPNs such as Tailscale and ZeroTier connect devices directly when they can and relay when they can’t. Tailscale’s documentation puts direct, DERP-relayed and peer-relayed connections all under end-to-end WireGuard encryption, with performance as the difference rather than security, and adds that a DERP relay cannot decrypt traffic because private keys never leave the device that made them. ZeroTier draws the same split, with all traffic encrypted end to end, most of it peer to peer, and free but slow relaying for devices that can’t connect directly. When UDP is blocked its agent falls back to a TCP relay.

Tailscale’s Personal plan is free for non-commercial use such as a homelab or a home VPN. One Tailscale device can also serve as a subnet router, a gateway that advertises the home network’s routes to the rest of the tailnet, so a remote laptop reaches devices at home that have no Tailscale client of their own.

Headscale is an open-source, self-hosted implementation of the Tailscale control server, scoped to a single tailnet for personal use or a small open-source organization. NetBird is another option built on WireGuard. Its documentation describes peers that connect over encrypted point-to-point WireGuard tunnels, a relay for pairs that can’t connect directly that cannot decrypt what it carries, and a management service that runs in NetBird’s cloud or can be self-hosted.

On the NAS itself, Tailscale’s Synology page says the package in Synology’s Package Center is no longer supported and points to a manual install of the DSM package. Its NAS page lists the QNAP App Center and TrueNAS as places to get an official app, and it uses the name SCALE for the TrueNAS line. TrueNAS has since unified SCALE and CORE as TrueNAS Community Edition, which Part 1 covers. Unraid’s documentation describes an officially maintained Tailscale plugin in its Community Apps tab, with native certificate support in Unraid 7 and newer. Unraid can also put a single Docker container on the tailnet as a device of its own, which shares that one app without exposing the whole server.

Tunnels

Cloudflare Tunnel is the reverse-proxy-style option. Its cloudflared daemon makes outbound-only connections to Cloudflare, so the resource needs no publicly routable IP address. Twingate routes a user’s device to resources on a network through a Connector deployed on that network, and it also uses outbound-only connections. Its Connector needs only outbound internet access, and Twingate calls inbound access to the Connector host neither required nor recommended. A tunnel removes the open port but not the login page behind it, which is why the account settings later in this part still apply.

What the ransomware campaigns got in through

Makers that investigated these campaigns name a guessed login, a known flaw nobody had patched, or an exposed box as the way in.

QNAP’s statement of July 12, 2019 said eCh0raix was targeting QNAP NAS to encrypt data for ransom, and its August 12 advisory said devices with weak passwords and outdated QTS firmware may get infected. Synology’s July 23 statement traced the attacks on its own NAS, launched July 19, to dictionary attacks instead of specific system vulnerabilities. Attackers had collected admin passwords by brute force. Synology’s PSIRT saw the same pattern on August 4, 2021, with a botnet it believed was driven by StealthWorker and no sign of a software vulnerability being exploited.

Qlocker and the backup app flaw

Qlocker, which began the week of April 19, 2021, differed from eCh0raix. QNAP says it exploits CVE-2021-28799 in certain versions of the HBS 3 Hybrid Backup Sync app, and that once a NAS is infected the ransomware moves files into password-protected 7z archives. Fixed builds start at HBS 3 v16.0.0415 on QTS 4.5.2. A second QNAP advisory describes the flaw as improper authorization that lets remote attackers log in to a device.

DeadBolt struck through exposure, then through a flaw

DeadBolt shows both causes. The January 2022 wave hit NAS exposed to the internet without protection, as noted above. QNAP detected a new campaign on September 3, 2022, aimed at NAS running Photo Station with internet exposure, and tied it to CVE-2022-27593, fixed in Photo Station 6.1.2 on QTS 5.0.1.

Synology’s October 2026 case

On October 29, 2026, the company said threat actors were exploiting a vulnerability it had already patched to encrypt data on devices running outdated DSM versions, and it urged users to update immediately and to enable automatic updates. Its statement points readers to Synology-SA-24:20 and does not say which flaw in that advisory was used. CVE-2024-10441 in it is a remote code execution bug with a CVSS3 base score of 9.8. For the DSM 7.2.2 line the fix is 7.2.2-72806-1 or above, and the advisory gives no mitigation other than upgrading.

Three causes run through every campaign

Guessed passwords, unpatched software and an exposed management page are what the makers’ own statements point to in these campaigns. Synology put its 2019 wave down to dictionary attacks instead of specific system vulnerabilities, and in 2021 its PSIRT saw no indication of a software vulnerability being exploited. That is the reading of the statements, and it points to a short list of settings.

Settings both makers tell you to change

Synology’s and QNAP’s published guidance lines up closely.

Synology’s 2019 advice also listed turning on Snapshot, which keeps copies and locks nothing. Whether a given model still receives updates is a question for Part 1, which compares how long each maker supports its products, and for Part 9, which says to check a used unit’s status page before buying. Applying updates safely is covered in Part 8.

Each campaign maps to a row. Guessed passwords are what the admin account, Auto Block and 2-step rows address, while the Qlocker, DeadBolt and C3RB3R flaws are what the updates row and the reachability row address.

The same settings on six more systems

Synology and QNAP aren’t the only makers that publish this advice. Each of the six systems below says in its own documentation what to do with the default account, failed logins, exposure, a second factor and updates. Part 1 covers each system’s versions and how long it is supported.

Most cells are filled. The three dashed ones mark a setting a system’s docs leave out. TrueNAS and OpenMediaVault describe no lockout after failed logins, and Unraid describes no second factor for its web login, though it does cap web logins at 3 tries before a 15-minute wait. Where a cell is empty, the settings that remain, keeping the box off the internet above all, have to cover the gap.

TrueNAS

TrueNAS’s documentation tells owners to create their own administrator account with a unique name and then turn off password sign-in for the built-in root, admin and truenas_admin accounts. Fresh installs since 24.10 name the default administrator truenas_admin rather than admin, and iXsystems says root access will be switched off for good in a later release. Its SSH page calls signing in as root a security vulnerability and says to leave SSH off unless outside connections need it.

On exposure, the project says to run TrueNAS without direct exposure to the internet and points to Tailscale, ZeroTier and WireGuard apps for reaching it from outside. Its security recommendations keep the web interface and IPMI on private subnets, and the Allowed IP Addresses setting limits the web interface to one address or a subnet. Two-factor sign-in uses time-based one-time codes and can cover SSH too. The Update screen offers automatic or manual updates, and flaws are posted on its Security Advisories site. The docs describe no lockout after repeated failed logins.

Unraid

Unraid asks for a root password the first time its web interface opens, but its security fundamentals page notes that it enforces no complexity rules, so the strength of that password is the owner’s job. Since Unraid 6.9.2 the web interface allows 3 login attempts per IP address before a 15-minute cool-off, a limit that covers the web login only and not SSH or Telnet. Unraid 7.2.0 added a countdown on the login page for a locked-out user. The docs describe no second factor for the web login. The same fundamentals page says never to put the server in a network DMZ and to forward only the ports you understand and need.

For getting in from outside, Unraid’s docs prefer the Tailscale integration covered under mesh VPNs above, because it keeps the web interface off the public internet. Unraid Connect is the other route, and signing in to its dashboard exposes nothing by itself; only its Remote Access setting does. Updates start by hand from the web interface. Lime Technology posts security fixes in its release announcements, and its 7.3.4 post asks every user to update for them. In January 2025 it disclosed a critical cross-site scripting flaw in the web interface that could give code execution as root, fixed in 6.12.14 and 7.0.0.

OpenMediaVault

OpenMediaVault ships with a known web login. Its installation guide gives the default user as admin with the password openmediavault, so changing it is the first job after setup. Its FAQ shows how to give another user administrator rights by adding them to the openmediavault-admin group. Root can sign in over SSH by default, and the SSH page says to turn that off after installation. If SSH has to be reachable from the internet, the same page says to forward a port other than 22 and to use public keys with password and root logins off.

The web interface has its own firewall panel, and the system checks for updates daily, emails a notice and installs security updates without being asked. A second factor came late. OpenMediaVault 8.5.0 added an authentication framework for the web interface, and the openmediavault-2fa-totp plugin built on it gives time-based one-time codes for authenticator apps. The docs say nothing about blocking repeated failed logins.

UGREEN

UGOS Pro has the owner create the administrator account at first setup, so there is no preset admin name to guess, and the same setup offers to install important updates automatically. UGREEN’s security guide advises a standard user account for everyday file access and keeping administrator accounts for administration. From UGOS 1.10.0.0092 the Security page can block an IP address after a set number of failed logins in a set time.

The same guide says not to expose SMB, NFS, SSH or the management interface directly to the internet. Its firewall guide recommends an allow list with Deny Access as the default for everything else, and its SSH guide says to reach SSH through a VPN rather than a forwarded port. UGREENlink is the built-in way in from outside and needs no port forwarding. For a private network, UGREEN points to Tailscale running in Docker, which the DH2300 can’t host because it has no Docker. Two-factor sign-in uses time-based codes from authenticator apps. UGREEN’s disclosure policy says it publishes flaws on its website once a fix exists, but no advisory list or ransomware statement turned up.

Asustor

Asustor’s ransomware guide says to disable the account named admin and make a new administrator with another name, to turn off SSH and SFTP when they aren’t needed, and to keep ports closed for services used only at home. ADM Defender, which arrived with ADM 5.0, holds the firewall profiles, and ADM 5.0 reached every supported model on May 21, 2025. Its automatic blacklist blocks an address after too many failed logins in a set time, a trust list exempts known addresses, and risk IP detection blocks addresses listed in the AbuseIPDB database.

EZ Connect reaches the NAS through an ezconnect.to address with no router setup, but turning on a Cloud ID also switches on EZ-Router, which sets up port forwarding by itself. ADM’s VPN page can run the NAS as a server for WireGuard, OpenVPN, L2TP/IPsec or PPTP instead. 2-step verification adds a code from an authenticator app. Asustor posts numbered security advisories.

Two of those advisories cover DeadBolt. AS-2022-002 says the attacks on Asustor units began on February 21, 2022, encrypted files with a .deadbolt extension and replaced the ADM login page with a ransom note, with fixes in ADM 4.0.4.RQO2 and 3.5.9.RQO2. A second wave began June 10, 2022, and AS-2022-008 fixed it in ADM 4.0.5.RUE3 and 3.5.9.RUE3. Neither advisory names the way in. Asustor’s March 2022 notice asked owners to update ADM, refresh their backups and change their ports.

TerraMaster

TOS has the owner set the administrator name and password during setup, and TerraMaster’s security advice says to disable the default admin account, make a new one with a strong password, and turn off RDP, SSH and Telnet when they aren’t in use. It names 5443 and 8181 as the default HTTPS and HTTP ports and says to change them. Its data protection page adds that attackers try the default admin account first, warns against names such as admin and administrator, and says not to publish the tnas.online link or turn on a DMZ host.

The Security page in TOS has Auto Block, which blocks an address after a set number of failed attempts for a set time. Its firewall makes no deny rules by itself, so an address outside the allow list can still connect until one is added. Security Isolation Mode accepts requests only from the local network segment, and TerraMaster calls it a strong tool against sudden ransomware attacks. It arrived with TOS 5 on June 13, 2022. For remote access, TNAS.online connects without port forwarding through a TerraMaster account, while DDNS access needs a forwarded port first. TOS has OTP two-factor verification through the TNAS Mobile app, and a device marked as trusted skips the code on later logins. The company says it updates TOS regularly with security fixes and asks owners to update and turn on notifications.

TerraMaster publishes no advisory list. In a statement of September 24, 2019 on flaws a security firm had reported, it told anyone still on an old TOS version to update at once. A later flaw tracked as CVE-2022-24990 let a remote attacker read the administrator password with one request to TOS 4.2.29 and earlier, and CISA added it to its list of exploited vulnerabilities on February 10, 2023.

What these settings don’t give back

None of these steps restores a file that is already encrypted. That takes a copy the NAS cannot overwrite.

Part 7, Apps and Backing Up the NAS, covers the containers and app stores that add services to a NAS, the snapshot, replication and backup tools that keep those copies, and the locks that stop ransomware from deleting a backup.