QNAP NAS - Making Your NAS as Secure As Possible

[Music] hello and welcome back and today i want to talk about qnap nas and giving yourself a network security tune-up this video is going to be more about making sure that all of your security settings are as good as they can be and although we're going to cover a lot of information in today's video it has to be said that this is still not everything there's a lot of stuff you can do with a network attached storage device not just qnap but any brand really to really make things triple locked ridiculously safe they're just not going to be in this video maybe because they involve your client devices and again we're talking your windows system your mac system and security settings you can do there or perhaps the security settings that you can do with the router and the managed switch in your network environment this video is about taking care of all of the security internally data security network security access and more within the qnap nas this isn't about the wider environment of your home or office and don't think this video covers everything that it just simply can't there's too many variables there's too many different kinds of user case environment out there and also the majority of today's video is not only just on this nas but it's on this laptop as well and although we will be touching on external connectivity a little the bulk of today's video is about taking care of things within the qnap system without external connectivity because in light of everything that happened recently with q locker i know a number of you have either disconnected your nas from external connectivity with the wider internet or you had no intention of connecting with the internet anyway making sure that nas was something you never use the cloud with so in today's video 90 of the things we're going to look at are things for users so they can either continue to use their nas without connecting to the internet or they want to reconnect their nas to the internet but are worried to do so until all of the security settings are in place so do bear that in mind throughout today's video and if you do follow every single step and you do every single thing that i say in today's video i'm not gonna say that you're bulletproof no one truly is but what i will say is you will have one of the safest nazis out there to your detriment maybe every single time after you've done this when suddenly you realize just how free and loose you were accessing your nas in the first place but without further ado let's make our way on to the qnap nas and go through every single security setting that we can go through and every single one of our configurations that we recommend to make sure this device is as safe as it can be let's make our way to the screen right so a number of you more than likely notice straight away at the top of this video is that the microphone is a lot closer to me today and there's a lot to do with what we're doing with this screen recording also though in the surrounding environment i'm recording in today there's a lot of background ambient noise i'm having a real bugger of a time trying to remove so i apologize in advance if you can hear all of that now today's video is mainly going to cover around about seven or eight points we're going to go through user login settings we're then going to go on to firmware and security the thing that qnap were banging on with after the q locker ransomware stuff which i believe isn't the whole real thing here let's be honest uh two we're going to go into the notification center and go through how exactly the nas can let you know when there's irregularities as quickly as possible then we're going to be looking into application updates and from there we're going to make our way into online services such as taking advantage of the firewall and taking a little bit more of a look at my qnap cloud and how to get an ssl certificate up and running on there but let's start things off immediately with the business of connecting and access now once you've logged into your nas i've installed a bunch of applications here it's worth highlighting that a number of people aren't quite aware that if you go up to the top here and select the options tab from here you can actually change a number of key login sessions now right now i am using the admin account and one of the early things you can maybe choose to do is not use the admin account liberally if you do want to create a new account go into the control panel as you see here on screen make your way into users and you can create a sub user who has a decent amount of control this is a user who has a lot of the access but none of the core damaging access this is a user that you can say has access to certain folders certain applications and just has certain privileges within your system and if there's areas of your data you don't want it to have access to such as a user that has access to configurations but not data or vice versa this is something you can set up here so although i am using the admin account which is technically not really something you should be doing it is gonna make things a lot easier to show you guys a lot of the settings and things to change with this account just bear in mind that after you've done all of these things do head into the control panel and create a new account that you use more day-to-day that doesn't have the power of the admin account unless you actually need it but the options in here that i want you to look at the most are firstly password settings where you can not only have a change of password if you need it but you can set it up that your password is changed on rotation now a number of you i'm sure already want to go into the comments and say oh what happened with cue locker that's nothing to do with this and i agree it's not but this video is about covering all the aspects that most people will be able to understand about changing the security on their system and keeping it as bulletproof as possible so i'm going to cover them all so please be patient so not only can you change the password here but on top of that you can set up lots of login logout rules and probably most important of all enabling two-step verification use an authenticator app like the google authenticator app and create yourself a two-step authentication portal this is when you can't log into the nas unless your phone authenticates it for those who aren't aware using the google authenticate your app set up the app scan this 3d barcode here and then you can set it up that no one can access the nas with that account unless they authenticate it on your phone as well now if you want to do a little bit more about password control head back into the control panel in my case go into the admin scenes you can change the password sure but what you can also do is change a lot of the rules behind passwords you can go ahead and set it so that as far as passwords are concerned that that password has to have certain um rules with regards to characters special characters how often it's rotated and more so these are all things that you can change we'll be coming back into the control panel later on but after looking at the user login and the options menu the next thing we need to look at is this tool security counsellor now security counselor weirdly isn't an app that is available by default on all nozzes it's quite a demanding little app comparatively but it is available to download directly from qnap's website here security counselor allows you to have a one portal viewpoint of your nas and as you add some of the key um protection applications on the nas they all appear here i've installed these manually but all three of these here antivirus malware remover and q firewall they all need to be installed manually although i will add the antivirus does require a license to get the most out of it which again is a bit of a shame there but within the security councillor these are the things you can do so firstly go to the security policy this is where you can decide how strict the nas is about certain security and certain whether it lets certain things through and if you're worried before reconnecting your nas with the internet or with having the nas just generally accessible externally you can change a number of these policies here or you can go to a custom policy that will cover everything and again i could go into all of this like what happens if a password is entered erroneously a bunch of times what happens if a connection comes from a certain source or more the intermediate security policy for example does not allow an internet accessing user to take advantage of my qnap cloud without verifying themselves every single time something i'll show you later on and the same thing goes with scans and more the security advisory you can set it up that you get notified about new security advisories with qts but again not really proactive enough in my opinion but that's a slightly different story now going back to the security checkup if you run the check up here so i'm going to run a scan so as you can see this is now going to run a scan of my nas going by my policy that i've created here and just to see how many of these rules here the nas is adhering to will be shown right now it's already noticed that different things are already in need of change so for example it's highlighting according to my security policy i've still not enabled that the password needs to be changed every 180 days that the ssh port is has a default value so um one of the earliest mentions and again i'm going to keep referring to the bleeping computer article do check it out they do talk a lot about um one of the remedies that qnet recommended is changing the ports um for a lot of external accessing tools uh again media streaming multimedia console that sort of thing and again here is where a lot of those values can be changed and enable it so you're not using the port that everyone would use which potentially could be a problem down the line with the antivirus you can see a lot of these if we like to full screen this a little bit we can see that along with those issues of port connections we can see the push notifications for firmware updates haven't been enabled something we'll talk about later on and the same thing goes to all of this now a lot of these come down to two very preset values one is the idea that ports are all set to default now that's not a huge surprise when a number of these services are set up they need to have a default value and a lot of the time people don't change them because they don't really know what they're doing but if you set a security policy that's particularly strict and you can go higher remember there is another tier higher of security then this will allow you to go through this checkpoint and change a lot of these options and the ports you can change but know what you're doing before you muck around with ports and i don't think i'm going to advise you on this video at least to change those ports without you understanding exactly what you're changing the same thing goes for push notifications do bear in mind that you will need to add either the mobile application for these push applications or a relevant email address something i'm going to show you in a little while in the notification center but as you can see it's saying everything else is fine and of course what you do after this information comes through in the notification center we look at later now in the antivirus the antivirus is available to install for free but it's worth highlighting a number of the key features and again you can create a schedule here a lot of the key features do require a license from mcafee themselves but for now if you are going to install it again this will at least tell you if there's a virus it won't it won't protect you in the same way ransomware will but you can set up this schedule here sorry got a bit of a frog in my throat there so yes you can set up a schedule personally i generally set a schedule every single day normally in the middle of the night when everyone's asleep so i'm going to go with 1am and then on top of that you can add filters which again very bespoke depending on the size of the files if you want um or you can set it up to only do certain things and whether you want them to go into quarantine or not this is something that's quite interesting if a virus is reported or a suspicious file is found by mcalphy you can choose whether you wanted to only let you know only move the file to quarantine or completely remove it but bear in mind that you want to know for certain that it's a virus so i would recommend the quarantine option same goes again as mentioned about if you want it to be a full scan or a partial scan obviously the more data you have the bigger storage array the longer it will take but you can say you want it to be the whole system or just specific files or folders so again i've already ran a scan as you've seen but as things get report you can look at your reports here and the quarantine of course as files get moved will be reported there and you can choose whether to reinstate them or delete them so again nice and simple all going on there but bear in mind as mentioned that with regards to mcafee you will need to have a fully licensed copy of that which you can get through qnap which is good but it's not great given you've already whacked out a bunch of money on your nas i'm sure you'd agree so that's the mcafee they're running in the background we've got that on the schedule next malware remover of course we can run a schedule on the malware remover and that's going to scan there malware remover has its very own ui so if we go for the malware remover tool there we're able to see that while that's scanning there in the background we can set up the settings there again i've set a schedule you can set a schedule there i'm going by 1am again and again you can get it to scan for updates for an updated database all the time and then you can choose whether you want to send the malware results to uh qnap if you have internet connectivity or you can just make sure that in the events log in the q log center you are notified a lot of this will come down to notification center that i will be showing you in just a moment let's come out of that one so coming out of the malware remover there coming out there we can have a look at cue firewall we're going to look at key firewall a little bit more later on but q firewall effectively is the tool for managing um the gateway between internet connectivity and your nas we will as i say go into this in a little bit more detail later on but the security counselor will allow you to um add this to your security policy so when the security check-ups happen um on a schedule you're able to see what needs changing with regards to the firewall moving forward so we've got the schedule there and we'll add uh the security schedule there again 1am 1am at the moment i've got three scans running simultaneously so we can come out of it near so the next thing we need to look at i've already alluded to several times is the notification center in the notification center not only is this where pretty much all of the bits and bobs that nas are doing every single day are reported as you can see there all issues anything that comes with under the heading of the um security policy i've selected will come through there so we're just going to come out of that and from here everything from erroneous ips that aren't known such as here when i've tried to use a dodgy certificate to show it on top of that as when scans take place all of these come under the heading of different alerts and depending on their security they will be displayed slightly differently so as you can see during here when we were i was running a test for a video coming soon i'm showing how to set up the nas without uh utilizing the internet a number of the apps i was using were trying to update even though the nas didn't have internet access at the time it listed these as errors but at least you can see that it does acknowledge those areas but what good are all of these errors if you don't know things are going wrong and this is where this bar at the top is going to come in for example event notification allows you to create rules such as certain things happening such as antivirus scans if something goes right or wrong whether you want to know that backup restoration things have happened effectively letting you know in the event of something going right or wrong what you hear about so if you want to know if the system's being accessed by an ip you don't know if you want to know that a backup routine has failed if you want to know that if malware has been found and or removed all of these things with regards to access with regards to in-house outhouse whatever you look at it with your nas an alert can be created you can even set one master rule to cover all of them or unselect all of them only for the ones that you care about the most so then you say whether you want it to be general information an error or a warning you can say what tier you want it to happen on and then you can say whether you want it to have a message included or excluded so that way if you're dealing with a third-party it guy or it's in-house or just you need more information it can all be added to this specific rule and of course you can make sure that this only happens at certain times a day or will happen as and when from here you can add different alert methods such as email then there's sms but you will need to have a phone carrier um added as well as instant messaging using uh myqnapcloud and social services or the push service with the mobile application again i will talk a little bit more about these in a bit but as you can see nice and straightforward you can add all those in there you have to it's very user specific and service specific but then you can have it so it's sent from to that if you are using an email client you will need to add the email client provider to the nas but again if you go with the push notifications it's less of a problem you can go for push service there and then it will just be sent by a cubot on the nas directly to the recipient which again you can use any one of a number of them there so you can create those um customize alerts and the same goes for alert notifications not just events and again same thing but more tailored towards issues along the way and of course with pairing devices here if we go back to the overview really this allows you to show how to add for example email um accounts for you to get those email alerts sms alerts by adding the phone number but again you will need to add a phone service so it's not as straightforward as you'd like instant messaging of course is if you want to add an im account and there's quite a few to choose from but again you can add the ones such as facebook and skype quite easily there and finally the push service is one that you can use with q manager on your mobile phone so something happens with the nas you then get an alert on your phone to go buzz buzz something's happening according to your um security alerts according let's go through that on the security alerts in let's find out if i just scrolled right on by in the security console again this is very very detailed heavy and by no means am i even considering the stuff i've shown you so far in this video could even approach user friendly but at the same time a lot of the configuration options are there the real problem i find when any like anything like ransomware when hacking happens and again not just a qnap when it happens to any brand a lot of it comes down to not finding out you the end user quick enough and a lot of the things i'm talking about today are about you the user either barring people from entry or improving the ways in which you can find out about these things happening to your device so moving away from the notification center we can now look at app updates one of the other big things the big song and dance is that qnap went ahead with after this event took place is to say that some users didn't update their firmware enough and i know a number of us do feel that that's not really the full story that's not really the whole point of it yes your firmware should be up to date but it's not really as straightforward as that to say to people you need to make sure you've got it all up and running yes like here you can go straight into the settings and yes you can go to the update settings and make sure that it always automatically installs updates for individual apps you can set that up nice and easily and it will force these updates to be installed immediately on a daily schedule as you can see there so it will force those updates as and when you set i think my schedule is something like again 1 am so i can do that one manually but at the same time your system has an even bigger responsibility with regards to firmware updates in the control panel if you go to firmware updates you can see that not only can you check for updates at any given time but also you can go ahead and auto update this is when updates will be automatically applied if they're found to your nas i know a number of users aren't overly keen on auto installing updates as i mentioned in my q locker video this isn't just about qnap nas a lot of people do not want to install the latest update for anything their iphone their windows machine look how many of you have got max are at the top you keep clicking remind me later on an update so you can choose to only install stable versions now these are versions that have already been um kind of version updated so these aren't your sub versions or your betas you can make sure that these are scanned for and updated and it will only update to the stable versions of qts it's still not foolproof for me and i do think that the latest firmware update wouldn't have been enough in this scenario i think it would have gone a long way but still a lot of the things that we've spoken about here would have certainly helped a number of people before their accounts unfortunately were attacked uh their nazis were attacked by q locker and the encryption took place so if we go back into that control panel and from here we click the security panel we can have a look at some of the other options here so the ip access options now here is when if the nas is being accessed remotely you can say how many foul login attempts can result in blocking so for example within one minute at the moment five login attempts means that ip is blocked for five minutes but you can block it quite a long time you can say that if someone tries to log in with within a period of for example 10 minutes with five fouled attempts that can result in a one hour or one day block and then you can configure that with the notification settings and the security um counselor to make sure that you get alerts to your devices to let you know when that happens and that applies to a number of different network protocol here same goes for account access as well but the real good thing is when you can take advantage of um certificates that we'll talk about in the my cloud section shortly this will allow you to create a funneled and encrypted access point remotely with the nas so again this allows more vague um hacking attempts to be blocked we've already talked about password rotation but if we make our way now into the firewall settings from here we can have a little look at things trying to access the nas consistently via the firewall and blocking things before they even get a chance to get through so at the moment i am utilizing basic protection here it lists all the individual ports and again i appreciate things getting a little bit more tech heavy here i would rely for now unless you know better i would rel i would recommend relying on the profiles it has so for example subnets only is effectively a much more closed system within the sub network and restricted security is even more restrictive than that these profiles pretty much will um block anything and everything going through without very very precise activity hence why i went with basic protection which can still be configured if you choose you can say about access to certain ports you can talk about what can go through what can't what protocol can go through but this is when things go into the far more technical range something where i think a lot of people who buy a nas it goes a little bit beyond the expectations of people to know what they're doing and with capture events and the notification settings once again to let you know if when things go through based on those security settings you can go ahead and make sure that you get an alert sent through to you again time managed or not if an ip you don't recognize is trying to log in failed or successful which brings us quite neatly onto qnap's own security and external connectivity my qnap cloud now for those aren't aware myqnapcloud is the means with which your nas can be accessed via the internet without this your nas in theory along i mean obviously you can just disconnect it from the internet but this is the throttle point this is meant to be what stops someone getting into your nas now setting up a my qnap cloud account is very very easy almost too easy one of my earliest complaints in my previous video where i talked about q locker and one of the many things qnap could do to stop people getting in was to do with if you look at services such as playstation or xbox um or even a lot of android phones you can't access the online services or some or all of the online services unless you update to the latest firmware now as restrictive as that sounds in the case of qnap if so much of the problem as they say was to do with um the firmware not being the latest version which again a number of us do ponder and wonder about um then they shouldn't allow people to maintain external access without the latest firmware now that's not the only restriction and that's not the only thing you can change so for example advanced auto router configuration will allow the nas to communicate and set up a upnp um access with port forwarding on your router easily for you so it does that utilizing my qnap cloud as a bouncing point but again it's i even though i'm enabling it here by default it's not enabled and i think a number of you won't need it really so if you do utilize the upnp port forwarding via my qnap cloud know that this is where a lot of the problems of those nas ports arose from so do bear that in mind now the my ddns settings is where you talk about how you bounce from the qnap cloud to access your nas one of the things that's quite interesting of course is because the ssl certificate which you can pay for a qnap certificate or get a completely free one from let's encrypt nice and simple that means that when you try to access your nas remotely such as in the case of this nas if we go into this one here and we'll access the nas remotely so let's go into the overview even from here we can see that this is our external connection we've created with my qnap cloud if i copy that open a new tab and log in the first thing it's going to ask me to do is verify who i am because as far as my security credentials are i'm anonymous i've not identified myself and it forces me to have to log into the nas with my my qnap cloud account here which again it doesn't fully solve the problem but at the very least it does restrict access and forces them to use pre-designated routines uh emails password login information rather than relying on a backdoor policy there and again a lot of this is about having layers as many layers as possible and as many unique layers as possible and those ports are only a small part of it the my qnap cloud you can see it's you can set it up with access to credentials and as long as you've got the two-step verification locally working in conjunction with the ssl certificate which again all that's doing is allowing encrypted remote access it doesn't act as a means of restricting access remotely it's still better than nothing with regards to allowing or if you've ever used a connection remote access to your nas making sure that a lot of the security information wasn't captured along the way but again a lot of today's video once again has been about adding as many layers as possible to your security protocol the big takeaway of this video that you guys need to take on board right now is if you don't feel that your qnap nas is safe online get it offline get it working on the network it works perfectly fine on the network on its own and when you are ready to reconnect the internet when you are ready for all of your settings to be as safe as you want regardless of just how heavy going you want to make them then at least you have the option to do that before you reconnect but as i mentioned at the start of the video once you access everything to the highest security settings do know that you are going to encounter friction you aren't going to have the smooth sailing access that you once had you can't have a hundred hurdles and a 100 walls between you and the outside world and then be surprised that logging in can be a right old bugger thank you so much for watching i do hope that we see some more resolution to cue locker very very soon this video unfortunately is going to be far more beneficial to those of you that weren't impacted by it and just want to make sure that they've ramped up their security if you were a victim then do talk about it in the comments maybe you've had a resolution maybe you've learned more it's always great to share this with other users along the way thank you so much for watching do enjoy this i've got another video coming soon where i'm going to look at backup routines snapshots and more so you can bulk up your backup routine in case something like this happens again click like if you've enjoyed the video subscribe to learn more i'm going to get a drink of water before my throat gives out and i will see you next time

Channel: NASCompares

Views: 22,610

Keywords: NAS Server, NAS Drive, NAS Guide, QNAP HACK, QNAP NAS HACK, QNAP QLOCKER, QNAP VIRUS, QNAP HACKING, NAS RANSOMWARE, NAS VIRUS, NAS DRIVE HACK, NAS BACKUP, BEST NAS BACKUP, BEST NAS FOR BACKUPS, NAS COMMAND INJECTION, QNAP STOP QLOCKER, QNAP UPDATE, ARE QNAP SAFE, ARE NAS SAFE, QNAP Network Security, QNAP Disconnect from internet, Disconnect NAS internet access, QNAP NAS Security, Keep QNAP NAS Secure, Keep NAS Secure, QNAP NAS locked, QNAP NAS configuration

Id: hUxieCdHyVg

Length: 32min 38sec (1958 seconds)

Published: Tue Apr 27 2021