Best way to configure a NAS for the safest, most reliable (as in will not become unusable, not necessarily worried about potential downtime) and least succesptible to ransom? reddit / selfhosted ---------------------------------------------------------------------- hdddanbrown · 2023-11-15 11:25 Wtf ---------------------------------------------------------------------- Trashrascall · 2023-11-15 11:28 Why wtf? I'm tryna self host here buddy ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-11-15 11:34 Don't expose it to the Web, use Snapshots of volumes to provide local protection (so you can roll back), then ensure you use some offside back-up.. and make sure you regular test restoring that data (don't assume a backup is good, just because the software reports "success") ---------------------------------------------------------------------- hdddanbrown · 2023-11-15 11:35 Maybe think of a proper question and not something as broad and pointless as "best way to configure a nas" ---------------------------------------------------------------------- Trashrascall · 2023-11-15 11:38 Lol too subtle for you I guess. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 11:50 How much storage would you suggest? Do I literally e⁴my projected usage to store different snapshots? I would just configure it so that it's only accessible on the LAN then? Would I be able to use this to backup something like MS exchange or OD? Apogies for the many questions I am trying to efficiently impliment a solution for some urgent file retention issues at work and am planning out my research deep dive. But we also are constantly targeted and a subsection of our staff is very susceptible to phishing, unfortunately (we are pushing training though.so fingers crossed it.takes) ---------------------------------------------------------------------- JaJe92 · 2023-11-15 12:10 If you want maximum protection at paranoid level, have a different disks with a schedule time when to be connected to the network just to do the snapshot and then disconnect from the network and be completely isolated. If you ever get hit by ransomware, just don't have the snapshots in the network at all and hope to not get hit exactly when the snapshot process is running at that time. ---------------------------------------------------------------------- ElevenNotes · 2023-11-15 12:45 3-2-1-1-0 backup rule and you don't have to worry about randsomware. Can't encrypt what is offline. ---------------------------------------------------------------------- mxafi · 2023-11-15 13:08 Assuming you actually want a NAS and not cold storage, I’d recommend at least some kind of raid to account for disk failure. As for ransomware protection, one decent solution is snapshots and limiting every client to only be allowed access to their own backup directory, or a limited set of directories in general on the NAS, as well as no execution permissions in those directories. If you’re concerned about the NAS being directly infected by a malicious user with direct access and execute permissions, the only real solution is offsite or cold storage backups. ---------------------------------------------------------------------- from-nibly · 2023-11-15 13:13 If this is for a company I would look into ceph. There are some vendors that will help set it up like 45drives With ceph you would have 3 servers with identical drive space. You can have redundancy (not backups) that would withstand a whole server just dying but it only costs 1.5 times the space. Take snapshots like had been said before to protect against other machines that mount the volumes being hijacked. Take offline backups of the volumes to protect against the ceph nodes from being hijacked. I think though because of the way ceph works if someone hijacked only one ceph node it would treat it as down and rebalance and wouldn't actually compromise the disks. (don't quote me on that) As was said before 3-2-1. 3 copies, on 2 different media, 1 in a different location. The system you choose is NOT the thing that keeps you safe, it's your practices. ---------------------------------------------------------------------- OhMyForm · 2023-11-15 13:14 There’s a bunch of people in this thread, who seem a little bit too goofy to figure out that you were just asking how did defend against RansomWare basically find something that uses snapshots ---------------------------------------------------------------------- OhMyForm · 2023-11-15 13:15 Furthermore, if you use something like true nas it has that using something called ZFS and then if you use Samba, you can turn on something called shadow copies where you can look into history and pick out old versions of the file system ---------------------------------------------------------------------- from-nibly · 2023-11-15 13:19 Also here's a good article on different backup strategies https://www.backblaze.com/blog/whats-the- diff-3-2-1-vs-3-2-1-1-0-vs-4-3-2/ ---------------------------------------------------------------------- clarksonswimmer · 2023-11-15 13:33 Garbage in, garbage out. Try thinking about the problem you're going to solve before asking vague questions and hoping for good responses. ---------------------------------------------------------------------- TopdeckIsSkill · 2023-11-15 13:50 we're talking about a diy nas or a sinology one? ---------------------------------------------------------------------- [deleted] · 2023-11-15 13:57 [deleted] ---------------------------------------------------------------------- matt95110 · 2023-11-15 13:58 Maybe you could try encrypting a volume that you will only use for backups and leave it unmounted when you aren’t using it? ---------------------------------------------------------------------- ProbablePenguin · 2023-11-15 14:00 >Specifically interested in whether raid makes any sense if down time is not a concern and as stated in the title. It depends how difficult it is to build back the backup history if a drive fails, is it an issue if your backups suddenly 'reset' to no backups? >how to safeguard the NAS from malicious access if individual users on the network are compromised. First step is partitioning access, if a compromised user only has write access to a few specific shares, then that's all they could potentially damage. Snapshots are another good option, as is an online backup to Backblaze B2 or similar. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-11-15 14:30 I would say if this is for business, your asking in the wrong place - My advise is you need proper expert guidance. If your not experienced or confident enough in these areas, then the responsible thing to do, is to bring in a bit of outside help - Search for a local IT MSP... they can sit down and get a proper understanding of your issues, and they will also be able help you procure, and either manage the systems for you, or give you the necessary training. Being good at IT, is mostly about knowing how to tackle an issue - an that includes, ensuring you have a proper safety net, that you can escalate stuff to... ---------------------------------------------------------------------- contherad · 2023-11-15 14:33 Best way to configure a NAS is with backups. ---------------------------------------------------------------------- BloodyIron · 2023-11-15 14:48 Subtlty has nothing to do with it. The question is logically unanswerable as the scope and breadth is impossible to be answered just for a single question. If you want to know how to configure a NAS [boy do I have some information for you](https://www.truenas.com/docs/). Temper yourself, in addition to the original question, your response is really not working in your favour. ---------------------------------------------------------------------- Gredo89 · 2023-11-15 15:29 Never heard of ceph. If I understood correctly, ceph is like a Multiserver RAID-5, correct? ---------------------------------------------------------------------- mnopw · 2023-11-15 15:49 Ceph is too complex for the use case. ---------------------------------------------------------------------- mnopw · 2023-11-15 15:51 Make sure to have dedicated admin accounts with strong passwords. Deactivate what you don't need. Use an FS that supports snapshots and automate snapshot creation (e.g. x with a month y with a week z with an hour of retention). ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:04 I've heard this response a couple of times, and while well intentioned, it's really not helpful. MSPs are expensive. We are a small organization with a low operating budget. We have a volunteer consultant to help me with some things and a handful of contracted msp hours, but those go fast. I'm plenty comfortable tackling issues, I just like to use reddit to determine the gaps in my knowledge about a subject (because people are often blunt af on here in the IT subspace) and guide my research. That way if we need to use the IT service or when K have time with the consultsnt I can maximize the value of my time with them. Nowhere did I say I have no outside help, I am just operating within budgetary constraints and trying to get the ball down the field before I pass it off. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:08 Am implementing 3-2-1 but still trying to figure out the best options. Especially for something we can use to restore data relatively easily. What do you think about the reliability of having accounts backup to the NAS and then just using cloud backup for the NAS itself? That would subvert some of the bloated licensing costs, but I am somewhat concerned about things getting lost in translation. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:10 Any advice on the '0' in practice? What's the best way to ensure the files are free of error? ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:10 Thanks! ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:11 That's genius. What do you use to control access timing for each disk? ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:16 Did you read my question or just the title? There's too much fn gatekeeping in the IT reddit and I'm not here for it. He could have asked a follow up question or asked for clarification. He came hot out the gate the response was tempered enough. In real life if you go around talking to people like that you either lose your job or get smacked. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:26 Thanks man, I really appreciate it. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:27 Smart ill get a other NAS to backup the NAS then. ---------------------------------------------------------------------- from-nibly · 2023-11-15 18:39 ceph is a lot more than raid5 on multi server. It's like the closest thing to cloud storage I've seen. It has the ability to create multiple types of volumes (block, multiwrite, and object (s3)). You can mismatch your drives within a single node, as long as you match them between nodes. I use it through rook on my home kubernetes cluster. I can yank a drive out of the running server while streaming stuff on plex (or writing to the filesystem) with 0 consequences. (This is NOT advice, there's probably a way you could break stuff doing this, but I haven't yet) It's got snapshots built in, you can dynamically expand the storage without having to recompile anything. and it's incredibly resilient to idiots (myself) (also not advice) ---------------------------------------------------------------------- from-nibly · 2023-11-15 18:42 possibly, but it would take care of, - snapshotting - redundancy - expandability All in one go. but he's suggested that budget is a big concern, so you are probably right. It's what I use on my home k8s cluster and it let's me buy sketchy drives off ebay, for really cheap. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-11-15 18:49 >I've heard this response a couple of times, and while well intentioned, it's really not helpful. MSPs are expensive. I started as a developer in a small company, who had no IT, so it got left to me, so I understand, finding places to sound out ideas is important. But you were asking specifics about your sizing etc (in a now deleted post), which will be scenario specific, and the reason I mentioned the MSP, as nobody here would be qualified to answer than, without having a good examination of the exact requirements. Also more generally, you'll find certain subs, such as selfhosted, homelabs, datahoarders etc, you'll get some pushback... cause they're hobby-focused. If you want some good places to actually get some input, then I'd highly recommend https://community.spiceworks.com ---------------------------------------------------------------------- BloodyIron · 2023-11-16 02:50 Dude, you accuse me of gatekeeping without knowing the first thing about me. If you bothered to actually even know who I was, you would know that I teach others constantly. I'm not talking about gatekeeping, I'm talking about asking **actually good questions**. There's 100% a difference, and you sure as fuck need to learn it. Because if you can't ask good questions, regardless of the topic, you will not find information.