Advice on encryption, usage, security

[jlloyd28564932]

I've got a T6-423 setup with 6x 12GB, I've set up a single pool on RAID6 for double redundancy - as of yet I've not transferred any of my data to it, still evaluating my options and the hardware.

This device will live on my "internal only" network with a very limited set of ports/permissions and likely MAC address locked to known PCs.

I'm keen to encrypt my data. Previously I have used LUKS underlying the operating system and no stored credentials - ie I need to physically enter the passcode when turning on a device. This suits me well (my current solution is LUKS/ext4 DAS based).

I see TOS does not support full disk encryption, though it does support eCryptFS for encrypted shares with its limitations (no password changing, ever, no decryption only copying, I presume filename restrictions of 143 characters still). This might be fine, but what if the physical NAS is stolen - are the eCryptFS keys stored on the device or are they manually entered to decrypt once per session?

If anybody uses encrypted shared folder on TOS I'd be interested in hearing your viewpoint.

If the reports are correct the OS is stored on a USB key - so another thing I thinking of evaluating is removing that and installing TrueNAS and seeing how I like that on the TS-423. If anybody has tried that what is the system cooling like (as I know TrueNAS can struggle to control fans in a sane fashion).

***Any advice welcome***

No doubt in a few days I'll actually commission it. Only once I'm happy you understand. My current feeling is that I like the HW, but I'll find the OS a little restrictive.

[jlloyd28564932]

Obviously I recognize that nothing is truly safe.

But do what you can, and don't be the low hanging fruit...

[Gremlin]

If the reports are correct the OS is stored on a USB key

- Which the reports are wrong about.

The OS is stored on a multi-disk Raid-1 array (Covering all HDD so, in your case x 6). The USB stores nothing and is only used in the event of a diskless boot or a failed OS boot. When TOS 6 can be clean installed that arrangement might be configuable but, as of now, it isn't. If you dig down you will also find a raid-1 swap partition and, likewise, an initboot partition. This is so any installed HD can boot the nas and run. In the older models the default disk to boot (in the event of issues) is slot 1. Not sure about later models with 6+ slots and/or nvme.

[jlloyd28564932]

If the reports are correct the OS is stored on a USB key

- Which the reports are wrong about.

The OS is stored on a multi-disk Raid-1 array (Covering all HDD so, in your case x 6). The USB stores nothing and is only used in the event of a diskless boot or a failed OS boot. When TOS 6 can be clean installed that arrangement might be configuable but, as of now, it isn't. If you dig down you will also find a raid-1 swap partition and, likewise, an initboot partition. This is so any installed HD can boot the nas and run. In the older models the default disk to boot (in the event of issues) is slot 1. Not sure about later models with 6+ slots and/or nvme.

Interesting, I'll pull it, image it and have a look. In that case as long as there is any kind of conventional BIOS I should be able to install my own OS on a different USB key - and if that fails I can put the old one back. Obviously I would lose any kind of warranty if I do that - fair enough.