[Help] Encrypt disks/volumes

[krissan]

Hey @TM Support,
I just have purchased F6-424. On webpage: https://www.terra-master.com/global/pro ... u&mid=1588 , You claim that there is "AES Volume and Shared Folder Encryption" YES. But how to do it (4disks TRAID+ ideally)?
I tried directly form SSH using

Code: Select all

cryptsetup

and

Code: Select all

luksFormat/Open

, but it did not work.
I tried multiple scenarios of LUKS encrypting Disk/Partition/LVM, but no luck.
How to consume this feature you are advertising on product webpage?
Shared Folder encryption has many downsides comparing to full disk/volume encryptionm which should be completely transparent for filesystem, also would not cause any slowness for hardware and no NFS mount is possible with such.
Only solution is to perform any at client encryption... but then also downsides of not having many features from TOS available.
Of course I can always return TM, move to other vendor or install TrueNAS just to have encryption functionality, but I would better like you to provide us instructions how to encrypt volume as advertised.
TOS 6.0.650
BIOS: MADN0102.V06

[TMzethar]

HyperLock-WORM file system volumes can only be created starting from the second volume onwards; the first volume cannot be configured as a HyperLock-WORM file system volume.
Further relevant information:
https://toshelp.terra-master.com/web/#/en/Volume

[krissan]

Hey,
hyperLock-WORM is something completely different, and it will cause whole lot of other troubles.
I do not want to create cold storage archive, but use it as a normal NAS, but with encrypted disks. If disk fails then I can send it for a warranty claim without need to worry about data leakage! Or if nas would be stolen the same situation.

You mention about this "AES 256-bit Disk Array Encryption Protection" apart form Hardware specification even here:
https://www.terra-master.com/uk/press/i ... w/id/1320/


"AES 256-bit Disk Array Encryption Protection
Advanced disk array encryption allows server administrators to create AES 256-bit encrypted disk arrays on the NAS during initial installation. The user can unlock the encrypted disk and access data only through the previously set key password."

So question is still opened, how to perform full disk/volume encryption on TM F6-424?

[TMzethar]

I apologize for not fully understanding your question earlier. AES 256 is actually used in multiple functions. The description you see at this point likely refers to 'encrypting shared folders'.

[krissan]

Hey,
"encrypted disk arrays" does not mean encrypted shared directories...
Nevertheless, I downloaded and extracted TOS.ins, and found that in v5 and v6 there in file

Code: Select all

/etc/init.d/nas/luksmnt

script seems to be able to unlock LUKS devices.
Is there an option to handle luks encrypted devices by TOS, even when it would require to open them directly from SSH, but after that TOS could handle them properly?
I am thinking of:
[Storage Device]->[LUKS]->[MDADM]->[LVM]->[FileSystem] , but all starting with MDADM would be handled already by TOS WebUI?

According to this tutorial: https://nascompares.com/answer/tos-5-an ... ncryption/ it was possible in TOS v5?




But option is not anymore present in TOS v6, can you confirm it?

Cheers.

[krissan]

I found this thread: viewtopic.php?p=34048&hilit=encryption#p34048

So my investigation that full disk/raid encryption was possible seems to be real, as user claim that encryption was working prior upgrade!
In the meantime I did some LUKS play, manual pvcreate, vgcreate, and seems it works after I created volumes then using WebUI.
After reboot I need to unlock drives from SSH, and perform appropriate mounts, then WebUI starts seeing volumes.
So TOS is able to do it, can we ask for enabling this disabled functionality again so it'll work out of the box without terminal play?

@TM support, maybe we should move this thread of missing disk/raid encryption to some BUG, category?

[TMroy]

This more like a new feature request instead of BUG. If you can describe clearly why you need this feature, why the encrypt shard folder not going to meet your need in the sub forum "New features wanted" , then I can pass it to the tech team to evaluate.

[Dromadore]

Honestly, I find it unbelievable that a Linux distribution claiming to focus on security doesn’t offer disk-level encryption (not just “cryptage”) but only shared folder encryption. On all my Linux systems, for years, I’ve always encrypted the entire disk, including root and swap, using a passphrase: it’s the absolute minimum for security. Only the /boot and /boot/efi partitions remain unencrypted to allow the system to boot, but without the passphrase, it’s impossible to access anything, including the system itself.

Folder-level encryption is really insufficient: it leaves many traces elsewhere on the disk (temporary files, swap, logs…), whereas with full disk encryption (FDE), everything is protected-even if someone steals the drives. This is the method recommended by all serious distributions, using tools like LUKS/dm-crypt, and it’s far more performant and transparent in use.

I’m genuinely shocked that in 2025, a NAS-focused distribution like TOS doesn’t offer this basic functionality, while even Ubuntu, Debian, Fedora, etc., have integrated it for years, sometimes right at installation. No wonder many recommend replacing TOS with OpenNAS or TrueNAS for real security: it’s absurd to talk about data protection without offering full disk encryption.

I will soon receive my first TerraMaster (F8 SSD Plus), but apart from the hardware quality, I’m wondering if I made the right choice.
I’m new to this, so I don’t know how responsive TerraMaster is, but I hope their support will be quick and good.

[GevinKe]

Honestly, I find it unbelievable that a Linux distribution claiming to focus on security doesn’t offer disk-level encryption (not just “cryptage”) but only shared folder encryption. On all my Linux systems, for years, I’ve always encrypted the entire disk, including root and swap, using a passphrase: it’s the absolute minimum for security. Only the /boot and /boot/efi partitions remain unencrypted to allow the system to boot, but without the passphrase, it’s impossible to access anything, including the system itself.

Folder-level encryption is really insufficient: it leaves many traces elsewhere on the disk (temporary files, swap, logs…), whereas with full disk encryption (FDE), everything is protected-even if someone steals the drives. This is the method recommended by all serious distributions, using tools like LUKS/dm-crypt, and it’s far more performant and transparent in use.

I’m genuinely shocked that in 2025, a NAS-focused distribution like TOS doesn’t offer this basic functionality, while even Ubuntu, Debian, Fedora, etc., have integrated it for years, sometimes right at installation. No wonder many recommend replacing TOS with OpenNAS or TrueNAS for real security: it’s absurd to talk about data protection without offering full disk encryption.

I will soon receive my first TerraMaster (F8 SSD Plus), but apart from the hardware quality, I’m wondering if I made the right choice.
I’m new to this, so I don’t know how responsive TerraMaster is, but I hope their support will be quick and good.

The feedback you provided is indeed constructive and holds considerable reference value. We will promptly forward this request to our product team for a thorough evaluation.
We sincerely appreciate your continued support and interest in TerraMaster.

[jay616]

Hi. I just want to add that this is an important feature for me too for the reasons the other poster mentioned. If full disk encryption isn't supported, I won't be able to use TOS which is a shame as it looks quite good.