Watching over and defending the data

A NAS holds the files of a whole household —or a whole office— and stays on 24 hours a day with nobody looking at it. This guide covers the six pieces that deal with that: the three that are there to recover what breaks, and the three that are there to find out something is wrong.

Previous versions

Control Panel → Shared folders → (a folder) → "Previous versions".

With this on, Windows shows the "Previous versions" tab when you right-click a file or a folder, and the Mac does the same through "Revert to". Inside is the file exactly as it was in each snapshot of the volume.

The tab is not the important part: who uses it is. Without it, recovering a file means telling whoever administers the NAS, who opens the panel and restores it. With it, the person who has just wrecked their own document recovers it alone, from their own machine, in ten seconds.

It needs snapshots. What shows up in that tab is whatever the volume kept; if there are no scheduled snapshots, the tab comes up empty. Schedule them in Storage → Snapshots (one a day keeping fifteen is a good starting point) and wait for the first one.

It is turned on folder by folder, and so it should be: the family photos folder wants it; the downloads folder does not.

If the tab comes up empty

In order of likelihood:

1. There are no snapshots of that volume yet. That is the normal case on day one.
2. The folder is its own dataset and the snapshots are of the parent volume (or the other way round). The panel works out the right place for each folder on its own, but if you have one dataset per folder, the snapshots have to be of THAT dataset.
3. The snapshots were created by hand with a different name. The panel names them auto-YYYYMMDD-HHMMSS, and Windows needs that exact pattern to be able to sort them by date. Ones you created with another name will not show up there (they are still there and are restored from the panel as always).

Who touched what

Control Panel → Shared folders → (a folder) → "Record who deletes and who moves". It is read in Log Centre → "Who touched what".

It answers the question that had no answer: who deleted the folder?. With this on, the NAS records every deletion, every rename and every new folder made over SMB, with the user and the machine it was done from.

Only what destroys or moves is recorded. Recording reads and opens as well would fill the log with thousands of lines a minute —a Windows machine opens and closes files non-stop— and the piece of data that matters would be lost inside.

It is not kept in any separate file: it goes to the system journal, which already rotates on its own and survives reboots.

Antivirus

Control Panel → Security → Antivirus.

The reasonable question first: what does a NAS running Linux want an antivirus for? It is not to protect itself —Linux does not run an .exe— but so as not to be the delivery service. The files in the shared folders are opened by the laptops around the house, and there they do run. A trojan in "Documents" can spend months travelling from one machine to another, and the NAS is the only place from which all of it can be seen at once.

• It scans the folders you choose, by hand or once a week.
• It uses ClamAV signatures, which update themselves.
• Out of the box it only warns. Moving somebody's file without asking, with the false positives any antivirus has, is more frightening than the warning. If you prefer quarantine, the file leaves the shared folder and stays in <volume>/.cuarentena, where nobody opens it any more.
• It does not eat the NAS: it runs at the lowest processor and disk priority and with a memory cap, so the folders keep being served just the same while it scans.
• It tells you when it finishes if it found something, which is the only part that matters: when the three in the morning scan ends, nobody is looking at the panel.

A full scan of a volume with many files takes hours. That is normal and there is no time limit on purpose.

Ransomware trap

Control Panel → Security → Report and trap.

Locked snapshots are the best defence there is, but they are for recovering. This is for finding out in time: an encryption starts with one folder and takes hours to go through a whole NAS, and during that time nobody is looking.

How it works: the NAS leaves a bait file in every shared folder — AAA-aviso-de-seguridad-LGM-no-borrar.txt— and checks its fingerprint every minute. A program that encrypts does not pick and choose: it encrypts everything it finds, and that file is first in alphabetical order. When it changes or disappears, whatever is at the other end is not a person.

What happens then:

• A critical alert, through every channel you have set up (email, Telegram, the phone…).
• Closing the shared folders, if you asked for it. It is aggressive —it leaves the whole house with no files all at once— and it is what really stops an encryption in progress: every minute it stays open is more gigabytes. Only SMB is switched off: the panel, the backups and everything else stay up so you can look at what happened and recover.

Two things it does right and are worth knowing:

• A file that cannot be read (a disk that does not answer, odd permissions) **does not count as an attack**. That would be the easiest way for a disk with a problem to leave the whole house with no files.
• The alarm does not repeat every minute. Whoever saw it is already looking.

If the trap goes off

1. Do not switch the NAS off. The snapshots are what is going to save you and they are right there.
2. Look in the panel at which file went off and when: it tells you which folder it started from.
3. Disconnect the suspect machines from the network (or cut the wifi). The encryption comes from one of them, not from the NAS.
4. Look at that folder's snapshots to see how far back it goes, and restore from one before that time (disaster recovery).
5. When you are sure, arm the trap again and reopen SMB from File services.

Country blocking

Control Panel → Security → Country blocking.

A NAS published on the internet gets, without exception, thousands of attempts a day from half the world. Automatic IP blocking reacts after the first attempts; this is the opposite: if your people come in from Spain, anything from outside Spain does not even reach the door.

• It is an allow list, not a block list. Blocking the ten countries most attacks come from leaves the other hundred and eighty open, and whoever is attacking knows that.
• From your own network you always get in, whatever you pick. It is the fence that prevents the accident that really matters: locking yourself out of your NAS from your own living room.
• Each country's ranges download themselves and are refreshed once a week. Address allocations move slowly, but they move: without refreshing, over the months people from your own country would start being left out.
• If a list cannot be downloaded, nothing is filtered rather than everything.

Careful if you travel. With Spain ticked, your own phone from abroad does not get in either. If you travel often, tick those countries too or come in through the VPN, which takes a different route.

Weekly report

Control Panel → Security → Report and trap.

It is the opposite of an alarm: a short review of how the NAS is doing when nothing is happening. Free space per volume, disk health, the week's backups, antivirus and updates, through the same channels as the rest of the notifications.

It exists so somebody finds out that the backups have not run for a month, or that a volume has 6 % left, before it is an emergency.

Two details there on purpose:

• You can read it before turning it on: the screen shows the report that would be sent right now. A periodic email you cannot picture ends up in the bin.
• If the NAS was switched off at its time, it is sent as soon as it comes back. With scheduled power-off, that is the normal situation.