Watching over and defending the data

11 min · 9 sections

A NAS holds the files of a whole household —or a whole office— and stays on 24 hours a day with nobody looking at it. This guide covers the six pieces that deal with that: the three that are there to recover what breaks, and the three that are there to find out something is wrong.

If what you want is…	Go to
Whoever deleted a file to recover it themselves	Previous versions
To know who deleted the folder	Who touched what
A file with a trojan not to travel from one PC to another	Antivirus
To find out about an encryption while it is happening	Ransomware trap
Nobody knocking on your door from half the world	Country blocking
Somebody to notice that the backups are not running	Weekly report

Previous versions

Nothing to turn on: it shows up in every shared folder whose volume keeps snapshots.

Windows shows the "Previous versions" tab when you right-click a file or a folder, and the Mac does the same through "Revert to". Inside is the file exactly as it was in each snapshot of the volume.

The tab is not the important part: who uses it is. Without it, recovering a file means telling whoever administers the NAS, who opens the panel and restores it. With it, the person who has just wrecked their own document recovers it alone, from their own machine, in ten seconds.

It needs snapshots. What shows up in that tab is whatever the volume kept; if there are no scheduled snapshots, the tab comes up empty. Schedule them in Storage → Protection → Snapshots (one a day keeping fifteen is a good starting point) and wait for the first one.

It is read-only and shows what was kept with the permissions of that moment: everyone sees the versions of the folders they can already open. Each folder's card, in Control Panel → Household folders, tells you how many Windows will show and how recent the latest one is, or why there are none.

If the tab comes up empty

In order of likelihood:

There are no snapshots of that volume yet. That is the normal case on day one.
The folder is its own dataset and the snapshots are of the parent volume (or the other way round). The panel works out the right place for each folder on its own, but if you have one dataset per folder, the snapshots have to be of THAT dataset.
The snapshots were created by hand with a different name. The panel names them auto-YYYYMMDD-HHMMSS, and Windows needs that exact pattern to be able to sort them by date. Ones you created with another name will not show up there (they are still there and are restored from the panel as always).

Who touched what

Control Panel → Household folders → (a folder) → "Record who deletes and who moves". It is read in Log Centre → "Who touched what".

It answers the question that had no answer: who deleted the folder?. With this on, the NAS records every deletion, every rename and every new folder made over SMB, with the user and the machine it was done from.

Only what destroys or moves is recorded. Recording reads and opens as well would fill the log with thousands of lines a minute —a Windows machine opens and closes files non-stop— and the piece of data that matters would be lost inside.

It is not kept in any separate file: it goes to the system journal, which already rotates on its own and survives reboots.

File types a folder refuses

Business edition. In the settings of each household folder (Edit) you can tell it what it must not accept:

Windows programs: .exe, .bat, .msi, .ps1, .vbs and the like. For document folders, where nobody needs to keep a program.
Ransomware traces: the extensions left by programs that encrypt files to demand a ransom, and their payment notes. If an office computer gets infected, the encrypted files cannot get back into the folder.
Others, your own, separated by commas. * stands for anything: *.iso refuses every disk image; copy of *, everything that starts that way.

What stops it and what does not:

The Windows and Mac network, WebDAV and anything uploaded, copied or renamed from Files stop it; Files tells you the folder does not accept that file type; Windows and the Mac show a “not found” error and do not save it.
NFS and SFTP cannot refuse by name: whatever comes in that way gets in.
Over WebDAV a file that was already inside can be renamed to one of these types.
Anything already there is not deleted: it stops showing over the Windows and Mac network and stays in Files, where you can move or delete it.

Antivirus

Control Panel → Security → Antivirus.

The reasonable question first: what does a NAS running Linux want an antivirus for? It is not to protect itself —Linux does not run an .exe— but so as not to be the delivery service. The files in the household folders are opened by the laptops around the house, and there they do run. A trojan in "Documents" can spend months travelling from one machine to another, and the NAS is the only place from which all of it can be seen at once.

It scans the folders you choose, by hand or once a week.
It uses ClamAV signatures, which update themselves.
Out of the box it only warns. Moving somebody's file without asking, with the false positives any antivirus has, is more frightening than the warning. If you prefer quarantine, the file leaves the household folder and stays in <volume>/.cuarentena, where nobody opens it any more.
It does not eat the NAS: it runs at the lowest processor and disk priority and with a memory cap, so the folders keep being served just the same while it scans.
It tells you when it finishes if it found something, which is the only part that matters: when the three in the morning scan ends, nobody is looking at the panel.

A full scan of a volume with many files takes hours. That is normal and there is no time limit on purpose.

Scan on write

Business edition. For the folders where outside files come in —downloads, scans, what clients send— each file can be scanned as soon as it finishes saving, without waiting for the monitoring.

In “Scan on write”, press Install. It downloads about 300 MB with the signatures and takes a few minutes; you can keep using the panel.
Choose the folders and turn it on. It is not considered on until it starts watching them, and loading the signatures takes a couple of minutes.

It needs about 2 GB of free memory for the signatures. If there is not enough, it does not turn on and tells you how much there is.
It uses at most half a processor core: the NAS serves files at the same speed and what is written takes a few seconds longer to be scanned.
It does not block saving: the file is saved and scanned right after. What it finds follows “If it finds something”: with “Move to quarantine” it is moved away in under a minute; with “Warn and touch nothing” it stays where it is and shows in “Detected files” so you can decide. Either way you get an alert, and ransomware is answered like the trap.
With a home licence it turns itself off.

Ransomware trap

Control Panel → Security → Report and trap.

Locked snapshots are the best defence there is, but they are for recovering. This is for finding out in time: an encryption starts with one folder and takes hours to go through a whole NAS, and during that time nobody is looking.

How it works: the NAS leaves a bait file in every household folder — AAA-aviso-de-seguridad-LGM-no-borrar.txt— and checks its fingerprint every minute. A program that encrypts does not pick and choose: it encrypts everything it finds, and that file is first in alphabetical order. When it changes or disappears, whatever is at the other end is not a person.

What happens then:

A critical alert, through every channel you have set up (email, Telegram, the phone…).
Closing the household folders, if you asked for it. It is aggressive —it leaves the whole house with no files all at once— and it is what really stops an encryption in progress: every minute it stays open is more gigabytes. Only SMB is switched off: the panel, the backups and everything else stay up so you can look at what happened and recover.

Two things it does right and are worth knowing:

A file that cannot be read (a disk that does not answer, odd permissions) **does not count as an attack**. That would be the easiest way for a disk with a problem to leave the whole house with no files.
The alarm does not repeat every minute. Whoever saw it is already looking.

If the trap goes off

Do not switch the NAS off. The snapshots are what is going to save you and they are right there.
Look in the panel at which file went off and when: it tells you which folder it started from.
Disconnect the suspect machines from the network (or cut the wifi). The encryption comes from one of them, not from the NAS.
Look at that folder's snapshots to see how far back it goes, and restore from one before that time (disaster recovery).
When you are sure, arm the trap again and reopen SMB from File services.

When someone signs in to the panel with your account from an address that account had not used before, you get a notice with the browser and system they came from. Your home network and the VPN never warn, and from outside it is the network that counts, not the exact address, because carriers change it daily. If the notice was not you: change the password and close every session from Your account.

I am away from home

Control Panel → Alerts.

One switch for the days the house is empty. With the house empty, what is normal any other day stops being normal: while this is on, the NAS tells you who comes in.

It reports every panel sign-in, including from your home network. Normally, with the switch off, it only reports a new place.
It reports every machine that connects to the household folders.
Every camera that is recording reports motion, with a photo, even if its details do not have the alert switched on. When you switch the mode off, each camera goes back to its own setting.
At most one alert a day per account and address, so a week away does not end in twenty alerts nobody reads any more.

Switching it off puts everything back exactly as it was. The panel shows since when it has been on and who turned it on.

Country blocking

Control Panel → Security → Country blocking.

A NAS published on the internet gets, without exception, thousands of attempts a day from half the world. Automatic IP blocking reacts after the first attempts; this is the opposite: if your people come in from Spain, anything from outside Spain does not even reach the door.

It is an allow list, not a block list. Blocking the ten countries most attacks come from leaves the other hundred and eighty open, and whoever is attacking knows that.
From your own network you always get in, whatever you pick. It is the fence that prevents the accident that really matters: locking yourself out of your NAS from your own living room.
Each country's ranges download themselves and are refreshed once a week. Address allocations move slowly, but they move: without refreshing, over the months people from your own country would start being left out.
If a list cannot be downloaded, nothing is filtered rather than everything.

Careful if you travel. With Spain ticked, your own phone from abroad does not get in either. If you travel often, tick those countries too or come in with Tailscale or NetBird: whatever arrives through them does not go through this filter.

Weekly report