NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Premissions--- NAS 2120
We just got hit with Ransomware last Thursday. It was the .CRYPT version. I have putting the network back together ever since….what a mess. Small company running a Dell server with Windows Server 200...
It sounds like a real mess.
I am unclear on whether you are having issues restoring the data, or if you are past that, and just wanting to revisit your network security.
Probably the safest approach is to prevent all filesharing protocols on the fully-protected NAS, and have it run backup jobs to reach out to the main NAS for backup. Then enable filesharing only when you are restoring. Of course when the main files are corrupted they will still eventually reach the protected NAS. Off-line storage is therefore still needed. If you have enough space on the protected device you can also enable a single snapshot for each share, which might let you recover the uncorrupted files if they reach the protected NAS before you can stop the backup. You'd need at least 60% free space (not counting snapshot use) in order for this to work, since the NAS will automatically delete the snapshot when the file system gets too full.
Cloud backup (for instance crashplan) might also be a useful safety net.
FG wrote:
I do NOT click the box that says remember my password. I close windows exploder. When I open another exploder session and go the NAS it get right in……no password promt? The only time it ask for a password again is when I log off windows or restart.
This is standard windows behavior, and the NAS cannot control it. I don't know of any security policy or registry setting in Windows to prevent it.
You can force windows to close all network sessions (and forget any passwords) by opening command and entering "net use * /delete". Though I expect you already know that.
Also, I set up a user on the Ready NAS called server and another called John and a share folder called server backups. Through windows if I browse to share on the NAS signed in as John……lets me in…..ok good. Now I want to jump to the server backups folder, the user John does not have permissions to that folder so I sign using the user SERVER but it will not let me in, because either win or NAS thinks I am still JOHN. So I have to go to cmd, enter net use and delete the user John. Now I can sign in to the server backups folder using the server user/account.
Again, this behavior is built into windows. There is another trick that sometimes is useful.. Windows treats the NAS IP address and the NAS name as two different machines. So you can access \\nasname with one set of credentials and \\nasipaddress with another.
To your 1st question......At the present I focussing on the security portion of the equation.
I like the idea of the cloud, but it would probably take a full day to download a full back up before we could get the store process going. Because what would be considered a "good" download speed 30mbps?....
I am currently use 4----2TB drives with RAID 10, seems like the fastest and most redundant plan. This leaves me 4TB of storage. But I am open to ideas. For me restore speed is more important than storage volume. I think 4TB should cover us for awhile.
Windows!!!!!!!!! Sorry, had to get that out...rant completed.
Snapshots are read only correct? So, if someone got to the READY NAS they could still take the data from the snapshot, but can't change or delete it, correct?
Sounds like I need another 2120. 1 to store backups on and another that is not "shared" that would reach into NAS 1 and make a backup of it.
So, I can access the NAS using \\NASname with user account john and \\192.168.123.123 with user account server on the same PC? I will try this as soon as I get in.
Is a mapped drive letter anymore or less secure than jumping to the NAS from the "Network" tab in win exploder?
Of course an effective defense from ransomware just means that your next crisis will be from something else :smileyfrustrated:
FG wrote:
I like the idea of the cloud, but it would probably take a full day to download a full back up before we could get the store process going. Because what would be considered a "good" download speed 30mbps?....
Whether its practical on the backup side does depend on the amount of data churn. Restore will of course take a long time, so I view this as a last-resort option. I use crashplan at home for disaster recovery - my speeds vary greatly, but average closer to 15 mbs than 30. The deduplication does reduce the bandwidth needed (especially for my PC image backups - done with Acronis Trueimage). Note I am not using their enterprise product.
FG wrote:
Snapshots are read only correct? So, if someone got to the READY NAS they could still take the data from the snapshot, but can't change or delete it, correct?
The snapshot is read only (and you can block snapshot access on a share-by-share basis). But that doesn't fully protect it. When the snapshot is created, it actually takes no space. The data blocks are shared with the main share. As files are updated, the original datablocks are in the snapshots alone, with the new data being only in the main share. So if someone over-writes everything in the main share, all the old datablocks end up in the snapshot(s) alone.
If the file system gets too full, the NAS will protect itself by deleting the oldest snapshots - the threshold for that is settable, and is defaulted to 90%. That's why I suggested 60% free-space - if everything is overwritten you should still have 20% freespace (with 40% encrypted data and 40% unencrypted snapshots). But even there, if a second snapshot is made and the main data is over-written again by the ransomware (perhaps from a different pc), then the disk will become completely full and the data you need will be deleted. Note if a second snapshot is not made, the new re-write won't increase the space usage on the NAS.
For your use case, the NAS is doing exactly the wrong thing when the file system fills - because it deletes the unencrypted data you want to protect. You'd much rather make the BTRFS subvolumes read-only at that point. A configuration option to do that would probably be easy (so perhaps put it into the idea exchange).
If you are good with linux tools, there likely are some circuit breakers you could implement that would have a similar result. For instance, you could put a plain-text file in every folder you are backing up. Access that file first, and make sure it still is unencrypted. Then only do the backup if the file hasn't changed. Or do your own monitoring on space usage, and make the volume read-only yourself.
FG wrote:
Sounds like I need another 2120. 1 to store backups on and another that is not "shared" that would reach into NAS 1 and make a backup of it.
That would be a good approach (and at the moment that's an expense that would likely be approved!).
FG wrote:
So, I can access the NAS using \\NASname with user account john and \\192.168.123.123 with user account server on the same PC? I will try this as soon as I get in.
Yes.
FG wrote:
Is a mapped drive letter anymore or less secure than jumping to the NAS from the "Network" tab in win exploder?The early versions of CryptoLocker encrypted mapped drives but not network shares. So in practice mapped drives might be somewhat safer. Theoretically they are both equally vulnerable.
There are other steps (if you google you'll find quite a few suggestions). Some relate to user training (a lot of ransomware vectors in through a phishing email); some relate to blocking use of macros in office. Setting the windows PCs to open JS files by default in notepad is also easy to do, and might prevent a future attack. You might look here: http://blogs.microsoft.com/cybertrust/2016/04/22/ransomware-understanding-the-risk/
StephenB wrote:Of course an effective defense from ransomware just means that your next crisis will be from something else
A ray of sunshine you are...ha ha
For your use case, the NAS is doing exactly the wrong thing when the file system fills - because it deletes the unencrypted data you want to protect. You'd much rather make the BTRFS subvolumes read-only at that point. A configuration option to do that would probably be easy (so perhaps put it into the idea exchange)
I'm feeling way outside my depth/paygrade on this current issues....
Could you provide me with a link/screenshot/instructions to set up the BTRFS?
I don't know that I fully understand what you are explaining regarding snapshots. If someone gained access to NAS they could copy and huge file to the NAS which would bring it to capacity and render the existing snapshots useless?
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
