ReadyNAS encryption implementation

Question

Hi there,&nbsp;I was wondering what kind of encryption the ReadyNAS use? is it Luks?&nbsp;What is the performance impact expected on an old Pro 6 running a E6600 and 4GB of RAM?&nbsp;ThanksTony

StephenB · Answer

tony359&nbsp;wrote:
&nbsp;
I was wondering what kind of encryption the ReadyNAS use? is it Luks?

Yes, LUKS
&nbsp;
tony359&nbsp;wrote:
&nbsp;
What is the performance impact expected on an old Pro 6 running a E6600 and 4GB of RAM?
&nbsp;

I don't know, as I don't use volume encryption.&nbsp;
&nbsp;
One big limitation is that once encrypted is you

won't be able to vertically expand the volume.
won't be able to expand horizontally useing bigger disks

FWIW, I also don't see much of a security benefit.&nbsp; My NAS on power schedules (including my Pro 6) would need the USB key to be in them all the time.&nbsp; While I could remove the key from the main NAS after every boot, I'd still need to keep it nearby.
&nbsp;

tony359 · Answer

No expansion? Then no thanks! :)&nbsp;Thank you for mentioning that.&nbsp;My NAS is on 24/7 so the USB key is only needed every now and then. But I see your point, if I have a power cut when I am away or I need to reboot remotely...&nbsp;The USB drive can be unmarked, in a drawer along with many others. Yes, it's not 100% secure but if Arsenio Lupin steals my NAS, find the unmarked key and realises how to use it, then I am ok with them reading my bank statements! :D&nbsp;Thanks again for your help as usual Stephen!

StephenB · Answer

tony359&nbsp;wrote:
No expansion? Then no thanks! :)
&nbsp;

Very limited expansion.&nbsp; You can apparently add another drive of the same size to an empty bay, but that is it.
&nbsp;
tony359&nbsp;wrote:
&nbsp;
The USB drive can be unmarked, in a drawer along with many others.&nbsp;

True (but if you use volume encryption, you need to make sure you have more than one copy of the key!).&nbsp; I'm not saying there is no security benefit, just that I don't think the benefit is worth the downsides.
&nbsp;
There are a couple of other approaches to creating encrypted storage on the NAS.&nbsp; I believe that&nbsp;Sandshark&nbsp;uses VeraCrypt.&nbsp;&nbsp;

Sandshark · Answer

Yes, I have a Veracrypt "volume" on my NAS.&nbsp; As the NAS sees it, it's just a big file.&nbsp; I run Veracrypt on the PC that is using the "volume" that Veracrypt mounts.&nbsp; Here are some pointers:&nbsp;Unfortunately, it does mean only one device can access the "volume" at a time.&nbsp;Turn off Strict Sync for the share containing the file, or writes will be extremely slow.&nbsp;If you are transferring a large quantity of smaller files (like a lot of photos), be careful, especially if the file starts to get really large (&gt;500MB).&nbsp; I have seen the brtfs-transaction process (as viewed from ssh) reach 100&amp; and then "lock up" the Veracrypt volume.&nbsp; Some of the files transferred to that point will be corrupt, and no more files can be transferred.&nbsp; I ran a lot of tests once I saw it happen, and never saw existing files corrupted, but I can't say it won't happen.&nbsp; Best bet is to transfer files in smaller (&lt;100) groups.&nbsp; I suspect keeping strict sync enabled eliminates this problem, if you can stand the slowdown (or, more precisely, that turning it off creates the potential for the problem).&nbsp;If you write to the file often, it is fairly large, and you do backups with snapshots to another ReadyNAS, then use ReadyDR, not a file-based backup.&nbsp; The amount of space and time this saves can be huge.

StephenB · Answer

Sandshark&nbsp;wrote:
&nbsp;
If you write to the file often, it is fairly large, and you do backups with snapshots to another ReadyNAS, then use ReadyDR, not a file-based backup.&nbsp; The amount of space and time this saves can be huge.

You can also do incremental file backups from a PC that is accessing the veracrypt volume.&nbsp; Back up to an encrypted drive (or an encrypted cloud storage) of course.&nbsp; ReadyDR is backing up the encrypted container, so in that case there is no need to encrypt it again.
&nbsp;
There are a couple of similar approaches (with the same limitation of one user at a time).&nbsp; iSCSI Luns can be encrypted.&nbsp; It is also possible to create an encrypted virtual disk (Microsoft VHD or VHDX container) that is stored on the NAS.

Forum Discussion

ReadyNAS encryption implementation

10 Replies

Related Content

Readynas 628x Encryption-what standard

ReadyNAS Volume not expanding - with encryption

Does ReadyNAS OS implement SMB 3.1.1?

ReadyNAS 312/314 : SMB3 Transport Encryption options

Backup of ReadyNAS that has Encrypted Volumes

NETGEAR Academy

ProSupport for Business