2

Is there a way to back up local PC's (Windows) to a NAS without using an open share on the NAS?

Open shares are a risk if a machine on the LAN is infected with malware (such as a ransomware encrypter).

All the backup software and suggestions I can find rely on share-level access to a folder.

Specific environment is Windows 7 and 10 PC's and a QNAP NAS.

Jim

  • There should be a way for your PC to "talk" to the NAS. Share access is done over SMB protocol, which is one of many options for remote file system access. See if your NAS supports SCP (secure copy), FTP (file transfer protocol) or similar; and then find a piece of software that can run on your PC and push files to the NAS over that protocol. – Angstrom Jan 23 '19 at 14:00
  • A good passwrod on the share is a good way to protect against hostile nodes on your LAN if that ever happens. Only your backup program will have the correct password with write access, while others will have read-only permissions. – Alejandro Jun 24 at 14:28
  • As an alternative, you can try th "pull" model, in which the NAS itself connects to the target machines and extract whatever needs to be backed up from them and stores. Read-only shares can be provided to use the copies. – Alejandro Jun 24 at 14:29
1

Set your QNAP to require authentication for the SMB share (not open), and use StorageCraft SPX (for just one example, I do recommend it) which can authenticate to that share outside of Windows authentication. This way, only SPX has the authenticated connection, not Windows itself, not any user or system profile in Windows; so if that Windows gets infected, it cannot reach the NAS. Just be sure no Windows profiles have that password stored, which means more than just no drive letters mapped.

I have zero affiliation with the StorageCraft company.

| improve this answer | |
0

If your primary concern is that a ransomware attack might overwrite your backups as well as your main PC, there is another option.

Instead of sharing a file system where overwrites replace the contents of the existing files, share a filesystem which uses copy on write semantics. With frequent automated snapshots to preserve the contents of overwritten files you get have a copy of the original files even if they are 'deleted'.

In the event of a ransomware attack overwriting all of your backups, the main effect will be to run the server out of disk space. When you realise this has happened, you can restore the filesystem to the snapshot made immediately before the attack which simultaneously restores all of the original backups, and deletes all of their 'encrypted' replacements.

On my Linux NAS, I use ZFS drives which support this kind of functionality, though I haven't set it up myself and other options such as BTRFS are available.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.