Truecrypt on a NAS

[Charlotte]

I’m now the proud owner of a second hand QNAP TS-101.  I’ve set up network shares on it for my documents, photos and videos.  I’ve then mapped them to drive letters on my computer.  It’s all working very well and I couldn’t be more chuffed.  Once I’ve sorted out all my archived files, I’ll hook up another USB drive to the NAS and set it up for RAID1 duplication.  Lovely stuff.

However, I’d like to set up a further network share on the NAS, mapped as a wholly encrypted drive on my laptop.  Although I’m keeping my grumble important documents in an encrypted container on the C:/ drive there, I’d ideally like to have a fully encrypted drive on the NAS.  An X:/ drive, if you will.

I’m aware that Truecrypt theoretically supports dynamic volume sizes, but if I ask it to encrypt a whole network drive on the NAS, it can’t see my X:/ drive.

Is this possible?  How do I go about it?

[thing1]

Not 100% sure I parsed the question, but I'll attempt my take at an answer 

So long as you only want to access the encrypted drive from a single PC (at a time) then it works pretty well to just create a truecrypt volume inside a normal file hosted on the NAS, and have the PC mount that file as the X: drive.

So in TrueCrypt - Free Open-Source Disk Encryption Software - Documentation - TrueCrypt Volume this is the "File-hosted (container)" option.

It looks like you have to choose a fixed size for it though. Dynamic sizing only works if the host filesystem is NTFS, which isn't really an option with a NAS (even if it were using NTS, the network connection would obscure this fact to truecrypt)


Tip: if you're buying a USB drive to leave connected & powered semi-permanently, shop carefully: cheap ones have poor ventilation. I fried a drive in very little time this way.

[andygates]

Hm, it's a linux device so there ought to be some way of doing something with it.  Might be a bit alpha-geeky though.

Truecrypt will encrypt a bogstandard USB HDD out of the box, and my X: drive is thus, but a NAS is not like that, it's a file server inna box; you'd need to install it on the NAS and my one dalliance with linux truecrypt ended in grumpiness.

Paging the penguin posse!

[tiermat]

In THEORY yes you can do it.....

In practice however the processor and ram in a NAS box is insufficient to encrypt and decrypt on the fly (unless you want to pay silly money for something like a DS8000), as the processor will prolly be a weedy little ARM processor running at <300Mhz and the RAM will probably have looked like a good amount to have circa 1995!!!

EDIT: Comparison Chart - QNAP TS-109 Series vs TS-100, TS-101

Shows that the 101 has a freescale 266Mhz processor, fine for a mobile, or serving up files but no good really for encryption...

[andygates]

So what's best practice for securing a NAS full of grumble flicks?  Does the thing itself have basic security?

[tiermat]

The TS-101 is a basic NAS so offers very little in the way of security I am afraid...

The only option would appear to be to secure the files using SMB/CIFS authentication, actual disk level encryption would be a no go.

Sorry to be the harbinger of doom

[Charlotte]

No, not at all.  I'm really grateful for your expertise.

It sounds like what I've already got; an encrypted container in its own drive is probably the best solution, then?

[andygates]

Aye, do a big ol' file and mount that. 

TrueCrypt - Free Open-Source Disk Encryption - Documentation - Multi User Environment

I'd not want to try mounting it on two PCs at once...