3/19/23, 12:17 AM What can I do to enhance the security of my Synology NAS?

- Synology Knowledge Center

Knowledge Center Search Knowledge Center

Knowledge Center > NAS & SAN > Tutorial & FAQ

What can I do to enhance the security of my Synology

NAS?
Control Panel Security-related Issues Security Security Attacks Last updated: Oct 13, 2021

Purpose
This article provides several methods that can help you make your Synology NAS more secure.
Contents
1. Enable Security Advisor
2. Configure DSM users' permission settings
3. Configure password strength rules
4. Set expiration for passwords
5. Use multi-factor authentication
6. Enable auto block and account protection
7. Enable HTTPS connection
8. Secure FTP service
9. Open only public ports for needed services on the router
10. Enable DoS protection
11. Change default management ports
Resolution
Enable Security Advisor
Security Advisor is a built-in DSM app that scans your Synology NAS, checks your DSM settings, and gives you advice
on how to address security weaknesses. To configure Security Advisor, refer to this article.
Configure DSM users' permission settings
Make sure the default admin account is disabled to prevent malicious attacks.
Manage access to your Synology NAS by configuring user privileges to shared folders and applications as well as set
up usage quota and speed limit for different services. You can do this on a group level or individual level and during
the group/user creation process or at a later time in Control Panel > User (for DSM 6.2 and earlier) or User & Group
(for DSM 7.0 and later).
Configure password strength rules
You can make sure users set strong passwords to reduce the risk of hacking. Tick Apply password strength rules at the
following locations:
For DSM 7.0 and above: Go to Control Panel > User & Group > Advanced > Password Settings.
For DSM 6.2 and earlier: Go to Control Panel > User > Advanced > Password Settings.
For more information on password strength rules, refer to this article.
Set expiration for passwords
You can force users to change their passwords after a period of time. Tick Enable password expiration at the following
locations:
For DSM 7.0 and above: Go to Control Panel > User & Group > Advanced > Password Expiration.
[Link] 1/3
3/19/23, 12:17 AM What can I do to enhance the security of my Synology NAS? - Synology Knowledge Center

For DSM 6.2 and earlier: Go to Control Panel > User > Advanced > Password Expiration.
For more information on password expiration, refer to this article.
Use multi-factor authentication
Multi-factor authentication provides additional security for your DSM account. If enabled, you are required to provide a
second identity verification on top of your password when logging in to DSM. For more information on multi-factor
authentication, refer to the respective help articles for DSM 7.0 and DSM 6.2.
For DSM 7.0 and above: Go to Options > Personal > Account > 2-Factor Authentication.
For DSM 6.2 and earlier: Go to Options >Personal > Account, tick Enable 2-step verification.
Enable auto block and account protection
You can enable auto block to block an IP address after a pre-defined number of login attempts. This function is
applicable to login attempts via SSH, Telnet, rsync, Network Backup, Shared Folder Sync, FTP, WebDAV, Synology
mobile apps, File Station, and DSM. Configure Auto Block at the following locations:
For DSM 7.0 and above: Go to Control Panel > Security > Protection.
For DSM 6.2 and earlier: Go to Control Panel > Security > Account.
You can enable account protection to reduce the risk of accounts being attacked by brute-force. This function supports
the following services and packages: DSM, File Station, Audio Station, Video Station, Download Station, Mail Station,
Cloud Station, and Synology mobile apps. Configure Account Protection in Control Panel > Security > Account.
Enable HTTPS connection
When HTTPS is enabled, connecting to DSM, Web Station, Photo Station, File Station, Audio Station, and Surveillance
Station will be encrypted using SSL/TLS, making your connection to Synology NAS secure. Refer to this tutorial to learn
how to set up.
Secure FTP service
By default, Synology NAS automatically provides support for Secure FTP when you enable the FTP service. Refer to this
article for details.
Open only public ports for needed services on the router
Synology NAS is designed to be easily accessed via the Internet. Refer to this tutorial to learn how to configure remote
access. To ensure the security of your Synology NAS, we strongly recommend only opening public ports for the needed
services on the router.
Enable DoS protection
You can enable Denial-of-service (DoS) protection to prevent malicious attacks over the internet. To do so, go to Control
Panel > Security > Protection, tick Enable DoS protection, and click Apply.
After enabling DoS protection, your Synology NAS will respond to only one ICMP ping packet per second. If the
frequency is higher than once per second, Synology NAS would not respond to the echo request.
Change default management ports
You can customize ports to block malicious login attempts. The default ports are as follows:
HTTP: 5000
HTTPS: 5001
SSH: 22
You can change the default HTTP/HTTPS ports at the following locations:
For DSM 7.0 and above: Control Panel > Login Portal > DSM.
For DSM 6.2 and earlier: Control Panel > Network > DSM Settings.
You can change the default SSH port in Control Panel > Terminal & SNMP > Terminal.
Further reading
How can I prevent ransomware attacks on my Synology device?

Was this article helpful?   Yes ／ No

[Link] 2/3
3/19/23, 12:17 AM What can I do to enhance the security of my Synology NAS? - Synology Knowledge Center

Copyright © 2023 Synology Inc. All rights reserved. Terms & Conditions | Privacy | Cookie Preference |  Malaysia - English

[Link] 3/3