Playing with sed and QNAP
I own a small Intel Qnap NAS, i wanted to have a form of "security at rest".
I tried with the folder and volume encryption but the support to aes-ni is
not implemented directly and therefore is slooooooooow and sluggish.
Then i discovered SED disks (wikipedia)
that through the logic present -inside- the disk does a pretty decent job, not killing performances.
The documentation is obviously ominous, scarce and missing most of things.
I hereby suggest to use sed drives as non boot disks, so you can login to the NAS and enable
them. Then store everything on the sed drives (applications included)
Soon i will add a guide describing how to work with Qnap and bootable SED drives
Warnings
Hacking
If someone is able to connect to the disks to another machine without detaching the power,
it can read the data. If you want something more paranoid encrypt the folders too.
Extra security
DO NOT STORE THE KEYS ON THE NAS, NEVER. This way when the NAS reboot you will have
to go to the web interface and insert manually the login (for non boot drives).
Hardware
Please be first aware that only disks supporting OPAL are supported. Just to give an example
- WD Ultrastar H550 16TB SED 0F38461
- WD Ultrastar H550 18TB SED 0F38458
- Samsung 870 QVO SATA III 2.5" SSD 8/4/2/1TB
Others like the Seagate EXOS does support only ENTERPRISE SED
- Seagate Exos X16 da 16TB ST16000NM003G
You can check the capablities of your disk with
sedutil-cli --scan
The result would be like the following
Scanning for Opal compliant disks
/dev/sda 2 Samsung 870 QVO 8TB 2B7QCXE7
/dev/sdb No Crucial_CT250MX200SSD1 MU04
/dev/sdc E WD Ultrastar H550 16TB 0001SDM7
/dev/sdd 12 Unknown 0001SDM7
No more disks present ending scan.
Here we see that the WD has only Enterprise support(E), the Samsung
supports Opal 2.0 (2) and the Crucial...nothing. The unknown supports
Opal 1 and 2
Add a single (non boot) SED volume
- Go on "Storage and Snapshots"
- Create a new Storage Pool with SED enabled
- Set the password
- And go further till the end. And wait some time
- DO NOT CREATE NOW THE NEW VOLUME
- Now manage the new Storage Pool
- And DISABLE SED security sed04
- Apply and Create new Volume (i used Thick)
- And go further till the end. And wait some time
- Wait after all the operati1ons are finished (Formatting,Optimization etc )
and no operation is listed on the volume - Now manage the new Storage Pool
- And enable SED
- On file manager you can now create shared folders
Now at every restart you will have to unlock the volume :)
Add a Raid 1 (non boot) SED volume
- Go on "Storage and Snapshots"
- Create a new Storage Pool with SED enabled, selecte RAID 1
(for me it's RAID 1, i have only 2 disks)
- Set the password
- Create new Volume (i used Thick)
- And go further till the end. And wait some time
- Wait after all the operati1ons are finished (Formatting,Optimization etc )
and no operation is listed on the volume - Now manage the new Storage Pool
- And enable SED
- On file manager you can now create shared folders
Now at every restart you will have to unlock the volume :)
Add a Raid 1 (boot) SED volume
To be tested :)