Learn NAS - Encryption & Secure Transport

#Introduction

Firewalls and access control protect the NAS from who is allowed in. Episode 14 protects the data itself: encryption at rest and encryption in transit. If the data is secured, disk theft or media seizure won't leak its contents.

Encryption in transit ensures data flowing between the NAS and clients can't be read by third parties. Together, the two make your NAS safe at its two most vulnerable points: storage media and the network.

By the end of this episode you'll be able to enable native ZFS encryption, understand GELI and LUKS, manage keys correctly, secure the management UI with TLS, use SFTP and FTPS, and build a VPN for remote access.

#Native ZFS Disk Encryption

#Enabling Encryption

ZFS has native encryption managed per dataset with the modern aes-256-gcm algorithm. Encryption can be enabled when the dataset is created; enabling it afterward requires reprocessing the data.

zfs create -o encryption=aes-256-gcm -o keyformat=passphrase \
  tank/rahasia

The zfs create -o encryption=aes-256-gcm command creates a dataset with AES-256-GCM encryption. The keyformat=passphrase option specifies that the key is unlocked with a passphrase.

#Advantages of Native Encryption

Native ZFS encryption runs at the filesystem level, so other ZFS features like compression, snapshots, and replication keep working. Snapshots of an encrypted dataset are also encrypted, and keys are never copied to replicas.

zfs get encryption tank/rahasia

The zfs get encryption output shows the algorithm in use. Before writing important data, always confirm the dataset is truly encrypted this way.

#GELI and LUKS

#Encryption at the Disk Layer

If the filesystem doesn't support encryption (for example ext4), encryption is done at the block layer with LUKS on Linux (cryptsetup) or GELI on FreeBSD. This approach encrypts the entire block device, including the filesystem on top of it.

cryptsetup luksFormat /dev/sdb
cryptsetup open /dev/sdb data-enc

The cryptsetup luksFormat command creates an encrypted container on /dev/sdb, then cryptsetup open opens it as the data-enc device, which can be formatted and mounted.

#When to Use LUKS/GELI vs ZFS Native

Choose ZFS native when using ZFS, because feature integration is cleaner. Choose LUKS/GELI when using another filesystem, or when you want encryption at a lower block level. Both are equally strong; what matters is consistency and good key management.

#Key Management

#Storing Keys Correctly

The encryption key is the only way to unlock data. Losing the key is the same as losing the data. Don't store keys in the same place as the encrypted data, and always keep a backup copy of keys in a separate secure location.

zfs load-key tank/rahasia

The zfs load-key command loads the key so an encrypted dataset can be accessed. For passphrase datasets, you'll be prompted for input; for file-based keys, set keylocation first per the ZFS documentation, then load the key the same way.

#Key Best Practices

• Use a strong passphrase or a long random file key.
• Store key copies in a password manager and an offsite location.
• Never send keys through the same medium as the data.
• Document who is authorized to unlock the dataset.

#TLS for the Management UI

#Securing HTTPS

The management UI must always be accessed over HTTPS. TrueNAS SCALE uses a built-in certificate and can be connected to Let's Encrypt or an internal CA. OpenMediaVault provides certificates via the UI and supports EC SSL certificates on recent versions.

openssl s_client -connect 192.168.1.100:443 -showcerts

The openssl s_client command shows the certificate chain served by the UI. Make sure the certificate is valid and not expired, and ignore warnings only if you're using a trusted internal CA.

#Replacing the Default Certificate

The built-in self-signed certificate triggers browser warnings. For a clean experience, register a domain and use Let's Encrypt, or deploy an internal CA certificate to all clients. In homelabs, an internal CA with cfssl or easy-rsa is a common solution.

#SFTP and FTPS

#SFTP for Secure Transfers

SFTP is file transfer over SSH, with no separate FTP connection. TrueNAS SCALE enables SFTP when the SSH service is running. Its advantages: one protocol, one port (22), and mature SSH security.

sftp user@192.168.1.100
put berkas-iso.iso /tank/data/

The sftp command opens an interactive transfer session. The put command uploads a local file to a directory on the NAS. SFTP is safer than plain FTP because the whole session is encrypted.

#FTPS: FTP over TLS

FTPS adds TLS to the FTP protocol. If a legacy application only supports FTP, FTPS is the safer compromise. But for new integrations, SFTP and WebDAV over HTTPS are generally simpler and easier to firewall.

#VPNs for Remote Access

#Why a VPN

Remote access to a NAS shouldn't open public ports. A VPN places a remote device as if it were on the same local network, so all NAS services can be reached without port forwarding. Two popular technologies: Tailscale and WireGuard.

#Tailscale for Simplicity

Tailscale is a WireGuard-based mesh VPN that simplifies creating a private network between devices. On TrueNAS SCALE, Tailscale is available as an app; on clients, just log in and devices connect to each other directly.

wg-quick up wg0
ping 100.64.0.2

The wg-quick up wg0 command brings up the WireGuard tunnel. If ping to the peer succeeds, you're on the private network and can reach the NAS without public ports.

#Manual WireGuard

WireGuard is a modern VPN that's light and high-performance. Its manual configuration is simple but still demands care with private keys:

[Interface]
PrivateKey = kunci-privasi-peer
Address = 10.0.0.2/24
 
[Peer]
PublicKey = kunci-publik-server
Endpoint = nas.example.com:51820
AllowedIPs = 192.168.1.0/24

The configuration above connects a client to the WireGuard server on the NAS. All traffic to the LAN subnet is routed through the tunnel, so access to the NAS stays end-to-end encrypted.

#Closing

In this episode 14 you protected data at two critical points: encryption at rest with native ZFS aes-256-gcm, GELI and LUKS, and key management, plus encryption in transit with TLS, SFTP, FTPS, and a Tailscale or WireGuard VPN.

Key takeaways:

• Native ZFS encryption keeps snapshot and compression features active.
• GELI and LUKS protect non-ZFS filesystems at the block layer.
• Store keys separately from data and always keep a backup.
• HTTPS is a must for the management UI; replace the default certificate.
• Access remotely via VPN, never open public ports.

In the next episode, episode 15, we'll cover vulnerability and patch management — from CVEs in Samba and OpenSSH, routine update habits, to app isolation, non-root services, surface minimization, and periodic security audits. Your data is encrypted; now it's time to keep the system healthy over time.