How to Secure Your Unraid Server 🖥️ Unraid Security Best Practices

[@BeardedTechGuy]

What other steps are you taking to secure your Unraid storage server? Let me know below!

[@topytopy]

Hi TBTG! I have been trying to harden the SMB configuration with the following improvements: Null passwords are disabled, SMB signing is mandatory, SMB encryption is mandatory, the minimum protocol version for supported is SMB3_11 for all communications and the ntlm auth is configured to be ntlmv2-only. I have not yet found a way to configure this correctly via the web interface as the "Samba extra configuration" field is confusing. If you could create an additional video about this, that would be exceptionally helpful! Thanks.

[@alice20001]

EPIC! This is phenomenal. It's both general good security practices as well as high level hardening that just about every video misses! Outstanding!

[@BeardedTechGuy]

Glad you liked it!

[@thebaldfox]

Great video, logical and well laid out. I just subbed... would love to see a walk through or a breakdown of reverse proxy, the pros and cons / vulnerabilities in a similar manner, rather than just the usual this is how to install it in docker and add cloudflare :)

[@BeardedTechGuy]

Glad you liked the video and thank you for subscribing! I'll keep your suggestion in mind for an upcoming video, thanks for the input!

[@arnoldfriend8197]

Great video!!

[@BeardedTechGuy]

Glad you enjoyed it

[@jpulley]

Very helpful, subbed!

[@BeardedTechGuy]

Glad you found the video and thank you for subscribing!

[@gamer1xbox360]

Great tutorial and well explained, thank you

[@BeardedTechGuy]

I'm glad you found it helpful!

[@roberts_irregular_random_rec]

At 7:06, hard to understand what you are saying: ". . . for this setting, I recommend setting to yes and ????" Nice video - thank you for creating this.

[@BeardedTechGuy]

Oh wow, guess my noise gate caught me there. I recommend "Yes (Hidden)" That's the problem with listening to my own videos, my ears fill in gaps I know no matter how many times I listen to it. Thanks for catching that!

[@ZombieTechie]

Love the channel name!

[@RagnarRipper]

That was a great video! Watched it just to make sure and I'm pretty proud that I did all the things already :)

[@BeardedTechGuy]

Glad you liked the video!!

[@xxxxxxsauron]

thanks. please make a total noob video on everything unraid.. with SMB explained also how to use torrent and prowlarr with openvpn. how to setup plex with hardware transcoding

[@daz7748]

Very well explained, thank you!

[@BeardedTechGuy]

Glad you found the video helpful!

[@thenanook]

good info, liked and subscribed

[@BeardedTechGuy]

Glad you liked the video!

[@Richardj410]

Thanks, it's sinking in slowly.

[@DarkwaterV2]

Thanks a lot!

[@BeardedTechGuy]

You're welcome!!

[@cd9954]

Good info thanks. Since you keep that port for Plex open, isn’t that a vulnerability? Do you have docker running? Fail2ban?

[@whizadree]

I wouldnt do DMZ

[@sidewind131258]

I was following along and making changes here and there as I thought I needed them, and when I was finished with "Turn on Unraid notifications" I found out that I suddently had explanations folded out everywhere, do you have any idea on where to turn those off ? I run version 6.11.5

[@BeardedTechGuy]

In the top right hand corner there should be a little question mark in a circle. If it has a line under it, that means it's enabled / selected witch auto expands all the tips. If you want that off, it should not have a line under it. Here is what it looks like when off (top image) and on (bottom image): imgur.com/a/rbFW0EF

[@TechySpeaking]

first

[@BeardedTechGuy]

Almost!

[@johnmarkzimm]

Do you install anti virus software on your Unraid server... the only one I see is calmav.

[@BeardedTechGuy]

Great question! That honestly never crossed my mind. Are you asking for the files stored on the shares of Unraid or for the Unraid OS / storage itself?

[@onestopviewfiles]

12:12 so are plex ports on 32400 that are port forwarded ok? just don't forward any common ports like port 80?

[@BeardedTechGuy]

So realistically, any port forwarding (including Plex) introduces risk to your network. For me, I "trust" Plex enough to be served traffic from the Internet so I port forward 32400 for it. Port 80 is usually used for HTTP traffic which means it is not encrypted and sent in the clear, so anyone who can see the traffic can see the contents. Because of this, it is recommended to not use and instead use HTTPS over 443 with a certificate to help protect the traffic - IF you need web browser traffic forwarded to a device in your home network. Even though HTTPS is encrypted, anyone can still access the webpage so that server could still be hacked.

[@onestopviewfiles]

@@BeardedTechGuy thanks dude, so if I just only have the plex port forwarded, and thats it, then I should be ok?

[@BeardedTechGuy]

If you only have 32400 being forwarded then that would be the only traffic sourced from the Internet that would get forwarded into your home network. At that point, as long as your Plex server isn't vulnerable for any known attacks (always keep it up to date to help protect it), then your risk would be minimal.

[@ajugland]

Still dont know how my PC always prompt for credentials even though its a public share

[@BeardedTechGuy]

Hmm that's a weird one. You could check the credential store and see if a account is saved for it. Or if its not too destructive I'd remove the share and readd it to see what happens.

[@ATWPussyCat]

How can I prevent the password from being reset (as described in the password recovery, edit the file under /boot/config/shadow)? If someone steals my entire server, they have all the data. Is there a clever way to encrypt the data yourself?

[@BeardedTechGuy]

Great question! I tried to do some searching but couldn't really find anything. What seems like your best option would be to do disk encryption. My understanding is that the encryption password cannot be reset. I'm not sure if it's required every time on power up though. If it's saved in Unraid to mount the share and the saved encryption key is not wiped on password reset it really wouldn't protect against the entire server being stolen just the disks themselves.

[@Vcen7]

@@BeardedTechGuy Password is required on each reboot, but it does protect against robbers with strong backs.

[@BeardedTechGuy]

Good to know! Thank you for sharing

[@seamydobbsno1]

Are you bound to the beard for the lifetime of your channel now?

[@BeardedTechGuy]

One does not choose The Beard, The Beard chooses the one.

[@seamydobbsno1]

@@BeardedTechGuy My understanding of the truth is that I am talking to the beard 🙌

[@Calamity_Jack]

Do you need SSH if you're using the My Servers feature?

[@BeardedTechGuy]

My understanding is that you would not need SSH for the My Servers feature, so it should be able to be turned off if you don't want even local (on network) remote access to the server.

[@Calamity_Jack]

@@BeardedTechGuy Thanks for that. I do remotely access my server via my PC (local, on the same intranet) to manage it, so would I need to leave SSH enabled to do that? Or does My Servers bypass all of that and allow me to remotely admin my server via browser on my PC?

[@BeardedTechGuy]

SSH is used for the CLI access. For GUI either local or through "My Servers" uses HTTPs. If you do not need CLI access to unraid locally you should be able to disable SSH without impact to My Servers.

[@Calamity_Jack]

@@BeardedTechGuy Awesome, thx for clarifying!

[@Redneckrampage]

Secure unraid don't don't mention about unraid SSL

[@GrandmaHatesTech]

I have a 200 pound dog to make sure nobody accesses my computer Grrrrr

[@BeardedTechGuy]

Not sure why but I just imagined Snoopy sitting on a laptop wearing the typical "hacker gear" lol

[@activate_filmscore]

🛑🛑🛑That’s not what ppl are clicking this for …. Ppl want volume and pool encryption…. Answer is unfair can’t do it … true nas can🛑🛑🛑

[@jbrown70579]

Really trying to monetize this video? 10 ads in 15 mins? Seriously? Thumbs down.

[@BeardedTechGuy]

I think I'm getting ripped off! I only put 3 ad breaks in for the 15 minute video and KZbin very rarely uses all of them ¯\_(ツ)_/¯ imgur.com/a/KmawmsA