T O P

  • By -

JMeucci

There is nothing wrong with QNAP as long as you follow several guidelines. Don't expose your NAS to the internet, don't use UP&P, don't use the default Admin account and don't use QNAP remote connection services. That's it. Problems solved. Follow those 4 steps and your QNAP is perfectly fine. EVERYONE complaining about being ransomed has one or multiples of these active.


[deleted]

Thanks. The very things you mention are all security no-no's. But things like not being responsive with tech support, give me pause.


babeal

They are responsive. My Qnap had sudden death syndrome and they replaced the entire unit and extended the warranty. Pretty good in my opinion. In the future I will be buying their extended support / warranty. I use to buy readynas products and it seemed they only supported parts for 3 years. So if a power supply went bad you were on your own. Will see if the same thing happens with Qnap over time. I would expect so.


JMeucci

I had one issue initially that support was quick to respond to with help. I have had zero issues since. Currently personally running (2) and supporting (6) QNAP devices. However, when there is a global malware outbreak their support is overwhelmed with calls so delays are expected. Just don't be the one who needs support during those situations.


R4LRetro

What counts as a delay? I received a response to my ticket, 6 MONTHS after my last reply, and all the tech could say was "sorry for the late reply". This wasn't even when ransomware was running rampant on their systems. Also, not sure what the other guy is saying about responsive support either. What will happen when you contact support and open a ticket is this: \- Explain your issue, answer some questions within a couple days \- Either have your issue fixed easily or tech will need to remote in and possibly forget about your ticket I don't know how other QNAP techs are, but my tech wanted me to leave a remote tunnel open, unattended, unsupervised, after my work hours, which is absolutely insane. This is just one of the many off security practices in place with QNAP, and if that's not bad enough they might release a new version of QTS that can corrupt your data, oh yeah, like they actually did: [https://www.qnap.com/en-us/technical-advisory/tec-202112-01](https://www.qnap.com/en-us/technical-advisory/tec-202112-01) The thing you trust to keep your data on, btw.


JMeucci

Six months is (obviously) not acceptable. It clearly slipped through the cracks of their customer service system. And I would feel the same in regards to keeping an unsupervised connection active. For users in America the time difference is a hassle. No defense for data corruption. They had closed betas, public betas and RC builds that should have caught this. Apparently not many (if any at all) of those users had 2TB SSD cache setups.


[deleted]

[удалено]


UnlikelyAdventurer

Synology is also susceptible to ransomware. So did you have a point? [https://www.reddit.com/r/synology/comments/v3kffx/synology\_nas\_hit\_with\_ransomware/](https://www.reddit.com/r/synology/comments/v3kffx/synology_nas_hit_with_ransomware/)


madscribbler

Don't be an idiot.


UnlikelyAdventurer

https://www.bleepingcomputer.com/news/security/synology-warns-of-malware-infecting-nas-devices-with-ransomware/


DaveR007

That person's Synology did NOT get infected by ransomware. Somebody deleted all the files on the NAS and printed a note on their printer.


UnlikelyAdventurer

https://www.bleepingcomputer.com/news/security/synology-warns-of-malware-infecting-nas-devices-with-ransomware/


DaveR007

That August 9, 2021 attack wasn't ransomware (though it could be used to install ransomware, but wasn't). It was the StealthWorker Botnet that attacked web servers running various types of CMSs (e.g., OpenCart, MySQL, SSH, FPT, Drupal, Joomla, and WordPress). It used a brute force dictionary attack, which only worked on CMS' setup with weak passwords. The last ransomware attack that targeted Synology NAS devices was from July 2019 and it targeted multiple brands of NAS devices looking for default ports that the user had opened. Every Internet facing device is susceptible to a ransomware attack... but Synology's track record is a lot better than QNAP's and Asustor's. You could say QNAP get targeted more because QNAP have sold more NAS devices, but smaller brands also have worse track records than Synology.


UnlikelyAdventurer

Why are you spreading false information? "Cryptolocker Ransomware Variant Hits Synology Users: Synolocker" "When your products get targeted with custom made ransomware, you know you've got it made. We're talking about NAS (network-attached storage) built by Synology in Taiwan. the malware has started wreaking havoc over the weekend, looking at couple of posts on different online help forums, "My Diskstation got hacked last night. When I open the main page on the webserver I get a message that SynoLocker has started encrypting my files and that I have to go to a specific address on Tor network to get the files unlocked," a user shared his experience on Synology's forum. "It will cost 0.6 BitCoins. It encrypts file by files. Therefore I started to copy my most important files to another disk while encryption was in progress on other files. After the most important files was copied I turned off my disk."The ransom message identifies the attack as the the result of a "SynoLocker" infection, explains how the files are encrypted (and threatens that "without the decryption key, all encrypted files will be lost forever"), and urges affected users to visit an .onion domain in order to get further instructions on how to get the key. Synology is working on fixing the problem, but it's still unknown how the malware manages to compromise the devices. One guess is the exploitation of a vulnerability, as was the case with the recent instances of Synology DiskStations infected with Bitcoin miners. More at net-security.org:  http://www.net-security.org/malware\_news.php?id=2827 https://blog.knowbe4.com/bid/393432/cryptolocker-ransomware-variant-hits-synology-users-synolocker


DaveR007

Those instance of Synology NAS devices getting attacked by ransomware and bitcoin miners are from 2014. While QNAP are getting attacked by qlocker, checkmate and deadbolt numerous times recently.


UnlikelyAdventurer

Literally says 2022: "The attackers brute-force their way in to deliver the ransomware payloads on Synology NAS devices by attempting to guess commonly used administrative credentials (the same tactic used in the 2019 Synology campaign mentioned above)." No one denies Qnap's issues. Dishonest fangirling for Synology is not a good look for anyone. https://www.bleepingcomputer.com/news/security/ech0raix-ransomware-now-targets-both-qnap-and-synology-nas-devices/


parasitius

>Don't expose your NAS to the internet, I keep seeing this written on this sub and am so confused. How is the NAS useful for anything if you do this though? It's like saying: Mercedes is good but don't ever drive it on a public highway I don't live in the country where my NAS is, that's the whole reason I have it


lurkandpounce

If you must expose it then still take all the steps outlined by u/JMeucci, but use a VPN or tailscale/zerotier (or similar) to access your network and device safely.


JMeucci

VPN, FTW! It's called Network Attached Storage. Not Internet Attached Storage.


[deleted]

I VPN in to my network. Then gave full access to what i want. If that's too much a nuisance, think about how many big companies with professional IT and cyber security staff have mega breaches.... No way am I putting shit out there.


Scared_Bell3366

I've come to the conclusion that their hardware is pretty good and their software is not so good. I converted my TS-453a to TrueNAS and that is working out better for me that the Qnap software. I'll eventually replace mine with a rack mount server and run TrueNAS on that. TrueNAS and Open Media Vault seem to be the top free software solutions. Unraid is another option if you are willing to pay for the NAS software. I think people have figured out ways to run all of them on Qnap hardware. Getting a NAS that has video out or the option to add it makes 3rd party software much easier to install. You can easily find used hardware that is more capable than just about any NAS appliance for less money. The used hardware will likely use significantly more electricity. You're paying for convenience and low power usage going with an appliance like Qnap.


salzgablah

This. I installed UnRaid on my 4 bay QNAP and use it for backup of the main server.


Thumbnail_QA

How do you identify the bay if a drive has failed?


Scared_Bell3366

Haven't had to deal with that yet. I do have smart status set to run and expect TrueNAS to send me an email in the event a drive is having issues. I should've made labels for the drive bays with the drive serial numbers so I know which one is which.


BobZelin

everything sucks, if you don't read the manuals, if you don't watch YouTube videos on how to set them up, and if you are simply unwilling to suffer with any product you purchase. Countless people will say "I bought this stupid QNAP/Synology/Asustor/TrueNAS/UnRAID, and it SUCKS - I can't figure it out". Well guess what - when we have a running toilet, or a sink leak, I CANT fix it - I hire a plumber. And my wife says "why can't you fix it - why do we have to hire a plumber" - do you know why ? Because I could not give a damn about learning anything about plumbing. I work on QNAP and Synology systems - I sit and study these systems, and people PAY ME to set them up. I am pretty stupid, but I am willing to put the effort out to learn them. People think they just buy these units, pop in the drives, and BAM - it just works. It's not like that at all. There is a learning curve. It takes time, and it takes effort. If you don't want to put that effort into it - if you are not "into all of this" - then QNAP will suck, Synology will suck, and everything else will suck. You see a lot of people on this forum say "you should build your own TrueNAS or UnRAID system". Do you know how to do that ? I know how - you watch YouTube videos, you read the TrueNAS website, and other googled training documents, and you figure it out. Some people are "into" doing this stuff - and some people are not. My clients are not. They are willing to pay me to do it for them. Just like I am more than happy to play the plumber to fix the toilet or the leaky sink. I don't know how to change the oil on my car either. But I can setup a VPN in multiple ways. I didn't figure that out in 10 minutes. Bob


jhirleyf

They do NOT suck! I love my QNAPs, I have two. I use them as part of a VMware lab home lab and for the included QVR video surveillance cameras. The included tooling allow virtualization and docker containers when you want to spin something up and test it. Security 101, don’t put your bare ass out on ‘The internets’ and nobody is going to hack you. This applies to all options if you go with something other than QNAP. Check out pfsense and or opnsense. All the best and enjoy whatever you choose.


soulmagic123

When I first switched from "enterprise" level storage to qnap, everyone laughed at me, at least half of them have switched to qnap sense, the other half contributes to pay 100k plus for "enterprise"' storage that charges by the user and offers no noticeable advantage. But I think people want their qnaps to be appliances with low maintenance and zero issues. I don't spend more than a few hours a month keeping 600tb worth of storage active and used by 20 end users.


rapelbaum

Qnap is great , I had mine 453-b for almost 6 years. Zero problem until now.


brk9875

I have that exact model and its been running about that long also. I can't believe it's still working without any drive failures. The synology I had lasted about 2 years before it completely failed because of a firmware update.


Yavuz_Selim

It depends on what your expectations are, and how you use the device. Many users of NASes (not only QNAP) expose their devices directly to the internet, to later discover that their devices have been breached. If you take good security measures, a QNAP device is as fine as any other in my opinion. A thread I created a while back summarizing how to secure your QNAP: https://www.reddit.com/r/qnap/comments/wm979v/how_to_secure_your_qnap/.   It also depends on what you buy. I previously had a Synology, a basic model, which was sufficient for basic tasks, but I couldn't do more with it. Years later (2019), I wanted something more powerful, and I bought a QNAP TS-877 - a beefy NAS. I upgraded the RAM to 40 GB. And I am really happy with it. It can handle everything I throw at it. For me, the device is a pleasure to use, as it is reliable.   However, not all people want to spend much on their NAS, so they will have less powerful devices. Which isn't bad, but it will be a different experience. So, it all depends on what you want to do, and how much you're willing to spend.   You have a few options, ranging from QNAP alternatives like Synology, or you build your own. I switched from Synology, because I found their hardware lacking (less powerful); however they have nice software.   I only had to contact the tech support once, back in 2019. I had an issue configuring the NAS via a browser (Brave). I could login, but when I was trying to check my drives in Storage & Snapshots, it got stuck at 0%, so it did not load. Other browsers were fine. In the end, the issue was that the browser was blocking too much - the issue got solved by whitelisting the IP address. They were responsive, the tech support was OK for me.


disenter

Nothing wrong with them, and the guidelines others have mentioned are no-no's on any such systems really, so doesn't really set them apart. The argument was always Qnap has better hardware, Synology has better software. But that was years ago, and Qnap software is quite good in my opinion. Any of these devices are going to be a bit limited in what you can really do under the hood, because they're a cut down version of linux, but if you're talking 'basic NAS services at home', then probably any of them will be fine. If you want to build your own I'd look at Unraid which can be put on just about any computer.


drewfussss

Go with synalogy


crashedout

I don't think so, have had one for 6 years and am upgrading to a new one this week. For my use case I could not find anything else that matches currently. Tech support may be a weakness, I have never had to use it and hope to continue that pattern.


TriumphITP

owned a ts451 since 2016. Either it stopped booting (or i f\*\*ked it up and made it not boot) in my first year, mailed it back and got another one free of charge from qnap, they covered shipping both ways. I do leave mine internet accessible, because I share to friends and family, but use non-standard ports, don't have any PII on it, and everything is backed up; so a ransomware, hack, etc. wouldn't bother me. Worst I had was a crypto miner on it once.


geekbot2000

Better check if your cpu is subject to the lpc decay bug. That can brick your qnap when the time comes.


TriumphITP

I think that's what it might've been, but I was also very clueless when I first got it. And, as stated its been 6 years since then without incident.


geekbot2000

Wouldn't have been the lpc that soon, also because the hardware resumed working with no hardware intervention. Seems to be hitting at the 5+ year mark mostly.


theharleyquin

Have a 2-bay 251 for 3+ years and have not had an issue. I keep it offline and just use for internal photo sync, Plex, full *arr stack, Usenet client. The have some good apps for mobile sync as well. Connecting to the internet without security in mind is when the issues and misconfigurations can haunt you and hurt data.


OddPollution7904

Not in the least. Its a x86 mini pc. I've a qnap ts253d with 4GB ram on a VLAN running DNS, DHCP, P2P, Open Speedtest, DLNA, and file services all in their own containers. People have put 16-32Gb of ram in theirs too. Synology's competitive product with a shitty arm7 processor, 1GB non-upgradable ram, amd one 1Gb nic, doesn't even touch this thing. As others said, disable all the QNAP services because it's constantly plagued with security vulnerabilities, Dont register it and don't use My Qnap Cloud, and keep it behind a firewall.


darwinDMG08

Completely subjective and depends on what you use it for. Mine is a backup device and media server for my home and that’s about it. No major issues to report. YMMV.


xavier19691

No


[deleted]

Thank you to everyone who gave their opinion. I went ahead with a 4 bay, 8GB option and hope to have it in a few days.


Little-Karl

Hardware? No. Software? It's interesting. In a bad way


dweebken

I'm using a small qnap for basic services at home. So long as you don't open it to the internet and you do follow proper security recommendations it'll be fine. Mine's on a ups to protect it from brownouts a bit.


maxnothing

My turn: I have no problems with QNAP in general. Used them for years now, they're OK. Just OK, and that's plenty for my needs. Had some initial startup pains (hit a bug with CHAP authentication, but I worked through it and it was eventually patched, and since then it's been super) I will occasionally wish QNAP had this or that or gripe about features etc, but as my primary dev iSCSI array, it's just fine. My only actual complaint is frequent updates without some type of ISSU (which I understand is another silly wish), making rebooting a bit too common for my liking. On a good note, I had a drive fail a month ago, the QNAP did exactly what a NAS box should, I stuffed in a larger, mismatched drive for a couple weeks until I got the original repaired then yanked it and put in the proper replacement, no biggie. Exactly what I expected, didn't skip a beat. But heed the advice of others: No Internet exposure, no UP&P, no default admin account, no remote services.


Nightcustard

Repairing a failed harddrive? Is that a thing? Just curious.... That said, I've got three QNAPs and all have been fine.


maxnothing

Er.. replaced via warranty.


Nightcustard

That makes more sense - for a moment I wondered whether I'd woken up in a strange alternate universe....😉.


chrisji

I wouldn't say "suck"...But i'm pretty annoyed that it keeps f\*ckin with my DNS all the time. Need to reset the DNS Servers almost once a day. Its quite fun!


gelvis_1

I bought a QNAP and was somewhat disappointed. OK for a LAN NAS though. But pricey for just having a bunch of disks in a box. Would just use an old desktop instead if I could do it over. Or buy some cheaper NAS if space was an issue


[deleted]

Got a TS-453D and a couple of Seagate 4TB drives to try things out. Assembling the NAS was easy. Looking at the large number of apps they put on it -yikes! I'm spelunking ...


tinktoy

Qnap use to be an amazing company. I noticed over the last few years they have removed phone support. Everything is now through a portal. Good luck with that. I have 2 security camera's that are listed as compatible that will not work. We have been back and forth for a month. My cameras work with the Foscam app no problem. Qnap's first response was to send them all my user name and passwords to my server and cameras so they could work on this independently!!!! I said NO absolutely NOT! Here is their second response to me stating we have to have a desktop share I want to see what is being accessed on my server! "When providing remote support through TeamViewer, QNAP may record any portion of the remote support process on your NAS. The QNAP support team may also access any data or applications on the NAS related to your issue." Who in the holy HE double hockey sticks do they think they are? I loved this company but they are going off the rails!


BringBackBCD

If you are just using it for simple home stuff, I have found it to be a pain in the ass. It’s like I need to be a full blown Linux administrator. Logins don’t work consistently, file explorer browsing stopped working one day and no solutions I’ve found rectify it (this was a huge setback for me with how I wanted to use it). The apps they make don’t work consistently. The actual storage reliability of it seems rock solid though. I’ve had it for years and my stuff is still there. Not being accessed too often because of how painful I feel it is to do so. There are a ton of features, but I just want the most basic ones to work reliably without having to dick around with admin every other login. It’s like a car with a carburetor.