NAS connected to Windows Domain:

gerlis
gerlis used Ask the Experts™
on
NAS connected to Windows Domain:

We are considering connecting a QNAP NAS to a Windows Domain.  I have read the QNAP advice on how to achieve this but have some questions as to the practicality and security.

1.      Although the Windows Domain users are copied to the NAS, I wonder if an account can be setup on the NAS that would by-pass the domain security?
2.      Does access to data on the NAS require a separate login or, does the Windows login get passed through seamlessly?
Thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Iamthecreator OMIT/EE Solution Guide

Commented:
Does access to data on the NAS require a separate login or, does the Windows login get passed through seamlessly?
When you join the QNAP to the domain you can directly add the AD security groups to the network share permissions to control the access
Its a simple and straightforward process
Although the Windows Domain users are copied to the NAS, I wonder if an account can be setup on the NAS that would by-pass the domain security?
You can always access the QNAP with the built in admin account in the WebUI (separate from the AD account). You can create and manage other local NAS accounts.
Distinguished Expert 2018

Commented:
If the NAS device is joined to the domain, it can use domain users for authentication and thus, it will be seamless.
I don't understand question 1. If you administer the NAS, why would you want accounts other than domain accounts? If you have a reason to use other accounts, where would be the problem, why is this a bypass of domain security? There is no "domain security".

Author

Commented:
I was curious as to whether someone could bypass domain security - i.e get into folders they shouldn't be able to get into, by creating another account directly on the NAS.
Introduction to Web Design

Develop a strong foundation and understanding of web design by learning HTML, CSS, and additional tools to help you develop your own website.

Iamthecreator OMIT/EE Solution Guide

Commented:
I was curious as to whether someone could bypass domain security - i.e get into folders they shouldn't be able to get into, by creating another account directly on the NAS

Yes you can access the folders with the local NAS accounts, if they have permissions to do so. These permissions are managed on the NAS.
Distinguished Expert 2018

Commented:
Gerlis, it's still not clear at all.
 Folders have ACLs and if you create a local user at the NAS and you let that user access a folder on purpose, where's the bypass?

Author

Commented:
Somehow i'm not being clear.  Is data on the NAS just as secure as it would be if stored on the server itself?
Distinguished Expert 2018

Commented:
Now I understand. If we are looking at share security, yes, it's as secure. If you look at aspects like data in transit encryption, the answer might be different. Do you utilize smb encryption at your server?

Author

Commented:
No SMB encryption.
Distinguished Expert 2018
Commented:
Ok.

Just update your Nas regularly, only activate options that you use and keep it physically secured and you will be fine.

Author

Commented:
Thanks

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial