We help IT Professionals succeed at work.

NAS connected to Windows Domain:

gerlis
gerlis asked
on
76 Views
Last Modified: 2019-02-05
NAS connected to Windows Domain:

We are considering connecting a QNAP NAS to a Windows Domain.  I have read the QNAP advice on how to achieve this but have some questions as to the practicality and security.

1.      Although the Windows Domain users are copied to the NAS, I wonder if an account can be setup on the NAS that would by-pass the domain security?
2.      Does access to data on the NAS require a separate login or, does the Windows login get passed through seamlessly?
Thanks
Comment
Watch Question

Iamthecreator OMIT/EE Solution Guide
CERTIFIED EXPERT

Commented:
Does access to data on the NAS require a separate login or, does the Windows login get passed through seamlessly?
When you join the QNAP to the domain you can directly add the AD security groups to the network share permissions to control the access
Its a simple and straightforward process
Although the Windows Domain users are copied to the NAS, I wonder if an account can be setup on the NAS that would by-pass the domain security?
You can always access the QNAP with the built in admin account in the WebUI (separate from the AD account). You can create and manage other local NAS accounts.
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
If the NAS device is joined to the domain, it can use domain users for authentication and thus, it will be seamless.
I don't understand question 1. If you administer the NAS, why would you want accounts other than domain accounts? If you have a reason to use other accounts, where would be the problem, why is this a bypass of domain security? There is no "domain security".

Author

Commented:
I was curious as to whether someone could bypass domain security - i.e get into folders they shouldn't be able to get into, by creating another account directly on the NAS.
Iamthecreator OMIT/EE Solution Guide
CERTIFIED EXPERT

Commented:
I was curious as to whether someone could bypass domain security - i.e get into folders they shouldn't be able to get into, by creating another account directly on the NAS

Yes you can access the folders with the local NAS accounts, if they have permissions to do so. These permissions are managed on the NAS.
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Gerlis, it's still not clear at all.
 Folders have ACLs and if you create a local user at the NAS and you let that user access a folder on purpose, where's the bypass?

Author

Commented:
Somehow i'm not being clear.  Is data on the NAS just as secure as it would be if stored on the server itself?
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Now I understand. If we are looking at share security, yes, it's as secure. If you look at aspects like data in transit encryption, the answer might be different. Do you utilize smb encryption at your server?

Author

Commented:
No SMB encryption.
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION

Author

Commented:
Thanks