Synology Security Advisor and Hardening Checklist

My home Synology, like most of them, came with friendly defaults: an admin account, SSH one checkbox away, HTTP on port 5000, and QuickConnect ready to put the web interface on the internet. Convenient for the first hour, dangerous for the following years, especially with ransomware campaigns that go after NAS devices specifically. I now run through the same list on every DSM 6.x unit, at home or in a small office.

It needs DSM 6.2 and an account in administrators, and you should tolerate a few minutes of downtime since some steps restart services. First, DSM's own tool, Security Advisor.

Run Security Advisor

Open Security Advisor from the main menu. On first launch it asks whether the NAS is for home or work use; pick work for the stricter baseline. Go to Advanced and select Scan.

The results are grouped into Malware, System, Account, Network and Update. Each finding has a Fix button or a link to the relevant Control Panel page. Typical first-run findings: the admin account is enabled, password strength rules are off, auto block is off, the default ports are in use, and DSM is not up to date. Enable a scheduled scan under Security Advisor → Advanced → Scan Schedule so you get a notification if a setting drifts later.

Accounts

Create a new administrator with a non-obvious name in Control Panel → User → Create, add it to administrators, and log in with it. Then disable the built-in account:

Control Panel → User → select admin → Edit → tick Disable this account. The guest account should already be disabled; check it while you are there.

Enforce password rules under Control Panel → User → Advanced → Password Settings: apply password strength rules, minimum length 12, include mixed case and numerals. Enable 2-step verification for administrators under Control Panel → User → Advanced → 2-Step Verification → Enforce for administrators group. If you prefer to check the result from the shell:

sudo synouser --get admin | grep -i expired

Expired: [true] on a DSM 6 system means the account is disabled.

Auto block and account protection

Control Panel → Security → Account: enable Auto Block with 5 login attempts within 5 minutes, block for a permanent duration or at least a day, and add your management subnet to the allow list. I skipped that once and locked myself out. Enable Account Protection as well; it blocks the account rather than the IP, which catches distributed attempts.

Reduce what is exposed

• Control Panel → Network → DSM Settings: change the HTTP port from 5000 and HTTPS from 5001 to something else, and tick Automatically redirect HTTP connections to HTTPS. Enable HTTP/2 and HSTS.
• Control Panel → Security → Certificate: replace the self-signed certificate with a Let's Encrypt certificate if the NAS has a DNS name (Add → Get a certificate from Let's Encrypt).
• Control Panel → Terminal & SNMP: disable Telnet. If SSH is needed, move it off port 22 and keep it disabled when not in use. Disable SNMP unless a monitoring system polls it.
• Control Panel → QuickConnect: disable it, and disable UPnP router configuration under Control Panel → External Access → Router Configuration. I use a VPN (VPN Server package with OpenVPN) to reach the NAS remotely instead, because I'd rather not have any admin page facing the internet.
• Control Panel → File Services: disable SMB1 (SMB → Advanced Settings → Minimum SMB protocol: SMB2), disable AFP and NFS if no client uses them, and turn off Bonjour/WS-Discovery on networks where discovery is not needed.
• Control Panel → Info Center → Service: review what is listening. Anything you do not recognise is a package that can be stopped in Package Center.

The firewall

Control Panel → Security → Firewall → Enable firewall, then Edit Rules on the profile. Create rules from top to bottom:

1. Allow all ports from your LAN subnet (for example 192.168.1.0/24).
2. Allow the VPN subnet to management ports only.
3. Allow specific countries or nothing else at all for the remaining services.
4. Set the final action If no rules are matched: Deny access.

Apply the profile to all interfaces. Then confirm from a machine outside the allowed subnet that the DSM port is unreachable. Firewall rules live in /usr/syno/etc/firewall.d/, but edit them from the GUI only.

Patches and backups

Control Panel → Update & Restore → Update Settings: select Automatically install important updates and check daily. Under Package Center → Settings → Auto Updates, enable automatic updates for packages too, and set Trust Level to Synology Inc. and trusted publishers.

Back up the configuration (Control Panel → Update & Restore → Configuration Backup → Back up configuration) and, more importantly, the data. Hyper Backup to a remote destination with a versioned schedule is the real defence against ransomware; enable snapshot replication with retention on Btrfs volumes so encrypted files can be rolled back.

Checking the result

Rerun Security Advisor; the goal is zero red items and only warnings you have consciously accepted (for example SSH enabled during maintenance). From the shell:

sudo netstat -tlnp | grep -vE '127.0.0.1|::1'
sudo cat /var/log/auth.log | tail -n 20

The listener list should be short, and auth.log should show only your own logins. From outside the LAN, nmap -Pn -p 5000,5001,22,23,445 your-nas-public-ip should report all filtered.

Notes from the field

• Security Advisor flags Malware: Threats detected for files in shared folders after a scan: it uses the built-in signature check. Quarantine the file, then run Antivirus Essentials from Package Center for a full scan.
• After enabling the firewall, packages like Plex or Surveillance Station stop working from other devices: add their ports (or the application entries from the built-in list) above the deny rule.
• 2-step verification locked out an administrator whose phone was lost: another administrator can disable it for that user in Control Panel → User → Edit. If none exists, the reset button on the unit restores the default admin without touching data.
• Auto Block blocked your own IP: Control Panel → Security → Account → Allow/Block List, remove the entry and add the address to the allow list.

The backups matter more than any of the rest. Everything else just makes an attacker's job harder; a versioned copy somewhere else is what saves you.