DB-유

Synology Two-Factor Authentication and Login Portal Settings

· synology, security, dsm

Whenever I see the failed-login lines in a NAS log, I remember that an internet-facing Synology is just a login page with family photos and backups behind it. A password alone isn't enough once the DSM port is exposed, and the login page deserves the same care as the accounts. I do both together: 2-step verification for every account that can log in, and a tighter login page.

You need DSM 6.2 with an administrator account, any TOTP authenticator app on your phone, and a working email address in DSM (Control Panel → Notification → Email) for the recovery flow.

2-step verification for your own account

Click your user icon (top right) → Personal → Account tab → Enable 2-step verification. Scan the QR code with the authenticator app, enter the 6-digit code, and set the emergency email. DSM shows backup codes once; store them in your password manager, not on the NAS.

From now on the login page asks for the code after the password. Ticking "Trust this device" skips the code on that browser for 30 days.

Enforce it for everyone

Enabling it for yourself does nothing for the other admin account you created during setup. Force it:

Control Panel → User → Advanced tab → 2-Step Verification section → "Enforce 2-step verification for the following users" → choose All users or Administrators group.

Users who have not set it up are walked through enrolment at their next login. Users who never log in to DSM (file-share-only accounts) can be excluded by choosing the group option.

Retire the default admin account

DSM creates admin; every brute-force script tries it first. Create a second administrator with a different name, log in as that user, then disable admin:

Control Panel → User → select admin → Edit → tick Disable this account.

Check first that no scheduled task or backup job runs as admin (Task Scheduler and Hyper Backup both show the running user).

Login page settings

The DSM login page is configured in Control Panel → Network → DSM Settings:

  • Change the HTTP/HTTPS ports from 5000/5001 to something else. It does not stop a targeted attacker but removes the NAS from the mass scanners that only try the defaults.
  • Tick Automatically redirect HTTP connections to HTTPS.
  • Under Control Panel → Security → Security tab, set Logout timer to 15 minutes and enable Improve protection against cross-site request forgery attacks.

If services such as File Station or Drive are published under their own hostnames, use Control Panel → Application Portal → Reverse Proxy, and keep the DSM port itself closed on the router. Then only the specific applications are exposed, not the full desktop.

Block brute-force attempts

Control Panel → Security → Account → Enable auto block: 5 attempts within 5 minutes, block for 1 day. Add your LAN subnet to the allow list so a mistyped password at home does not lock you out. Trusted IPs are listed on the same tab.

You can watch the result in Log Center → Log → filter "Connection":

Failed to log in via [DSM] from [185.x.x.x] as [admin]
Host [185.x.x.x] was blocked via [DSM]

Test it from outside

From a phone on mobile data (outside your LAN), open the DSM address. You should get: HTTPS only, the custom port, a code prompt after the password, and no admin login possible. Then try five wrong passwords deliberately from that connection and confirm the address appears under Security → Account → Block list.

When it goes wrong

  • Lost the phone. Use "Forgot verification code" on the login page; DSM emails a one-time code to the emergency address. If notifications were never configured, log in from the LAN as another administrator, open Control Panel → User → Edit → untick 2-step verification for the locked user.
  • Codes are rejected although the app is right. The NAS clock has drifted. Control Panel → Regional Options → Time → synchronise with an NTP server. TOTP tolerates only about 30 seconds of skew.
  • Blocked yourself. From the LAN (allow-listed) open Security → Account → Block list and remove the IP. If the LAN is not allow-listed, SSH in and run sudo synowebapi --exec api=SYNO.Core.Security.AutoBlock method=clear version=1.
  • Mobile apps stop logging in after enforcement. DS file, DS photo and Synology Drive all support the code prompt; update the app if it does not show one.

None of this is exotic. Two-step on every login, a renamed administrator, non-default ports and auto block are enough to stop the automated noise, which is nearly everything in the log. I'd do the 2-step part first if you only have ten minutes.