Latest NAS recommendations

Questions
1

I was reading this post from a few years ago on NAS devices: NAS + Privacy and Security

3 years is a long time in this space. I was wondering in 2026 what NAS vendors people are recommending these days.

Honestly I’m not looking for too much, just interested in storing my files at home instead of in the cloud, and storing home camera files. Basically all of my personal stuff. also interested in cutting some subscriptions.

Thanks for the thoughts!

2

I recommend TrueNAS on Ugreen hardware

3

I would recommend Unraid, especially if you want to cut subscriptions. It makes Self Hosting relatively easy and has things like Tailscale built in to make secure remote access really straightforward.

4

would prefer amnesiavpn to IPV6 home address

5

Cool

6

If you look at the vendors I would recommend Ugreen.

If you look at the software/OS site I can only recommand TrueNAS, all other systems like OMV, FreeNAS, UnRaid, ZimaOS etc. have less security and features than TrueNAS.
Otherwise, I can also recommend setting up your own NAS on a fedora, almalinux or Proxmox.

7

UnRaid is cool, but the whole security model and architecture is extremely weak and insecure.

If someone decide to use UnRaid, go for it, however please keep in mind that you should not expect security on it.

8

Interested why you think the security on Unraid is extremely weak? If the server isn’t exposed to the internet, what is it that makes it less secure than TrueNAS?

9
  • Lack of any MFA
  • Lack of any anti-bruteforce system
  • Only one admin account (root)
  • Lack of FDE on the OS disk itself
  • Lack of secure boot
  • Lack of TPM2.0
  • Lack of any file system integrity check
  • Lack of fine granular RBAC (Role based Access Control or simpler said which person is allowed to do what)
  • Everything runs as root and not isolated
    - This means all third-party plugins run directly on the system as root. Install a malicious plugin and your whole UnRaid and compromised.
    - This means also that all proccess are running as root. For example the web-server. Compromise the web-server and you have full system access.
    - The list goes on here, but I don’t see any reason to list everything
  • Docker containers installed through UnRaid are not really configured to be secure
    • Containers run as root
    • Do not have any cap. hardening
    • Having no signing, hash verification etc.
  • Lime Technology (company behind UnRaid) are having a thin security model and architecture
  • lack of mandatory access control (SELinux or AppArmor)
  • Their RAID system has not the same security against data loss and availability as for example the ZFS one.
  • Lack of any ransomware protection
  • weak encryption defaults
  • They do not store secrets securely
  • And many others
10

That’s quite a list. Presumably a fair few of those would only come into play if someone had access to your machine? If it’s not connected to the internet are things like no MFA still a risk from remote attacks?

Does TrueNAS mitigate all the above? How easy is it to install docker compose setups and connect via Tailscale on TrueNAS? Sorry for all the questions.

11

Presumably a fair few of those would only come into play if someone had access to your machine?

To be more clear if somebody can connect to your UnRaid. It is exposed, one of your devices has malware or some device in your network has malware (smart TV, smart light bubbles, smart washing machine etc.)

If it’s not connected to the internet are things like no MFA still a risk from remote attacks?

Depends on the siituation

Does TrueNAS mitigate all the above?

Besides Secure Boot and TPM2.0, yes.

How easy is it to install docker compose setups and connect via Tailscale on TrueNAS?

If you know how docker works, medium difficulty.

12

Could you elaborate a bit how you would set that up/what software you would use there? Would you use something like NextCloud or OpenCloud?

If I understand this correctly this would be the most secure approach, since e.g. Fedora uses SELinux and supports Secure Boot, right?

What about filesystems? As far as I am aware Fedora only supports Btrfs and not ZFS.

13

Could you elaborate a bit how you would set that up/what software you would use there? Would you use something like NextCloud or OpenCloud?

I mean like an actual NAS. Install the fedora server and then install every component you need.

So for example:

sudo dnf install nfs-utils samba samba-client samba-common-tool clamav lm_sensors zfs

Then you create your own ZFS pool, then setup different groups and users, configure SELinux. After that you configure SAMBA in /etc/samba/ and NFS and so on …

If I understand this correctly this would be the most secure approach, since e.g. Fedora uses SELinux and supports Secure Boot, right?

Depends on what you do else on the NAS. If you use it for more things than just a simple NAS, it might make sense to use Proxmox and have multiple VMs and in one is your NAS, the other yoru PiHole and so on.

What about filesystems? As far as I am aware Fedora only supports Btrfs and not ZFS.

As shown above you can install zfs on Fedora, but I think you need to add a third party repo for that.
So at the end you can choose BTRFS or ZFS or maybe something completely different.

14

I agree with this approach. I don’t really know what the OP expects from a NAS, but a Samba server, running bare metal on Debian, is all I need. I don’t need or want GUI. A dedicated machine seems wasteful and absurd for a single or a few users. My “NAS” is a general-purpose server that also serves as router, firewall, email server, Podman host, game server, etc.

15

I would at least put the NAS OS (debian) in an VM with hardware pass-through (depending on your setup, but probably the SATA-Controller).

The same goes for everything else, put it inside its own VM and try segmenting and isolating it.
The only thing that really should be its own hardware is the Firewall and router otherwise if your server goes down everything in your home losses’ internet.