Is TrueNAS Scale protected against ramsomware?

[Robert Urrutia]

I'm planning to move from Unraid to TrueNAS Scale. Everything works fine in Unraid except the lack of snapshot feature. Recently (somehow) a member of my family got their shares infected by checkmate ramsomware, luckily not much data was lost due to an offline backup. Still that has got me thinking about migrating to TrueNAS. So is it true that in a case the shares get infected I could revert those changes back with a snapshot? In a case that some shares get inffected, can the ramsomware reach server system files and encrypt the snapshots? I know most people are gonna comment "a raid is not a backup". Yes I know that pretty right, but it's easier and quicker to just restore a snapshot rather than manually backing up everything everyday and manually restoring. TIA.

[Oshino Shinobu]

As long as you keep your system up to date, you'll mostly be protected against vulnerabilites that can lead to a ransomware infection. Phishing is typically the leading cause for ransomware infections, much easier for attackers if you just give them the access they need. For shares, the more vulnerable part is going to be the endpoints that are actually accessing the shares rather than TrueNAS itself, provided you don't have TrueNAS exposed to the internet via port forwarding or such.

 

If you were hit with ransomeware, I wouldn't rely on snapshots as a reliable backup solution, I'd be advising to completely wipe and restore from a proper backup that you know if good. By all means use them for things like accidental deletion and changes, but you said it yourself, a cold/offline backup is the best DR solution for protecting against ransomware, which is something RAID and snapshots do not protect against if the server is infected.

 

Some precautions you can take is to ensure that the account you use to access the shares is not the same account that has root/priveleged access to the NAS itself.

[AbydosOne]

11 minutes ago, Robert Urrutia said:

So is it true that in a case the shares get infected I could revert those changes back with a snapshot?

Basically yes, assuming you set up a sane periodic snapshot task on all the relevant datasets.

 

12 minutes ago, Robert Urrutia said:

can the ramsomware reach server system files and encrypt the snapshots?

Given enough ingenuity, probably yes, but ransomware is looking for low-hanging fruit, and encrypting (or deleting) snapshots in a remote server is not a trivial task.

[LIGISTX]

35 minutes ago, Robert Urrutia said:

I'm planning to move from Unraid to TrueNAS Scale. Everything works fine in Unraid except the lack of snapshot feature. Recently (somehow) a member of my family got their shares infected by checkmate ramsomware, luckily not much data was lost due to an offline backup. Still that has got me thinking about migrating to TrueNAS. So is it true that in a case the shares get infected I could revert those changes back with a snapshot? In a case that some shares get inffected, can the ramsomware reach server system files and encrypt the snapshots? I know most people are gonna comment "a raid is not a backup". Yes I know that pretty right, but it's easier and quicker to just restore a snapshot rather than manually backing up everything everyday and manually restoring. TIA.

ZFS snapshots are read only, and the only way to delete them (or alter them in any way) would either be through the truenas WebUI or via sshing in. So I’m almost every case, yes, “snapshots are ransomeware proof”. Obviously, if someone tries hard enough, on a normal home network this may not always be the case as a program could attempt to scrape passwords and reach out to device, detect a truenas webUI and go to town… but this is beyond the typical set or concerns. Truenas does also support 2FA I believe, and that would go a long way against protecting against this as well. 
 

Also something to remember, ZFS snapshots are “free”; they don’t take any space assuming no data has changed. I take snapshots of my important days every 10 minutes and hold them for 6 hours, snapshot every hour and hold for a day, snapshot every day and hold for 2 weeks, snapshot every week and hold for 2 months, snapshot every month and hold for 6 months. Since I rarely delete data out of my personal files directory, this dataset and it’s snapshots take up barely any more space then just the raw data itself. If your directory has a lot more deletions and such, you may have to edit the strategy you use - I have different snapshot strategies per dataset for this reason. 

[Applefreak]

40 minutes ago, Robert Urrutia said:

I'm planning to move from Unraid to TrueNAS Scale. Everything works fine in Unraid except the lack of snapshot feature. Recently (somehow) a member of my family got their shares infected by checkmate ramsomware, luckily not much data was lost due to an offline backup. Still that has got me thinking about migrating to TrueNAS. So is it true that in a case the shares get infected I could revert those changes back with a snapshot? In a case that some shares get inffected, can the ramsomware reach server system files and encrypt the snapshots? I know most people are gonna comment "a raid is not a backup". Yes I know that pretty right, but it's easier and quicker to just restore a snapshot rather than manually backing up everything everyday and manually restoring. TIA.

I would assume that depends on what is infected. Is it the host or server or on the clients end. If a client get's infected, recovering data should be possible with a full snapshot. However you want to make sure that each clients only has access to their specific directory. If you have the resources on the server, give each Client a VM or container to work out of. Getting ransomware on the server would mean on of the admins was lazy und careless. 

[LIGISTX]

45 minutes ago, Applefreak said:

I would assume that depends on what is infected. Is it the host or server or on the clients end. If a client get's infected, recovering data should be possible with a full snapshot. However you want to make sure that each clients only has access to their specific directory. If you have the resources on the server, give each Client a VM or container to work out of. Getting ransomware on the server would mean on of the admins was lazy und careless. 

I don’t think this is quite what the OP is after. If they are using this as a NAS, usually you just have an SMB share used either as a network folder/drive, or are sending backups via either windows or some third party software. No VM or container required. Just needs to implement ZFS snapshots within truenas to snapshot the directories… and not let their truenas box be compromised either via SSH or webUI.

[wseaton]

Snapshots, be it file or volume level are the number one defense against ransomware on an enterprise level. Azure and AWS don't rely on offline backups to scrub Ransomware. 

 

An infected client can encrypt anything they have edit rights to. If their user account can edit X data, then the ransomware running in their account can encryot it. Ransonware encryption = edit rights. That simple. Doesnt matter if its windows or Linux. Same rules apply.

 

The bad ransomware outbreaks snipe somebody's admin credz and start over writing backups. Just sloppy administration. Keep passwords and admin accounts unique and you should be fine. Snapshots are the bomb for file level recovery. 

 

 

 

 

[Robert Urrutia]

Thanks everyone for sharing your thoughts, I've doing some testing with TrueNAS and seems like I'm migrating to it.