Question: I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files.
Some extras include:

* ssh, ftp, telnet, mail servers
* photo gallery (directly from the NAS!)
* mysql/php (can even run a website from there)
* and much more

On the specs side it looks awesome as a LAN server but it's possible to access those services also from the Internet. And now, I'm wondering how safe that is, considering you're actually putting multiple servers and, not to forget, all your personal files stored in that device, *on the Internet*.

I've done a bit a research and ssh access could be hardened using 2-step authentication, but not sure about the other services, unless they all have to go through ssh?

I would appreciate your view on this and other possible ways to make your home NAS secure.

Answer: 
A NAS is a computer. It has a "smaller" CPU (usually an ARM in the 200 MHz range) but it still runs a "normal" operating system (often a Linux derivative) with all its normal software and assorted vulnerabilities. When a SSH server has a buffer overflow, it is vulnerable, even if the outer box does not "look like" a computer.

To be considered secure, a NAS, just like any other computer, must be managed, with prompt installation of security fixes. This is where the problem lies: *contrary* to what happens with full-fledge desktop computers, NAS vendors rarely distribute security patches on a daily basis. There is an inherent latency which means that when a vulnerability is found, attackers have a few weeks (or months !) of head start before the fix is packaged and installed in the majority of deployed devices. This is a rather big issue. It turns 0-day exploits into 0-month exploits.

My advice would be to refrain from putting such a device "on the Internet" unless you replace the OS with another one which you control, and offers low-latency security updates (and, of course, you *do* check them and install them with all due alacrity). For instance, you can install [Debian on QNAP NAS](http://wiki.qnap.com/wiki/Debian_Installation_On_QNAP).
Don't put on the internet if you don't need it. If you do need it make all the other services only available locally and only allow ssh from the internet. You can then make a tunnel through ssh and access your other services through that tunnel.

Do mind that it is a ***HOME*** NAS so better keep it on your LAN.