Question: I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files.
Some extras include:

* ssh, ftp, telnet, mail servers
* photo gallery (directly from the NAS!)
* mysql/php (can even run a website from there)
* and much more

On the specs side it looks awesome as a LAN server but it's possible to access those services also from the Internet. And now, I'm wondering how safe that is, considering you're actually putting multiple servers and, not to forget, all your personal files stored in that device, *on the Internet*.

I've done a bit a research and ssh access could be hardened using 2-step authentication, but not sure about the other services, unless they all have to go through ssh?

I would appreciate your view on this and other possible ways to make your home NAS secure.

Answer: 
QNAP devices have a very limited ssh server installed as standard - you have to login as admin (i.e. root access), which is a risk in itself.
You can replace with openssh - see instructions here: <http://wiki.qnap.com/wiki/How_To_Replace_SSH_Daemon_With_OpenSSH>

however be very careful to change the guest account password. I learnt this to my cost when I noticed multiple unwelcome external users logged in as guest!

You can also harden the openssh config to deny password access, and only permit access with public key exchange.
Do you intend to put your family photos, music library, ripped DVD collection and house documents onto the NAS?

If so, how much would it matter to you if:

* They were all over the internet.
* They were all erased.

If either of these matter to you, you'd be best not to poke a hole in your firewall exposing this NAS to the internet.

If these things just don't matter, can you isolate the NAS from the rest of your home devices, e.g. a 'home DMZ'? In that way, if the NAS is compromised, your internet access and other home devices are not at risk.