====== NAS Installation - Synology DSM 7.4 ======
===== Upgrade from DSM 6.4 =====
  * First upgrade to DSM 7.0 through //Control Panel//
  * Go to the [[https://www.synology.com/en-global/support/download|Synology Download Center]], //Select product type// and //Select your Synology Product//, then //Select DSM version// currently installed and the latest DSM version offered for this product as a target DSM version
  * Upload the downloaded update file in //Control Panel --> Update & Restore --> Manual DSM Update// and start the update
  * The update should run without issues, after which there are a few extensions which are obsolete and which you can uninstall

===== KMIP for key management =====
  * Follow the guide to install [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_security_kmip?version=7|KMIP]] on a Synology NAS server and client
  * Further guidance for [[dsm7kmip|KMIP for key management]]
  * How to setup a [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]] on Debian 13

===== Encrypted shared folders =====
  * On a NAS where encrypting the entire ''/volume1'' is not necessary or not advisable (no sensitive data, or performance concerns) you can encrypt single shared folders.
  * To avoid data in encrypted shared folders get into the wrong hands follow my guide [[deb9:encrypted|Encrypted partitions/folders with auto-mount]]. <color red>This guide is outdated, but principles still apply. I will update the guide in due time.</color>


===== Setup rescue login =====
  * Since DSM 7.2 and DS220+ and younger models Synology offers full volume encryption. This is finally the protection you need to fully protect all your data, including mail directories and user directories.
  * You need to setup the volume with encryption when you first create the volume, a non-encrypted volume cannot be encrypted in place.
  * The encryption keys will be stored in the Encryption Key Vault of the NAS, the keys will be automatically applied on boot of the system. This protects against theft or change of hard disks, but not against theft of the entire NAS. To protect against theft of the NAS you need to move the Encryption Key Vault to an external device running a KMIP server, which is supported by Synology. How to setup the KMIP server on a Synology NAS is described in [[dsm7kmip|KMIP for key management]].
  * If you do not have another Synology NAS on another location, or you do not want to use your other NAS on another location as the KMIP server, you can install a working KMIP server on a linux machine. How this is done is described in [[deb13:kmip_server_pykmip|KMIP Server (PyKMIP)]].
  * You need to take precautions in case you get locked out from your DSM because the Encrypted Key Vault is not accessible. Synology let's you login with SSH when password login is enabled even if the homes directory is not accessible (e.g. if it resides on the non-accessible encrypted volume). However, enabling password login is a security risk which I want to avoid, so I developed a method to handle this case in [[dsm7rescue|Rescue an encrypted volume]] .

===== Migrate MailPlus Server to new NAS =====
  - Backup full system configuration on your source NAS in **Control Panel --> Backup & Restore --> Configuration Backup --> Export** and save it to your local drive
  - Restore the configuation backup on your target NAS in **Control Panel --> Backup & Restore --> Configuration Backup --> Restore**, select only //Users// and //Groups// from //Users, Groups, Shared Folders, Application Privileges//, leave everything else unchecked
  - Install //Hyper Backup// on your source NAS
  - Install //Hyper Backup// and //Hyper Backup Vault// on your target NAS
  - Run a //Hyper Backup// task for application //Synology MailPlus Server// with your target NAS as destination
  - Enable ''rsync'' service on your target NAS in **Control Panel --> File Services --> rsync** on default port 22
  - Go to **Control Panel --> File Services --> Advanced --> Shared Folder Sync** on your source NAS, click //Task List// and create a manual full sync task with the (internal) IP address of your target NAS as destination
  - Do the sync before you intend to switch to the target NAS. Once everything else is setup, come back to **Shared Folder Sync** and do another full sync. The initial sync takes a while, but the follow up sync executes fast as rsync only copies files which were added or changed in the meantime.
  - Update all port forwards in your firewall to your target NAS
  - If you have a web server running on a different machine you probably keep your taget NAS behind a reverse proxy. In this case you need to update the reverse proxy settings to reach your target NAS.
  - Check your mail server by sending mail and receiving mail
  - Remove the sync task you created from your source NAS (see above) in **Control Panel --> File Services --> Advanced --> Shared Folder Sync** click //Task List//
  - Set the login portal for the mail client in **Control Panel --> Login Portal --> Applications**
  - Use ''traceroute'' to find connectivity issues to your mail server from another computer:<file>sudo traceroute -T -p 5001 your.mailserver.tld</file>
  - Set up regular backups to safeguard your MailPlus data on the new NAS using //Shared Folder Sync// and //Hyper Backup//.
  - Create a scheduled task on your target NAS to copy renewed certificates (e.g. using Let's encrypt) if your NAS is behind a reverse proxy:<code>#!/bin/sh
#
# Copy certificates from web server to NAS, must be run nas root
# (c) Bernard Condrau, 2026-08-25: adapted to DSM 7.4
#
SERVER="your_webserver_generating_certificates"
PORT=22
IDENTITY="/volume1/homes/user/.ssh/id_rsa"
# make sure your user can run rsync and cksum as root without password (check visudo)
SERVER_RSYNC="sudo rsync"
SERVER_CKSUM="sudo cksum"
SERVER_CERTDIR="/etc/letsencrypt/live/cloud.condrau.com"
# CERTDIR must be hardcoded and is different in every server instance
CERTDIR="_archive/"$(sudo cat /usr/syno/etc/certificate/_archive/DEFAULT)
CERTROOTDIR="/usr/syno/etc/certificate"
PACKAGECERTROOTDIR="/usr/local/etc/certificate"

# compare cksums first to decide whether certificates need to be copied
REM_PRIV=$(ssh -i $IDENTITY -p $PORT user@$SERVER $SERVER_CKSUM $SERVER_CERTDIR/privkey.pem | cut -d' ' -f 1)
LOC_PRIV=$(cksum $CERTROOTDIR/$CERTDIR/privkey.pem | cut -d' ' -f 1)

if [[ $LOC_PRIV -ne $REM_PRIV ]]; then

	# copy certificates from web server
	sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path="$SERVER_RSYNC" user@$SERVER:$SERVER_CERTDIR/cert.pem $CERTROOTDIR/$CERTDIR/cert.pem
	sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path="$SERVER_RSYNC" user@$SERVER:$SERVER_CERTDIR/fullchain.pem $CERTROOTDIR/$CERTDIR/fullchain.pem
	sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path="$SERVER_RSYNC" user@$SERVER:$SERVER_CERTDIR/privkey.pem $CERTROOTDIR/$CERTDIR/privkey.pem
	sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path="$SERVER_RSYNC" user@$SERVER:$SERVER_CERTDIR/chain.pem $CERTROOTDIR/$CERTDIR/chain.pem

	# push the updated archive certificates to the system and restart web services
	sudo /usr/syno/bin/synow3tool --gen-all
	sudo /usr/syno/bin/synosystemctl restart nginx

	echo "certificates updated"
else
	echo "nothing to update"
fi

exit 0</code>
  - Check basic TCP connectivity:<code>telnet [smtp_host] [port] (e.g., telnet smtp.gmail.com 587)</code>
  - Check certificate assignment in Synology DSM<code>openssl s_client -connect mail.yourdomain.tld:465 -showcerts
openssl s_client -connect mail.yourdomain.tld:993 -showcerts
openssl s_client -connect mail.yourdomain.tld:587 -starttls smtp -showcerts</code>
  - If the //verify return code: 0// is not 0 but 1 or another number, your DSM most likely does not serve the intermediate certifiate. In this case you need to do the following:
    - Go to **Control Panel --> Security --> Certificate --> Settings** and assign Synology's default certificate to //MailPlus-Server-dovcot// and //MailPlus-Server-postfix//. Click **OK** and wait 30 seconds, then set the certifiates back to your Letsencrypt certificate and hit **OK**.
    - Go to **Control Panel --> Security --> Advanced --> Custom Settings** and set //MailPlus-Server-dovcot// and //MailPlus-Server-postfix// to //Intermediate compatibility//.
    - Stop and restart //Synology MailPlus Server// and //Synology MailPlus (Client)//.
  - You can also enter ''cat /var/packages/MailPlus-Server/target/etc/main.cf | grep .pem'' and check whether ''fullchain.pem'' is referenced.
  - Re-check the certificate assignment.
  - Open **MailPlus Server** and go to **Mail Delivery --> General**. //Enable SMTP authentication// and disable external postmaster in //External Postmaster//.
  - Disable //SMTP-SSL/TLS (port 465)// in **Synology MailPlus Server --> Service**
==== Links ====
  * [[https://kb.synology.com/en-id/DSM/tutorial/How_to_migrate_MailPlus_to_another_NAS|How do I migrate MailPlus to another Synology NAS?]]
  * [[https://kb.synology.com/en-sg/DSM/tutorial/What_network_ports_are_used_by_Synology_services|What network ports are used by services on my Synology system?]]
  * [[https://kb.synology.com/en-id/DSM/help/DSM/AdminCenter/system_configbackup?version=7|Configuration Backup]]
  * [[https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/application_backupserv_sharedfoldersync?version=7|Shared Folder Sync]]