Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
| syno:dsm7kmip [2026/09/01 11:54] – created Bernard Condrau | syno:dsm7kmip [2026/09/01 13:58] (current) – [DSM as Client] Bernard Condrau | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== NAS Installation - Synology DSM 7.4 ====== | + | ====== KMIP for key management |
| - | ===== Upgrade from DSM 6.4 ===== | + | |
| - | * First upgrade to DSM 7.0 through //Control Panel// | + | |
| - | * Go to the [[https:// | + | |
| - | * Upload the downloaded update file in //Control Panel --> Update & Restore --> Manual DSM Update// and start the update | + | |
| - | * The update should run without issues, after which there are a few extensions which are obsolete and which you can uninstall | + | |
| - | + | ||
| - | ===== KMIP for key management ===== | + | |
| * Follow the guide to install [[https:// | * Follow the guide to install [[https:// | ||
| - | ==== Certificates ==== | + | ===== Certificates |
| - | - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, | + | - The default, out-of-the-box self-signed Synology certificate will fail on DSM 7.4 and later, which hardened the certificate requirements. You will generate matching certificates from an official Synology script, which will be installed alongside the default certificates, |
| - Login to your NAS on the command line with SSH and elevate to root | - Login to your NAS on the command line with SSH and elevate to root | ||
| - Download Synology' | - Download Synology' | ||
| Line 22: | Line 15: | ||
| server-key.pem | server-key.pem | ||
| server.pem</ | server.pem</ | ||
| - | ==== DSM as Server ==== | + | ===== DSM as Server |
| - go to //Control Panel > Security > Certificate// | - go to //Control Panel > Security > Certificate// | ||
| - Click //Add//, choose //Import Certificate//, | - Click //Add//, choose //Import Certificate//, | ||
| Line 36: | Line 29: | ||
| - Add a port forward for port 5696 to your server NAS | - Add a port forward for port 5696 to your server NAS | ||
| - | ==== DSM as Client ==== | + | ===== DSM as Client |
| - go to //Control Panel > Security > Certificate// | - go to //Control Panel > Security > Certificate// | ||
| - Click //Add//, choose //Import Certificate//, | - Click //Add//, choose //Import Certificate//, | ||
| Line 47: | Line 40: | ||
| - Upload the certificate authority file '' | - Upload the certificate authority file '' | ||
| - Now you need to go to **Storage Manager --> Storage** and click //Global Settings//. Scroll down to **Encryption Key Vault** and click //Reset// (important!) to make the switch to the KMIP Server permanent and move the encryption keys. | - Now you need to go to **Storage Manager --> Storage** and click //Global Settings//. Scroll down to **Encryption Key Vault** and click //Reset// (important!) to make the switch to the KMIP Server permanent and move the encryption keys. | ||
| + | - Go to **Control Panel --> Security --> KMIP**, check //Set as remote key client//, and make sure your KMIP Server with uploaded Synology certificates is running (either Synology DSM, or PyKMIP on Debian, or a commercial KMIP Server) | ||
| + | - Enter the following credentials. Note that every time you edit the connection you need to upload the // | ||
| - | ==== How to gain access to encrypted volumes when the KMIP Server was unavailable during DSM boot ==== | + | ===== How to gain access to encrypted volumes when the KMIP Server was unavailable during DSM boot ===== |
| * If you can re-establish connection to the KMIP Server you can do the following: | * If you can re-establish connection to the KMIP Server you can do the following: | ||
| - SSH into DSM | - SSH into DSM | ||
| Line 58: | Line 53: | ||
| - If your locked volume is not the same volume where your user home directories reside you can go to the **Storage Manager** and select the locked volume, then click the ellipsis (...) icon, and select //Unlock//. Upload your '' | - If your locked volume is not the same volume where your user home directories reside you can go to the **Storage Manager** and select the locked volume, then click the ellipsis (...) icon, and select //Unlock//. Upload your '' | ||
| - | ==== Recover an encrypted volume using an SSH shell ==== | + | ===== Recover an encrypted volume using an SSH shell ===== |
| * If you can not re-establish connection to the KMIP Server you can do the following: | * If you can not re-establish connection to the KMIP Server you can do the following: | ||
| - Identify the Target Device Node | - Identify the Target Device Node | ||
| Line 74: | Line 69: | ||
| * Your data is now fully unencrypted and accessible in plain text at ''/ | * Your data is now fully unencrypted and accessible in plain text at ''/ | ||
| - | ==== How to Regenerate and Download a Recovery Key ==== | + | ===== How to Regenerate and Download a Recovery Key ===== |
| - Open **Storage Manager** in Synology DSM | - Open **Storage Manager** in Synology DSM | ||
| - Go to **Storage** and click on your encrypted volume | - Go to **Storage** and click on your encrypted volume | ||
| Line 87: | Line 82: | ||
| * [[https:// | * [[https:// | ||
| - | ===== Setup rescue login ===== | ||
| - | * Since DSM 7.2 and DS220+ and younger models Synology offers full volume encryption. This is finally the protection you need to fully protect all your data, including mail directories and user directories. | ||
| - | * You need to setup the volume with encryption when you first create the volume, a non-encrypted volume cannot be encrypted in place. | ||
| - | * The encryption keys will be stored in the Encryption Key Vault of the NAS, the keys will be automatically applied on boot of the system. This protects against theft or change of hard disks, but not against theft of the entire NAS. To protect against theft of the NAS you need to move the Encryption Key Vault to an external device running a KMIP server, which is supported by Synology. How to setup the KMIP server is described in [[caldav|CalDAV - Calendar]]. | ||
| - | |||
| - | ===== Migrate MailPlus Server to new NAS ===== | ||
| - | - Backup full system configuration on your source NAS in **Control Panel --> Backup & Restore --> Configuration Backup --> Export** and save it to your local drive | ||
| - | - Restore the configuation backup on your target NAS in **Control Panel --> Backup & Restore --> Configuration Backup --> Restore**, select only //Users// and //Groups// from //Users, Groups, Shared Folders, Application Privileges//, | ||
| - | - Install //Hyper Backup// on your source NAS | ||
| - | - Install //Hyper Backup// and //Hyper Backup Vault// on your target NAS | ||
| - | - Run a //Hyper Backup// task for application //Synology MailPlus Server// with your target NAS as destination | ||
| - | - Enable '' | ||
| - | - Go to **Control Panel --> File Services --> Advanced --> Shared Folder Sync** on your source NAS, click //Task List// and create a manual full sync task with the (internal) IP address of your target NAS as destination | ||
| - | - Do the sync before you intend to switch to the target NAS. Once everything else is setup, come back to **Shared Folder Sync** and do another full sync. The initial sync takes a while, but the follow up sync executes fast as rsync only copies files which were added or changed in the meantime. | ||
| - | - Update all port forwards in your firewall to your target NAS | ||
| - | - If you have a web server running on a different machine you probably keep your taget NAS behind a reverse proxy. In this case you need to update the reverse proxy settings to reach your target NAS. | ||
| - | - Check your mail server by sending mail and receiving mail | ||
| - | - Remove the sync task you created from your source NAS (see above) in **Control Panel --> File Services --> Advanced --> Shared Folder Sync** click //Task List// | ||
| - | - Set the login portal for the mail client in **Control Panel --> Login Portal --> Applications** | ||
| - | - Use '' | ||
| - | - Set up regular backups to safeguard your MailPlus data on the new NAS using //Shared Folder Sync// and //Hyper Backup//. | ||
| - | - Create a scheduled task on your target NAS to copy renewed certificates (e.g. using Let's encrypt) if your NAS is behind a reverse proxy:< | ||
| - | # | ||
| - | # Copy certificates from web server to NAS, must be run nas root | ||
| - | # (c) Bernard Condrau, 2026-08-25: adapted to DSM 7.4 | ||
| - | # | ||
| - | SERVER=" | ||
| - | PORT=22 | ||
| - | IDENTITY="/ | ||
| - | # make sure your user can run rsync and cksum as root without password (check visudo) | ||
| - | SERVER_RSYNC=" | ||
| - | SERVER_CKSUM=" | ||
| - | SERVER_CERTDIR="/ | ||
| - | # CERTDIR must be hardcoded and is different in every server instance | ||
| - | CERTDIR=" | ||
| - | CERTROOTDIR="/ | ||
| - | PACKAGECERTROOTDIR="/ | ||
| - | |||
| - | # compare cksums first to decide whether certificates need to be copied | ||
| - | REM_PRIV=$(ssh -i $IDENTITY -p $PORT user@$SERVER $SERVER_CKSUM $SERVER_CERTDIR/ | ||
| - | LOC_PRIV=$(cksum $CERTROOTDIR/ | ||
| - | |||
| - | if [[ $LOC_PRIV -ne $REM_PRIV ]]; then | ||
| - | |||
| - | # copy certificates from web server | ||
| - | sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path=" | ||
| - | sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path=" | ||
| - | sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path=" | ||
| - | sudo rsync -aPLe "ssh -i $IDENTITY -p $PORT" --rsync-path=" | ||
| - | |||
| - | # push the updated archive certificates to the system and restart web services | ||
| - | sudo / | ||
| - | sudo / | ||
| - | |||
| - | echo " | ||
| - | else | ||
| - | echo " | ||
| - | fi | ||
| - | |||
| - | exit 0</ | ||
| - | ==== Links ==== | ||
| - | * [[https:// | ||
| - | * [[https:// | ||
| - | * [[https:// | ||
| - | * [[https:// | ||