DNS whitelist with Sandbox Browser
DNS whitelist with Sandbox Browser
  • Product
  • Solutions 
    • Remote Working
    • Stop Ransomware
    • Firewall Boosters
  • Knowledge Center
  • Resources 
    • About Us
    • News
    • FAQ
    • Sign In
  • …  
    • Product
    • Solutions 
      • Remote Working
      • Stop Ransomware
      • Firewall Boosters
    • Knowledge Center
    • Resources 
      • About Us
      • News
      • FAQ
      • Sign In
    Start Free
    DNS whitelist with Sandbox Browser
    DNS whitelist with Sandbox Browser
    • Product
    • Solutions 
      • Remote Working
      • Stop Ransomware
      • Firewall Boosters
    • Knowledge Center
    • Resources 
      • About Us
      • News
      • FAQ
      • Sign In
    • …  
      • Product
      • Solutions 
        • Remote Working
        • Stop Ransomware
        • Firewall Boosters
      • Knowledge Center
      • Resources 
        • About Us
        • News
        • FAQ
        • Sign In
      Start Free
      DNS whitelist with Sandbox Browser

      Synology NAS 2FA Setup to Reduce Attack Surface

      Learn how to easily enable two-factor authentication on Synology NAS using Approve sign-in, Verification code (OTP), and Hardware security key.

      · cybersecurity,DNS firewall,SOHO,Synology,2FA

      Set Up 2FA on Synology NAS to Reduce Attack Surface: Comprehensive Guide

      best way to secure Synology NAS DS1621

      Like any network-connected device, network-attached storage (NAS) is vulnerable to cyber threats. And according to Synology Product Security Advisory, Synology NAS had a few critical vulnerabilities with the high severity and CVSS v3 Base Score of 9+. In our previous blog, we offered several ways to protect your Synology NAS from malware, but we saved a separate spot for two-factor authentication.


      In this blog post, you’ll learn all types of the Synology NAS two-factor authentication setup process. And as a bonus, you’ll find out why Passwordless sign-in offered by Synology shouldn’t be confused with 2-factor authentication.

      How to Set Up 2FA on Synology NAS? (estimated setup time ~ 3 mins)

      1. Set up Approve sign-in for 2FA
      2. Set up Verification code (OTP) for 2FA
      3. Set up Hardware security key for 2FA

      How Do You Enforce 2FA for Synology NAS Users? (estimated setup time ~ 2 mins)
      (Advanced bonus topic) Passwordless Sign-In vs. 2-Factor Authentication

      How to Set Up 2FA on Synology NAS?

      The two-factor authentication (2FA) setup on a Synology NAS device is pretty straightforward.

      Let’s walk through the setup process for all the options, and see their differences. Start by following these steps:

      1. Click on the user icon > select Personal from the dropdown > go to the Account tab > click on 2-Factor Authentication.
        Note: You can’t set up 2FA for your account from the Control Panel.
      2-Factor Authentication

       

      If your DSM version is 6.2.4 and older, you might also see the Enable 2-step verification checkbox. If you do, click on it and follow the process.

      Enable 2-step verification

       

      If you haven’t set up your email account before, you’ll see the following pop-up window:

      Notification service

       

      If you see it, click Yes and follow the instructions. At the end of the process, click Apply and click Enable 2-step verification one more time.

      2. Synology offers THREE options to enable 2FA, here you can select which one

      Option 1: Approve sign-in

      Option 2: Verification code (OTP)

      Option 3: Hardware security key

      If you aren't sure what option to take, opt for Option 2 - the OTP. It is a good combination of convenience and security. In case you're looking for the highest level of protection, Option 3 might be more secure, but it requires investing in a hardware security key.

      Select a method for the second sign-in step

      Now let’s see the setup process for all three options.

      Option 1: Set up Approve sign-in for 2FA

      Approve Sign-In allows you to verify a login attempt via Synology Secure SignIn (a mobile app by Synology). It is available for both Android and iOS.

      To set it up, follow these steps:

      1. Click on Approve sign-in in the Set up 2-factor authentication window.
      2. Verify your account password.
      3. Next, you’ll be offered to install the Secure SignIn app. You can do that using the corresponding QR code on the screen. When done, click Next.
      4. Then, scan the QR code in a Secure SignIn app on your phone.
      5. Enter the OTP code from the app in your browser > click Next.
      6. Type in your account (backup) email address > click Next.
      7. Click Done, and you’re all set.
      Install Synology Secure SignIn

      Option 2: Set up Verification code (OTP) for 2FA

      This 2FA option supposes using a one-time password (OTP) from an authenticator app. Synology recommends setting up OTP as a backup sign-in method even if you opt for the Approve sign-in or Hardware security key options because you can use OTP sign-in even when your device is offline.

      To set it up, follow these steps:

      1. Click on Verification code (OTP) in the Set up 2-factor authentication window.
      2. Verify your account password.
      3. Next, you’ll be offered to install the Secure SignIn app. You can do that using the corresponding QR code on the screen. Click Next if you want to use another authenticator.
      4. Scan the QR code with your Secure SignIn app or an authenticator of choice.
      5. Enter the OTP code from the app in your browser > click Next.
      6. Type in your account (backup) email address > click Next.
      7. Click Done, and you’re all set.

      Option 3: Set up Hardware security key for 2FA

      This option allows you to sign in using a USB Yubico key or Touch ID in macOS .

      Before setting up the Hardware security key as your 2-factor authentication, you should configure the Dynamic Domain Name System (DDNS) by going to Control Panel > External Access > DDNS. You can check detailed instructions on how to do it in the Synology Knowledge Center.

      Then, to set up the Hardware security key, follow these steps:

      1. Click Hardware security key in the Set up 2-factor authentication window.
      2. Verify your account password.
      3. Select the key type (USB key or if on macOS select Touch ID/Face ID)
      4. Follow the instructions for your key type.
      5. At the end of the process, type in your account (backup) email address > click Next.
      6. Click Done, and you’re all set.
      Set up 2-factor authentication

      How Do You Enforce 2FA for Synology NAS Users?

      If you have admin rights, you can enforce 2-factor authentication for selected or all users. To do so, follow these steps:

      1. Go to Control Panel
      2. Open the Security tab > Account
      3. Click on Enforce 2-step verification for the following users
      4. Select specific users/groups or choose All users
      Control panel

       

      Your Synology NAS users will get the following message when signing in:

      Security request from your admin

      Synology NAS: Passwordless Sign-In vs. 2-Factor Authentication

      We recommend 2FA for Synology NAS as it is more secure. However, here we explain the differences between Passwordless Sign-In and 2-Factor Authentication for curious minds.


      As we’ve seen above, when going to Account > Personal, you can choose between Passwordless Sign-In and 2-Factor Authentication.  

      2-Factor Authentication

      Even though they both offer Approve sign-in and Hardware security key options, they aren’t interchangeable.

       

       

      Important: Passwordless Sign-In doesn’t include the second layer of account protection. It might be faster than 2-Factor Authentication, therefore, more convenient, but Passwordless Sign-In doesn’t offer an extra security barrier.

       

      Security Protection Comparison Table 

       

      Adding DNS firewall

      Two-factor authentication is crucial to enhance the security of your Synology NAS, but it still leaves your device vulnerable to several network attacks, like remote code execution (RCE). If you want to protect your privacy, prevent malware infections, and filter your web traffic, you would need a firewall. However, the majority of firewalls require long manual installation. To get a solution that protects your NAS device in one click, try DNS firewall by AP Lens for free.

      Our DNS firewall uses whitelist which stops unknown outbound traffic from your Synology. So no malware can communicate with external hosts.

       

      DNS firewall for NAS

       

      Subscribe
      Previous
      清水機是什麼?有幾多種?
      Next
       Return to site
      Cookie Use
      We use cookies to improve browsing experience, security, and data collection. By accepting, you agree to the use of cookies for advertising and analytics. You can change your cookie settings at any time. Learn More
      Accept all
      Settings
      Decline All
      Cookie Settings
      Necessary Cookies
      These cookies enable core functionality such as security, network management, and accessibility. These cookies can’t be switched off.
      Analytics Cookies
      These cookies help us better understand how visitors interact with our website and help us discover errors.
      Preferences Cookies
      These cookies allow the website to remember choices you've made to provide enhanced functionality and personalization.
      Save