Automatic unlock QNAP volumes from network

By | 2020-05-24

Automatically unlock encrypted volumes in QNAP via network using a BASH-script in a Cron-job. This script will log on, list locked drives and unlock them.

Data stored on the disks are encrypted, and you need a key do access the disks. The key is kept in memory, so if power is lost the disks are no longer unlocked.

This is an effective protection against thieves that gain physical access to the building. If they unplug and steal the NAS the data is encrypted. Encryption should be combined with offsite backup, i.e. to the cloud, which is also supported by QNAP.

To unlock the drives you have two alternatives: Log on to the web interface and enter the key, or let QNAP remember the key and automatically unlock. Letting QNAP remember it defeats much of the purpose, as the drives will be unlocked when power is plugged back in. Also, depending on how it is stored, it might require moderate Linux skills to change admin password and gain full access.

So to solve this I threw together a script running from a remote location that will unlock my encrypted drives. You can also run it from a Raspberry PI or any other device capable of BASH+Perl+curl+Python. Since Raspberry PI support wireless you can hide the unlock device anywhere within range of the wireless network, making it unlikely to be stolen together with the QNAP.

This is a quick and dirty hack, but it has worked for a couple of years for me. I simplified the script a bit for ease of use; if you have different keys for different volumes you can use the ${VOL} instead of ${VPASS} and set keys accordingly.

USER and PASS are login details for logging on to your QNAP NAS web interface. The user needs to have enough rights to actually unlock the volumes. VPASS is the encryption key needed for unlocking the volumes. HOST is the URL for your QNAP NAS, for example https://10.0.0.5 or https://mynas.local/

I run this in a cron-job every 10 minutes. The 30 second sleep is not required, but you should keep a few seconds at least. Note that contrary to what the QNAP web interface allows, drives can be unlocked simultaneously and relatively fast. They are usable long before they reach 100% in unlock operation, but unlocking multiple is still slow.

Leave a Reply

Your email address will not be published. Required fields are marked *