Setting Up a Secure Home NAS with Linux: A Step-by-Step Guide
Your photos, documents, and project files are sitting on a single drive—one failure away from being gone forever. Cloud storage feels convenient, until the provider has an outage or, worse, a breach. A home NAS gives you back control, and Linux makes it both affordable and secure. Here's how to build one without pulling your hair out.
Choosing the Right Linux Distribution and Hardware
You don't need expensive enterprise gear. An old desktop with a few drive bays works perfectly fine. A Raspberry Pi 4 is viable for light use, but if you plan to run Plex or handle multiple users, stick with x86 hardware and at least 8GB of RAM.
For the operating system, OpenMediaVault is the sweet spot for most people. It's Debian-based, managed through a web interface, and handles RAID and Samba out of the box. Ubuntu Server offers more flexibility if you want to run additional services like Nextcloud or Docker containers. Skip TrueNAS unless you're ready to commit to ZFS and its memory requirements.
Key Takeaway: Start with OpenMediaVault on repurposed hardware. It's the fastest path to a working, secure NAS without a steep learning curve.
Setting Up the Base System
Install the OS with minimal packages. On Ubuntu Server, uncheck everything except "OpenSSH server" during installation. Once booted, set a static IP and hostname:
sudo hostnamectl set-hostname nas
sudo nmcli con mod "Wired connection 1" ipv4.addresses 192.168.1.100/24
sudo nmcli con mod "Wired connection 1" ipv4.gateway 192.168.1.1
sudo nmcli con mod "Wired connection 1" ipv4.dns 192.168.1.1
sudo nmcli con up "Wired connection 1"
Next, enable unattended upgrades so security patches apply automatically:
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
Configuring Storage: RAID and Filesystem
RAID 1 (mirroring) is the right choice for a home NAS—two drives, one copy of your data on each. RAID 5 gives more usable space but requires at least three drives and adds complexity. Remember: RAID protects against drive failure, not accidental deletion or ransomware.
For the filesystem, ext4 is boring and reliable. Btrfs provides snapshots and checksumming, which are worth the added complexity if you're comfortable with the command line. To create a mirrored array:
sudo mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sda /dev/sdb
sudo mkfs.ext4 /dev/md0
sudo mkdir /mnt/data
sudo mount /dev/md0 /mnt/data
Add the mount to /etc/fstab with the defaults,nofail options so the system boots even if the array is missing.
Setting Up File Sharing: SMB and NFS
SMB (Samba) works with Windows, macOS, and Linux—it's your default unless you have a specific reason not to use it. NFS is faster for Linux-to-Linux connections but has weak authentication, so only use it on trusted local networks.
Install and configure Samba:
sudo apt install samba
sudo useradd -m alice
sudo smbpasswd -a alice
Edit /etc/samba/smb.conf:
[data]
path = /mnt/data
valid users = alice
read only = no
browseable = yes
Then restart the service:
sudo systemctl restart smbd
Securing Your NAS
This is where most home NAS setups fail. Don't expose SMB or NFS directly to the internet. Period.
Disable password SSH login and use keys:
ssh-keygen -t ed25519
ssh-copy-id user@nas
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd
Enable UFW, allowing only SSH and Samba from your local subnet:
sudo apt install ufw
sudo ufw allow from 192.168.1.0/24 to any port 22
sudo ufw allow from 192.168.1.0/24 to any port 445
sudo ufw enable
Encrypt the entire drive with LUKS during OS installation if possible. If you're adding a data drive later:
sudo cryptsetup luksFormat /dev/sdc
sudo cryptsetup open /dev/sdc datacrypt
For remote access, use WireGuard VPN. Install it on your NAS and your phone or laptop, then connect to the VPN before accessing files. This keeps SMB traffic off the public internet entirely.
Key Takeaway: If you can't use a VPN, you shouldn't be accessing your NAS remotely. Exposing SMB to the internet is how NAS devices get ransomware'd.
Monitoring and Maintenance
Set up SMART monitoring to catch failing drives before they die:
sudo apt install smartmontools
sudo smartctl -t long /dev/sda
Edit /etc/smartd.conf to enable email alerts on errors:
/dev/sda -m [email protected] -M test
Restart the service, then add a cron job to run short SMART tests weekly:
0 2 * * 0 /usr/sbin/smartctl -t short /dev/sda
Follow the 3-2-1 backup rule: three copies of your data, on two different media types, with one copy offsite. Your NAS is not a backup—it's the primary copy. Back it up to an external drive or a cloud provider like Backblaze B2.
FAQ
What is the best Linux distribution for a home NAS?
OpenMediaVault for simplicity, Ubuntu Server for flexibility. Both are solid choices.
Do I need RAID for a home NAS?
Not strictly, but RAID 1 with two drives is cheap insurance against drive failure. It won't save you from accidental deletion.
How can I securely access my NAS from outside my home network?
Set up WireGuard VPN on the NAS and connect through that. Never expose SMB or NFS ports to the internet.
What is the difference between SMB and NFS?
SMB works across all operating systems and is easier to secure. NFS is faster for Linux-only networks but has weaker authentication.
Can I build a NAS from a Raspberry Pi?
Yes, for light use. A Pi 4 with OpenMediaVault handles file sharing and backups fine. Don't expect great performance with Plex or heavy workloads.
What is the best filesystem for a home NAS?
ext4 for reliability, Btrfs for snapshots and checksumming. ZFS is powerful but memory-hungry and overkill for most home setups.
How do I monitor the health of my NAS drives?
Use smartmontools for SMART tests and set up email alerts. Check drive temperatures with hddtemp if your drives support it.
Ready to build your own secure home NAS? Start with a simple setup using OpenMediaVault and a couple of drives, then gradually add features like encryption and VPN. Share your experience in the comments below!