How to Protect a Server: 6 Practical Methods
Servers
02.12.2024
Reading time: 8 min
Share
Any IT infrastructure requires robust protection. While information security is a vast topic, there are basic steps that can safeguard against attacks from amateur hackers and bots. This article outlines six straightforward methods to protect your server effectively.
Tools and Methods of Protection
Securing a server from breaches involves a combination of measures. These can be categorized into the following areas:
- Securing communication channels used for system administration and operation.
- Implementing multi-layered security for the system.
- Restricting access to infrastructure resources.
- Monitoring and auditing system activities.
- Backing up data.
- Timely updates or rollbacks of software.
- Antivirus protection for servers.
Below, we detail six practical methods to achieve a robust security level against amateur attackers and bots.
Privilege Restriction
When managing access to resources, follow the principle of least privilege: users and processes should only have the minimal permissions necessary to perform their tasks. This is particularly important for databases and operating systems. This approach not only prevents unauthorized external access but also mitigates risks from internal threats.
-
Separate Accounts for Administrators: Create individual accounts for each admin. Use non-privileged accounts for operations that don’t require elevated permissions.
-
Active Directory: In environments using Microsoft Active Directory, regularly audit and configure group policies. Mismanagement of these policies can lead to severe security breaches, especially if exploited by a malicious admin or hacker.
-
Minimize Root Usage in Unix Systems: Avoid working as the
rootuser. Instead, disable the root account and use thesudoprogram for tasks requiring elevated permissions.
To customize sudo behavior, modify the /etc/sudoers file using the visudo command. Below are two useful directives for monitoring sudo activity.
By default, sudo logs to syslog. To store logs in a separate file for better clarity, add the following to /etc/sudoers:
Defaults log_host, log_year, logfile="/var/log/sudo.log"This directive records command logs, along with input and output (stdin, stdout, stderr), into /var/log/sudo-io:
Defaults log_host, log_year, logfile="/var/log/sudo.log"For a deeper dive into managing the sudoers file, check this guide.
Mandatory Access Control (MAC)
This recommendation focuses on Linux systems and builds upon the principle of access control. Many Linux administrators rely solely on discretionary access control (DAC) mechanisms, which are basic and always active by default. However, several Linux distributions include mandatory access control (MAC) mechanisms, such as AppArmor in Ubuntu and SELinux in RHEL-based systems.
While MAC requires more complex configuration of the OS and services, it allows for granular access control to filesystem objects, significantly enhancing the server's security.
Remote Administration of Operating Systems
When remotely administering an operating system, always use secure protocols:
- For Windows, use RDP (Remote Desktop Protocol).
- For Linux, use SSH (Secure Shell).
Although these protocols are robust, additional measures can further strengthen security.
For RDP, you can block connections of accounts with blank passwords. You can configure it via Local Security Policy under the setting:
Accounts: Limit local account use of blank passwords to console logon only.RDP sessions can be protected with the secure TLS transport protocol, which will be discussed later.
By default, SSH user authentication relies on passwords. Switching to SSH key-based authentication provides stronger protection, as a long key is far more difficult to brute-force than a password. Additionally, key-based authentication eliminates the need to enter a password during login since the key is stored on the server.
Setting up keys requires only a few simple steps:
Generate a key pair on your local machine:
ssh-keygen -t rsaCopy the public key to the remote server:
ssh-copy-id username@remote_addressIf key-based authentication is not an option, consider implementing Fail2ban. This tool monitors failed login attempts and blocks the IP addresses of attackers after a specified number of failed attempts.
Additionally, changing default ports can help reduce the likelihood of automated attacks:
- Default SSH port 22/tcp → Choose a non-standard port.
- Default RDP port 3389/tcp → Use a custom port.
Firewall Configuration
A robust security system is layered. Relying solely on access control mechanisms is insufficient; it is more logical to manage network connections before they reach your services. This is where firewalls come in.
A firewall provides network-level access control to segments of the infrastructure. The firewall decides which traffic to permit through the perimeter based on a specific set of allow rules. Any traffic that does not match these rules is blocked. In Linux, the firewall is integrated into the kernel (via netfilter), and you can manage using a frontend tool such as nftables, iptables, ufw, or firewalld.
The first step in configuring a firewall is to close unused ports and keep only those that are intended for external access. For instance, a web server typically requires ports 80 (HTTP) and 443 (HTTPS) to remain open. While an open port itself is not inherently dangerous (the risk lies in the program behind the port), it is still better to eliminate unnecessary exposure.
In addition to securing the external perimeter, firewalls can segment infrastructure and control traffic between these segments. If you have public-facing services, consider isolating them from internal resources by using a DMZ (Demilitarized Zone). Additionally, it’s worth exploring Intrusion Detection and Prevention Systems (IDS/IPS). These solutions work on the opposite principle: they block security threats while allowing all other traffic through.
Hostman offers a cloud firewall that provides cutting-edge defense for your server.
Virtual Private Networks (VPNs)
Up until now, we have focused on protecting a single server. Let’s now consider securing multiple servers. The primary purpose of a Virtual Private Network (VPN) is to provide secure connectivity between organizational branches. Essentially, a VPN creates a logical network over an existing network (e.g., the Internet). Its security is ensured through cryptographic methods, so the protection of connections does not depend on the underlying network's security.
There are many protocols available for VPNs, and the choice depends on the size of the organization, network architecture, and required security level.
-
PPTP (Point-to-Point Tunneling Protocol) is a simple option for a small business or home network, as it is widely supported on routers and mobile devices. However, its encryption methods are outdated.
-
For high-security needs and site-to-site connections, protocols like IPsec are suitable.
-
For site-to-host connections, options like WireGuard are more appropriate. WireGuard and similar protocols provide advanced security but require more intricate configuration compared to PPTP.
TLS and Public Key Infrastructure (PKI)
Many application-layer protocols, such as HTTP, FTP, and SMTP, were developed in an era when networks were limited to academic institutions and military organizations long before the invention of the web. These protocols transmit data in plaintext. To ensure the security of a website, web control panels, internal services, or email, you should use TLS.
TLS (Transport Layer Security) is a protocol designed to secure data transmission over an untrusted network. While the term SSL (e.g., SSL certificates, OpenSSL package) is often mentioned alongside TLS, it’s important to note that the modern versions of the protocol are TLS 1.2 and TLS 1.3. Earlier versions of TLS and its predecessor, SSL, are now considered obsolete.
TLS provides privacy, data integrity, and resource authentication. Authentication is achieved through digital signatures and the Public Key Infrastructure (PKI). PKI functions as follows: the server's authenticity is verified using an SSL certificate, which is signed by a Certificate Authority (CA). The CA’s certificate is, in turn, signed by a higher-level CA, continuing up the chain. The root CA certificates are self-signed, meaning their trust is implicitly assumed.
TLS can also be used with Virtual Private Networks (VPNs), such as setting up client authentication using SSL certificates or a TLS handshake. In this case, it would be necessary to organize your own PKI within the local network, including a CA server, as well as the keys and certificates for network nodes.
The Dangers of Attackers
The level of threat depends on the type of attack. Cyberattacks can be broadly categorized into two main types.
- Breaching the Security Perimeter
This type of attack involves gaining unauthorized access to the account of an authenticated user of a service or system, such as a database. Breaches of privileged accounts pose significant risks because attackers gain the ability to view sensitive information and modify system parameters. The most critical type of breach involves gaining unauthorized access to the superuser account of the operating system, potentially compromising a significant portion of the infrastructure.
- Disabling Systems
This category of attacks aims to disrupt system operations rather than steal data, but it is no less dangerous. The most prominent example is a DoS (Denial of Service) or DDoS (Distributed Denial of Service) attack. These attacks overload the server with a flood of requests, causing it to fail and become unresponsive to legitimate users. In some cases, a DoS attack serves as a precursor to other forms of cyberattacks.
The results of cyberattacks often include data breaches, financial losses, and reputational damage. For this reason, even the most basic level of security should be implemented when establishing an IT infrastructure.
Servers
02.12.2024
Reading time: 8 min
Share
Similar
Ubuntu
How to Install VNC on Ubuntu
If you need to interact with a remote server through a graphical interface, you can use VNC technology.VNC (Virtual Network Computing) allows users to establish a remote connection to a server over a network. It operates on a client-server architecture and uses the RFB protocol to transmit screen images and input data from various devices (such as keyboards or mice). VNC supports multiple operating systems, including Ubuntu, Windows, macOS, and others. Another advantage of VNC is that it allows multiple users to connect simultaneously, which can be useful for collaborative work on projects or training sessions.
In this guide, we will describe how to install VNC on Ubuntu, using a Hostman cloud server with Ubuntu 22.04 as an example.
Step 1: Preparing to Install VNC
Before starting the installation process on both the server and the local machine, there are a few prerequisites to review.
Here is a list of what you’ll need to complete the installation:
A Server Running Ubuntu 22.04. In this guide, we will use a cloud server from Hostman with minimal hardware configuration.
A User with sudo Privileges. You should perform the installation as a regular user with administrative privileges.
Select a Graphical Interface. You’ll need to choose a desktop environment that you will use to interact with the remote server after installing the system on both the server and the local machine.
A Computer with a VNC Client Installed.
Currently, the only way to communicate with a rented server running Ubuntu 22.04 is through the console. To enable remote management via a graphical interface, you’ll need to install a desktop environment along with VNC on the server. Below are lists of available VNC servers and desktop environments that can be installed on an Ubuntu server.
VNC Servers:
TightVNC Server. One of the most popular VNC servers for Ubuntu. It is easy to set up and offers good performance.
RealVNC Server. RealVNC provides a commercial solution for remote access to servers across various Linux distributions, including Ubuntu, Debian, Fedora, Arch Linux, and others.
Desktop Environments:
Xfce. A lightweight and fast desktop environment, ideal for remote sessions over VNC. It uses fewer resources than heavier desktop environments, making it an excellent choice for servers and virtual machines.
GNOME. The default Ubuntu desktop environment, offering a modern and user-friendly interface. It can be used with VNC but will consume more resources than Xfce.
KDE Plasma. Another popular desktop environment that provides a wide range of features and a beautiful design.
The choice of VNC server and desktop environment depends on the user’s specific needs and available resources. TightVNC and Xfce are excellent options for stable remote sessions on Ubuntu, as they do not require high resources. In the next step, we will describe how to install them on the server in detail.
Step 2: Installing the Desktop Environment and VNC Server
To install the VNC server on Ubuntu along with the desktop environment, connect to the server and log in as a regular user with administrative rights.
Update the Package List
After logging into the server, run the following command to update the packages from the connected repositories:
sudo apt update
Install the Desktop Environment
Next, install the previously selected desktop environment. To install Xfce, enter:
sudo apt install xfce4 xfce4-goodies
Here, the first package provides the basic Xfce desktop environment, while the second includes additional applications and plugins for Xfce, which are optional.
Install the TightVNC Server
To install TightVNC, enter:
sudo apt install tightvncserver
Start the VNC Server
Once the installation is complete, initialize the VNC server by typing:
vncserver
This command creates a new VNC session with a specific session number, such as :1 for the first session, :2 for the second, and so on. This session number corresponds to a display port (for example, port 5901 corresponds to :1). This allows multiple VNC sessions to run on the same machine, each using a different display port.
During the first-time setup, this command will prompt you to set a password, which will be required for users to connect to the server’s graphical interface.
Set the View-Only Password (Optional)
After setting the main password, you’ll be prompted to set a password for view-only mode. View-only mode allows users to view the remote desktop without making any changes, which is helpful for demonstrations or when limited access is needed.
If you need to change the passwords set above, use the following command:
vncpasswd
Now you have a VNC session.
In the next step, we will set up VNC to launch the Ubuntu server with the installed desktop environment.
Step 3: Configuring the VNC Server
The VNC server needs to know which desktop environment it should connect to. To set this up, we’ll need to edit a specific configuration file.
Stop Active VNC Instances
Before making any configurations, stop any active VNC server instances. In this guide, we’ll stop the instance running on display port 5901. To do this, enter:
vncserver -kill :1
Here, :1 is the session number associated with display port 5901, which we want to stop.
Create a Backup of the Configuration File
Before editing, it’s a good idea to back up the original configuration file. Run:
mv ~/.vnc/xstartup ~/.vnc/xstartup.bak
Edit the Configuration File
Now, open the configuration file in a text editor:
nano ~/.vnc/xstartup
Replace the contents with the following:
#!/bin/bashxrdb $HOME/.Xresourcesstartxfce4 &
#!/bin/bash – This line is called a "shebang," and it specifies that the script should be executed using the Bash shell.
xrdb $HOME/.Xresources – This line reads settings from the .Xresources file, where desktop preferences like colors, fonts, cursors, and keyboard options are stored.
startxfce4 & – This line starts the Xfce desktop environment on the server.
Make the Configuration File Executable
To allow the configuration file to be executed, use:
chmod +x ~/.vnc/xstartup
Start the VNC Server with Localhost Restriction
Now that the configuration is updated, start the VNC server with the following command:
vncserver -localhost
The -localhost option restricts connections to the VNC server to the local host (the server itself), preventing remote connections from other machines. You will still be able to connect from your computer, as we’ll set up an SSH tunnel between it and the server. These connections will also be treated as local by the VNC server.
The VNC server configuration is now complete.
Step 4: Installing the VNC Client and Connecting to the Server
Now, let’s proceed with installing a VNC client. In this example, we’ll install the client on a Windows 11 computer.
Several VNC clients support different operating systems. Here are a few options:
RealVNC Viewer. The official client from RealVNC, compatible with Windows, macOS, and Linux.
TightVNC Viewer. A free and straightforward VNC client that supports Windows and Linux.
UltraVNC. Another free VNC client for Windows with advanced remote management features.
For this guide, we’ll use the free TightVNC Viewer.
Download and Install TightVNC Viewer
Visit the official TightVNC website, download the installer, and run it.
In the installation window, click Next and accept the license agreement.
Then, select the custom installation mode and disable the VNC server installation, as shown in the image below.
Click Next twice and complete the installation of the VNC client on your local machine.
Set Up an SSH Tunnel for Secure Connection
To encrypt your remote access to the VNC server, use SSH to create a secure tunnel. On your Windows 11 computer, open PowerShell and enter the following command:
ssh -L 56789:localhost:5901 -C -N -l username server_IP_address
Make sure that OpenSSH is installed on your local machine; if not, refer to Microsoft’s documentation to install it.
This command configures an SSH tunnel that forwards the connection from your local computer to the remote server over a secure connection, making VNC believe the connection originates from the server itself. Here’s a breakdown of the flags used:
-L sets up SSH port forwarding, redirecting the local computer’s port to the specified host and server port. Here, we choose port 56789 because it is not bound to any service.
-C enables compression of data before transmitting over SSH.
-N tells SSH not to execute any commands after establishing the connection.
-l specifies the username for connecting to the server.
Connect with TightVNC Viewer
After creating the SSH tunnel, open the TightVNC Viewer and enter the following in the connection field:
localhost:56789
You’ll be prompted to enter the password created during the initial setup of the VNC server.
Once you enter the password, you’ll be connected to the VNC server, and the Xfce desktop environment should appear.
Stop the SSH Tunnel
To close the SSH tunnel, return to the PowerShell or command line on your local computer and press CTRL+C.
Conclusion
This guide has walked you through the step-by-step process of setting up VNC on Ubuntu 22.04. We used TightVNC Server as the VNC server, TightVNC Viewer as the client, and Xfce as the desktop environment for user interaction with the server.
We hope that using VNC technology helps streamline your server administration, making the process easier and more efficient.
We're prepared more detailed instruction on how to create server on Ubuntu if you have some trouble deploying it.
30 May 2025 · 8 min to read
Servers
How to Correct Server Time
The method you choose for correcting the time on your server depends on how far off the server's clock is. If the difference is small, use the first method. If the clock is significantly behind or ahead, it's better not to adjust it in a single step — it's safer to change the time gradually.
Configuration on Ubuntu/Debian
Quick Fix
To quickly change the time on the server, use the ntpdate utility. You need sudo privileges to install it:
apt-get install ntpdate
To update the time once:
/usr/sbin/ntpdate 1.north-america.pool.ntp.org
Here, the NTP pool is the address of a trusted server used to synchronize the time. For the USA, you can use NTP servers from this page. You can find pool zones for other regions at ntppool.org.
You can also set up automatic time checks using cron:
crontab -e
00 1 * * * /usr/sbin/ntpdate 1.north-america.pool.ntp.org
This schedules synchronization once a day.
Instead of a set interval, you can specify a condition. For example, to synchronize the time on every server reboot using cron reboot:
crontab -e
@reboot /usr/sbin/ntpdate 1.north-america.pool.ntp.org
Gradual Correction
To update the time gradually, install the ntp utility on Ubuntu or Debian. It works as follows:
The utility checks data from synchronization servers defined in the configuration.
It calculates the difference between the current system time and the reference time.
NTP gradually adjusts the system clock. This gradual correction helps avoid issues in other services caused by sudden time jumps.
Install NTP:
apt-get install ntp
For the utility to work correctly, configure it in the file /etc/ntp.conf. Add NTP servers like:
server 0.north-america.pool.ntp.org
server 1.north-america.pool.ntp.org iburst
server 2.north-america.pool.ntp.org
server 3.north-america.pool.ntp.org
The iburst option improves accuracy by sending multiple packets at once instead of just one.
You can also set a preferred data source using the prefer option:
server 0.ubuntu.pool.ntp.org iburst prefer
After each configuration change, restart the utility:
/etc/init.d/ntp restart
Configuration on CentOS
The method choice rules are the same. If you need to correct a difference of a few seconds, the first method will do. For minutes or hours, the second method is better.
Quick Fix
To quickly adjust the time, use ntpdate. Install it with:
yum install ntpdate
For a one-time sync:
/usr/sbin/ntpdate 1.north-america.pool.ntp.org
Use Crontab to set automatic periodic synchronization. For daily sync:
crontab -e
00 1 * * * /usr/sbin/ntpdate 1.north-america.pool.ntp.org
To sync on boot instead of at regular intervals:
crontab -e
@reboot /usr/sbin/ntpdate 1.north-america.pool.ntp.org
Gradual Correction
To change the time on the server gradually, use ntp in CentOS. Install it:
yum install ntp
Enable the service on startup:
chkconfig ntpd on
In the file /etc/ntp.conf, specify accurate time sources, for example:
server 0.north-america.pool.ntp.org
server 1.north-america.pool.ntp.org iburst
server 2.north-america.pool.ntp.org
server 3.north-america.pool.ntp.org
The iburst parameter works the same as in Ubuntu/Debian — it improves accuracy by sending a burst of packets.
Restart the service after making changes:
/etc/init.d/ntp restart
Then restart the daemon:
/etc/init.d/ntpd start
Additional Options
Time synchronization is usually done with the server closest to your server geographically. But in the configuration, you can specify the desired region directly in the subdomain. For example:
asia.pool.ntp.org
europe.pool.ntp.org
Even if the NTP server is offline, it can still pass on system time. Just add this line:
server 127.127.1.0
You can also restrict access for external clients. By default, these parameters are set:
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
The options notrap, nomodify, nopeer, and noquery prevent changes to the server's configuration. KOD (kiss of death) adds another layer of protection: if a client sends requests too frequently, it receives a warning packet and then is blocked.
If you want to allow unrestricted access for the local host:
restrict 127.127.1.0
To allow devices in a local network to sync with the server:
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
After any changes, restart the service:
service restart ntp
To check the service’s operation, use the command:
ntpq -p
It will display a table showing the time source address, server stratum, last synchronization time, and other useful data.
16 April 2025 · 4 min to read
Servers
How to Set Up Network Storage with FreeNAS
NAS (Network Attached Storage) is a network data storage device. It provides shared file access from any connected computer or gadget. With this setup, all data is stored in one place, offering convenient access to NAS over a local network (LAN) or the Internet, and supports RAID and other technologies for data protection.
NAS can be used as home storage for media files, an office server for shared documents, or a corporate solution for backups and file resources.
In this tutorial, we’ll look at configuring FreeNAS — a free operating system for creating NAS based on FreeBSD. It is now developed under the name TrueNAS, but the core principles remain the same.
This OS is free, uses the crash-resistant ZFS file system, and is flexible in configuration.
Installing FreeNAS
We’ll go through the installation of FreeNAS OS using a cloud server from Hostman.
Choosing the Configuration
Important system requirements for FreeNAS:
RAM: 8 GB minimum (16 GB+ recommended, especially with large disks)
Free disk for the system: at least 8 GB (16–32 GB recommended)
Data storage disk: size depending on your needs
This configuration ensures stable operation with up to 4 TB of data when using iSCSI, virtual machines, and databases and 8 TB for lighter tasks.
In this tutorial, we’ll use Hostman, where only NVMe SSDs are available. However, in general, consider the following:
For large media libraries, archives, and backups, HDDs are sufficient.
For high-speed access, processing small files, or running VMs or databases, SSDs are better, either as primary storage or as a cache for performance.
Step 1: Uploading the OS Image to Hostman Panel
Go to the download page and choose an appropriate installer version in .iso format.
To find the image:
Click the directory of the version you want (recommended: STABLE)
Open the x64 folder and copy the link to the .iso file.
In this tutorial, we use version 13.3 STABLE. Image download link:
https://download.freenas.org/13.3/STABLE/RELEASE/x64/TrueNAS-13.3-RELEASE.iso
In the Hostman panel, go to the Cloud servers - Images section, click Upload image and paste the copied URL.
Choose the server location and click Upload. Wait for the image to finish uploading.
Step 2: Creating a Cloud Server
Once the image is uploaded, click Create server from image.
Choose the server configuration.
Click Order to create the server.
Step 3: Adding a Disk
The default configuration includes 80 GB of NVMe storage — we’ll use this for the OS. Now we need to add an additional disk for storing data:
Wait for the image to mount and for the server to become available.
Go to the Plan tab and click Add disk.
Choose the required size and click Add.
Step 4: Installing the System
Go to the Console tab. You can open the console in a new tab for convenience.
The installer should appear in the console. Press Enter to start the installation.
Choose the destination disk (in this case, the 80 GB NVMe). Press Space to select, then Enter to confirm.
The installer will warn you that the disk will be erased. Confirm to proceed.
Enter and confirm a password — you will use it later to access the web interface as the root user.
Choose the boot mode. Hostman servers use Legacy BIOS.
The installer offers to create a 16 GB swap partition. It helps extend RAM by using disk space, which is useful if you have less than 16 GB RAM or expect unstable loads. Not recommended on USB drives due to wear.
The installation will begin.
After it completes, confirm that it finished successfully.
Press Space, and in the menu, select Shutdown System to turn off the server.
You can now delete the installation image so it doesn't incur charges.
After rebooting, the system will show that the web interface is available via the server’s IP address.
Installation is complete!
Initial Setup of FreeNAS
First Login to the Web Interface
Go to the UI using the server’s IP address. Log in with:
Username: root
Password: the one set during installation
You’ll see the TrueNAS dashboard.
Setting Basic System Parameters
Set the correct time zone: Open System, then General settings. Set your timezone in the Timezone field.
Enable alerts: Go to Alert Services and Alert Settings. You can configure email notifications or messenger integrations.
Creating and Configuring Storage (ZFS)
FreeNAS uses the ZFS file system for reliable and flexible storage. Its benefits include data protection and useful tools for backups and replication.
Go to Storage (1), then Pools (2)
Click Add to create a new pool.
Choose Create new pool.
Enter a name for your pool, e.g., mypool.
Select your disk (1) and move it to the Data VDevs field (2).
You’ll see options for Mirror and Stripe modes:
— Mirror
Data is written to all disks in the group.
If one disk fails, data remains on the others.
Total storage equals the size of the smallest disk.
Use when:
Reliability is more important than capacity.
You have two or more disks of similar size.
You want redundancy without complex RAID setups.
— Stripe
Data is split and written across all disks.
Better performance and full use of all disk space.
If one disk fails, all data is lost.
Use when:
Speed and space are more important than reliability.
Data isn’t critical (can be restored from elsewhere).
You want to maximize storage with minimal setup.
Click Create. Note that all data on the disk will be erased. The new pool should now appear in the panel.
User Management and Access Rights
In the left-hand menu, select the Account tab, then Users, and click the Add button.
Fill in the required fields — full name, username (alias), and password.
If needed, configure a home directory inside one of the created datasets.
You can manage permissions within datasets, which are logical partitions or storage spaces created inside a ZFS pool. To do this, go to the Pools tab (1) and use the Edit Permissions option (2) on the desired dataset.
You can configure access rights for individual users or entire groups.
Try not to grant administrator (root) privileges to too many users, even if it seems more convenient. The fewer people with elevated access, the more secure your data will be.
Setting Up Services and Sharing Protocols
Enable the necessary services under the Services tab to take advantage of NAS features.
The following protocols are available:
SMB for Windows networks
NFS for UNIX-based environments
AFP for Apple users
WebDAV for HTTP-based access
iSCSI, FTP, and others
You can configure each protocol after activation. For example, with SMB, you can set a workgroup and guest access parameters and enable auto-start on system reboot.
After enabling a service, create a share in the Shares section by selecting the appropriate protocol.
Advanced Features and Plugins
FreeNAS (TrueNAS) features a robust plugin system (Jails, Plugins) that includes many popular applications. Some of the most in-demand plugins include:
Nextcloud: A private cloud solution with office tools, calendar, audio/video conferencing. Ideal for collaborative work and personal file syncing (like Dropbox or Google Drive).
Plex Media Server: A powerful tool for managing your media library — TV shows, movies, music, photos. It can auto-fetch metadata, download covers, and track viewed/unviewed status.
Transmission: A lightweight torrent client with a web interface. Perfect for downloading large files directly to your NAS.
Syncthing: Focused on peer-to-peer folder synchronization. Great for distributed teamwork or backup syncing across devices.
Zoneminder: Enables you to set up a video surveillance system. Supports IP cameras, recording, and alert configurations.
Tarsnap: A secure backup service for UNIX-like systems.
To install a plugin, go to Plugins (1), choose an application, and click Install (2). Configuration (like ports or storage paths) is usually done after the quick setup.
If you want more isolation, use Jails — FreeBSD-based environments that let you install packages and libraries independently of the main system.
Backups and Data Protection
ZFS Snapshots allow for quick recovery of data in case of accidental deletion or corruption. You can automate this by scheduling snapshots via the Tasks → Periodic Snapshot Tasks tab. Choose the dataset, snapshot lifetime, and frequency.
Data deduplication saves storage space but is RAM-intensive (about 5 GB RAM per 1 TB of data). If you plan to use it heavily, consider increasing your memory. Otherwise, ZFS may slow down or run into resource issues.
For advanced backup features, consider plugins like Asigra or Tarsnap. Choose a backup strategy based on your risk tolerance and data volume. Some users are fine with local snapshots; others may prefer offsite copies.
Common Issues and Troubleshooting
Symptom
Problem Description
Solution
Cannot access the web interface (browser won’t open URL)
Network or IP configuration issues, firewall port blocking
1. Check IP settings in TrueNAS console (options 1, 4, 6 in network menu).
2. Verify gateway and DNS settings.
3. If behind NAT, open/forward required ports (usually 80/443).
4. Ensure local firewall allows access.
[EINVAL] vm_create: This system does not support virtualization
CPU/motherboard doesn’t support VT-x/AMD-V, or it's disabled in BIOS/UEFI, or virtualization is off in the hypervisor
1. Enable Intel VT-x / AMD-V (SVM) in BIOS.
2. Confirm CPU supports virtualization.
3. If running inside a hypervisor, enable Nested Virtualization.
"Pool is DEGRADED" or "FAULTED"
ZFS pool has a failing or disconnected disk
1. Run zpool status in the console to identify the faulty disk.
2. Replace the failed disk if using RAIDZ or Mirror.
3. Start the resilvering process.
4. Review logs and run SMART tests.
Slow performance or errors with deduplication
Deduplication consumes too much RAM
1. Add more RAM.
2. Disable deduplication where not needed (e.g., media files).
3. Use only compression (LZ4) if resources are limited.
Cannot access SMB share or it doesn't show up on the network
Incorrect ACL or SMB configuration, workgroup mismatch, bad user profile
1. Enable SMB in Services and set it to auto-start.
2. Create a new share under Sharing → SMB and check permissions.
3. Configure ACLs on the dataset (e.g., Full Control for user/group).
4. Verify the correct workgroup setting.
Snapshot creation/deletion fails
Not enough free space or quota exceeded, or permission issues
1. Check available space in pools.
2. Increase/remove dataset quotas if too strict.
3. Make sure the user has snapshot permissions.
SSH doesn’t work or key authentication fails
SSH service off, keys not in the right place, wrong file permissions
1. Enable SSH under Services.
2. Upload public key under System → SSH Keypairs, or place it in ~/.ssh/authorized_keys.
3. Set correct permissions (700 for .ssh, 600 for key files).
WebDAV access via password doesn’t work
WebDAV user/password not set or port blocked by firewall
1. Go to Services → WebDAV and set the webdav user password.
2. Make sure the port (e.g., 8080) is open in the firewall.
3. Verify the correct access path (e.g., http://IP:8080/resource_name).
Conclusion
FreeNAS (TrueNAS) version 11.3 is well-suited for setting up a file server and running additional services. The system offers tools for managing ZFS pools, user permissions, and protocols like SMB, WebDAV, and iSCSI.
If you need extended functionality, check out plugins and built-in virtualization (like VirtualBox or bhyve in newer versions).
ZFS features such as deduplication, snapshots, and replication provide robust data protection. Plugins like Nextcloud or Plex make collaboration and media management much easier.
The FreeNAS project evolved into TrueNAS, but the key principles remain: using ZFS instead of hardware RAID, flexible shared folder configuration, and a user-friendly web interface.
14 April 2025 · 10 min to read
Do you have questions,
comments, or concerns?
Our professionals are available to assist you at any moment,
whether you need help or are just unsure of where to start.
whether you need help or are just unsure of where to start.
