Securing Your Unraid Server

Why a Server Is Worth Protecting

A server is different from a single laptop. It is always on, it holds a lot at once, and other devices in your home reach it. That makes it both handy and worth guarding.

Think about what lives on it: photos you cannot re-take, financial records, backups of every other computer in the house. If a stranger got in, they could copy it, lock it, or delete it. If the hardware failed and you were not protected, it could be gone.

• People - strangers on the internet, or bad software trying to sneak in.
• Accidents - a drive dying, a wrong click, or a power surge.

A Strong, Unique Root Password

The root account is the master key to your server. If someone guesses that password, they own the whole machine. So this is the first thing to get right.

A phrase like "copper-lantern-quiet-river" is both easy for you to remember and very hard for a stranger to guess. Set it in the Users area of the web page, on the root account.

• Long - aim for a passphrase of several words, like four or five together.
• Unique - not the same password you use for email or banking.
• Not obvious - no birthdays, pet names, or the word "password."

Never Expose the Web Page to the Internet

This is the most important page in the guide. The Unraid web page is meant for your home network only. Putting it on the open internet is how servers get taken over.

It can happen by accident. Someone follows an online tip to "port-forward" a port on the router so they can reach the server from away. That quietly opens a door from the whole internet straight to your login page, where automated bots try passwords day and night.

• Keep the web page reachable only from inside your home.
• To reach it from away, use a private tunnel (VPN) - see page 18.
• Never port-forward the web page or your file shares.

Keeping Unraid Updated

Updates are not just new features. They fix security holes that have been found since the last version. Running an old version leaves those holes open.

Stick with the stable release, not test or beta versions. Read the short release notes so you know what changed, and update when the array is idle so nothing is interrupted.

• Unraid checks for updates and shows a notice in the web page.
• You apply the update, then reboot the server when it is convenient.
• The plugins and apps you added get their own updates too.

Turning On HTTPS for the Local Web Page

HTTPS is the lock icon you see in a web browser. It scrambles the connection so your password is not sent in plain view across your own network. Unraid can turn this on for the local web page.

Look in the management access settings for the option to use HTTPS. Unraid can provision a certificate so the connection is trusted. Once it is on, you reach the server with a secure address instead of a plain one.

• It keeps your login private, even from other devices on your Wi-Fi.
• It stops the browser from warning you every time you sign in.
• Unraid can set it up for you using its built-in option.

Separate Accounts Instead of Sharing One

It is tempting to have everyone in the house use the one root login. Do not. Give each person their own account, so you can control what each one can reach and turn off access cleanly.

Create accounts in the Users area of the web page. Keep root for administration only, and use everyday accounts for browsing files. That way the master key is used rarely and stays safer.

• You can limit each person to only the shares they need.
• If one account's password leaks, the others are unaffected.
• You can remove one person's access without changing everyone's.

Share Only What Is Needed

Every share is a door. The fewer doors you open, and the more carefully you decide who can walk through them, the safer your files are. This is called least-privilege - give the least access that still gets the job done.

In each share's settings you can choose who can read it and who can change it. Take a minute to set these deliberately. A share full of tax records should not be wide open to every device on the network.

• Set private shares to require a login, not open to everyone.
• Give each user read-only access unless they truly need to write.
• Do not make a share public just to make a one-time transfer easier.

Turn Off Services You Do Not Use

Every service that is running is one more thing that could have a weakness. If you are not using something, turn it off. A smaller footprint is a safer one.

You will find these switches in the settings for management access and shares. If you are not sure whether you use something, turn it off and see if anything stops working. You can always turn it back on.

• Telnet - an old, unencrypted way to log in. Leave it off.
• FTP - an old file-transfer method. Off unless you truly need it.
• SMB or NFS - keep on if you use network file shares, off if you do not.

Keeping Your Docker Apps Secure

Most Unraid apps run as Docker containers - small, self-contained programs. They are handy, but each one is also a program you are trusting. A few habits keep them safe.

When you install an app, look at what folders it can reach and what network ports it opens. If something does not need access to a folder, do not give it access. Less access means less that can go wrong.

• Update your containers when updates appear - they fix security holes too.
• Set a real password on any app that has a login page.
• Only map the folders an app truly needs, not your whole drive.
• Do not expose an app's web page to the internet without protection.

Do Not Run Random Templates

Apps are installed through the Community Applications plugin. Most are well-known and maintained, but not every template out there is trustworthy. A little care here goes a long way.

A container runs real software on your server. If it comes from an unknown source, you are trusting that source with a spot on your machine. Stick with reputable, widely-used apps and you avoid most trouble.

• Prefer apps that are popular and clearly maintained.
• Read the description and check who publishes the template.
• Be wary of an app with almost no users or a vague description.
• Do not paste in a random template from a stranger on the internet.

Router and Firewall Basics

Your home router is the front gate between your house and the internet. By default it keeps the internet from reaching in. Your job is mostly to not undo that protection.

Most of home security is simply leaving the front gate closed. Every port-forward is a hole punched in that gate. Open them only when you truly must, and never for the server's login page.

• Leave the router's firewall on - it blocks unwanted traffic by default.
• Do not port-forward your server's web page or shares.
• Change the router's own admin password from the factory default.
• Turn off UPnP if you do not need it, so apps cannot open ports on their own.

A Separate Network for Smart-Home Gadgets

Smart plugs, bulbs, cameras, and TVs are cheap and convenient, but they are not always well-secured. Keeping them on their own network keeps a weak gadget from reaching your server.

If one of those inexpensive gadgets ever gets compromised, it is stuck on the guest network and cannot touch your files. Your server and everyday computers stay on the trusted side.

• Many routers offer a "guest" network - a second, walled-off Wi-Fi.
• Put smart-home gadgets on the guest network, your computers on the main one.
• The guest network cannot reach your server, and that is the point.

Two-Factor Sign-In Where Offered

Two-factor sign-in adds a second step to logging in - usually a code from an app on your phone. Even if someone learns your password, they still cannot get in without that code.

When an app or account offers two-factor - sometimes called 2FA or two-step - turn it on. It is one of the biggest jumps in safety for the least effort. Keep your backup codes somewhere safe in case you lose your phone.

• On any Unraid-related online account that offers it.
• On the apps you run that support it, especially ones you reach remotely.
• On your email, since email can reset many other passwords.

Physical Security of the Box

All the passwords in the world do not help if someone can walk up to the machine. Anyone with hands on the server, and its USB flash drive, has a big head start.

The USB flash drive is special: Unraid boots from it and your license is tied to it. Losing that stick, or letting someone pocket it, is a real problem. Keep the whole machine somewhere sensible.

• Keep the server somewhere not everyone passes by - a closet or office.
• Remember Unraid boots from its USB flash drive - guard that little stick.
• Put it on a surge protector, ideally a battery backup (UPS).
• Do not leave the login page open on a screen next to the machine.

A Quick Look at the Logs

Logs are the server's diary - a running note of what happened. You do not need to read them daily, but knowing where they are and glancing at them now and then helps you spot trouble early.

You will find the system log through the web page, often behind a small log icon. Turn on Unraid's notifications too, so it can email or alert you when something needs attention instead of you having to check.

• Repeated failed logins, which can mean someone is guessing passwords.
• Warnings about a drive, so you can act before it fails.
• An app restarting over and over, which points to a problem.

Backups Are Your Ransomware Defense

Ransomware is software that locks up your files and demands payment. The only reliable defense is a backup the ransomware cannot reach. This is the most important safety net you can have.

Remember: parity in Unraid protects against a drive dying, but it is not a backup. If ransomware or a wrong click scrambles your files, parity faithfully protects the scrambled version. You need real, separate copies.

• Back up appdata (your app settings) and the flash drive (your config).
• Keep at least one copy offline or off-site, not always connected.
• Test that you can actually restore a file, not just that it copied.

Use a VPN for Remote Access

You can absolutely reach your server from away - safely. The trick is to tunnel in with a private VPN instead of opening the server to the whole internet.

Unraid has WireGuard built in, and Tailscale is available as an easy app. Either one creates a private tunnel so your phone or laptop joins your home network from anywhere - without opening a single port to strangers.

Your Security Checklist

Here is the whole guide as a checklist. Run through it now, and again every few months. You do not have to do it all at once.

• Root account has a strong, unique password.
• The web page and shares are NOT exposed to the internet.
• Unraid is on the current stable version.
• HTTPS is turned on for the local web page.
• Each person has their own account, with only the access they need.
• Unused services like Telnet and FTP are turned off.

What's in the 27-page PDF

• Why a home server is worth protecting in the first place
• A strong password, HTTPS, and separate user accounts
• The one big rule: do not put the web page on the open internet
• Keeping Unraid and your apps updated and trimmed down
• Backups as your real defense against ransomware
• A simple security checklist you can run through anytime

Why I wrote this

I write these as printable handouts because a guide you can keep in a drawer beats a web page you have to find again. No jargon, no judgment, no rushing. If you'd rather have someone sit beside you and go through it together, that's a flat $99 first visit with the 30-day follow-up included — serving Portage County from Atwater, Ohio. — Bill