Ask Slashdot: Stepping Down From an Office Server To NAS-Only? 227
First time accepted submitter rawket.scientist writes "I'm a full time lawyer and part time nerd doing most of the IT support for my small (~10 person) firm. We make heavy use of our old Windows Server 2003 machine for networked storage, and we use it as a DNS server (by choice, not necessity), but we don't use it for our e-mail, web hosting, productivity or software licensing. No Sharepoint, no Exchange, etc. Now old faithful is giving signs of giving out, and I'm seriously considering replacing it with a NAS device like the Synology DS1512+ or Dell PowerVault NX200. Am I penny-wise but pound foolish here? And is it overambitious for someone who's only dabbled in networking 101 to think of setting up a satisfactory, secure VPN or FTP server on one of these? We've had outside consultants and support in the past, but I always get the first 'Why is it doing this?' call, and I like to have the answer, especially if I was the one who recommended the hardware."
Collect your specs first (Score:3, Interesting)
Find out what you need to do, first, I just spent a disastrous contract job with a company that said "get us bids, then we'll write the specs". And all the groundwork that was necessary for *whichiver bid they accepted*, including storage integration cleanup and getting formerly neglected projects onto backup, met tooth and nail resistance and insistent project review from the current IT staff who had *no idea* and couldn't be bothered to know what their current system did, they were "too busy". They had enough time to complain bitterly about how their old debris was better, when it didn't meet the most basic requirements of reliable backup, recoverability, or supportable technologies.
For someone being paid hourly and who was smart enough to write in the inevitable support calls as billable time, it made me a lot of money, but they made themselves unhappy because they acted like Java programmers. There's an unstated, unstable, never documented API, and they'd just throw it over the wall in one of their endless meetings of people who have nothing to do with the work, to someone in their group who didn't get to go to the meeting, and toss it out to me. "And Then A Miracle Occurs." And boy, did I make miracles occur behind the scenes!!! I'm looking forward like hell to when these clowns go to the Cloud. I am going to make *so much money* translating their last rounds of ill-conceived fractureware practices into the sort of large-scale, but limited API features that the Cloud is actually good at.
In your case, if I had time to take on the job, I'd separate security functions such as VPN from the storage system. Assess if you're an all CIFS storage shop, how much you need, and what your backup and archival storage requirements are. (In a law firm, that archival storage requirement is critical.) Assess your database and email storage backup requirements. (Again, as a law firm, your email storage requirements are important.) And assess ease of recovery of lost data versus the risk of having material your clients would prefer did not show up in a subpoena. (Lawyer/client privilege is vital, so is having only *half* the material show up in the subpoena, the half that makes your client look guilty, without the evidence that clears them.)
NAS's work very well: most of them are Samba behind the scenes, and many of them do NFS as well as CIFS. Don't do that: the privileges for CIFS access and NFS access are very, very different and had to resolve in real life. NAS's also work great for off-site backup: simply swap backup storage devices and take one offsite, then swap regularly.
Think hard about that VPN technology. All Windows boxes support PPTP built-in, and despite the great cries of "oooohhhh, IPSEC is so much better" I've seen no reliable reports that there's a genuine performance or security improvment. The big risks are that the software won't work (which is extremely common with IPSEC and peculiar Windows flavors still in use), and that people will leave themselves logged in with their screens unlocked or their remote systems rootkitted. (VPN's do nothing to address this: good firewall management of the VPN connection does, and this has *nothing to do* with the underlying VPN technology.) IPSEC supports lots of expensive RSA key technologies that you can spend a lot of money for, and which most clients *HATE, HATE, HATE* because they lose those damn funky keychain fobs, which could have been designed better by a bunch of random number generators taking a Java garbage collection break from writing Hamlet.
Re:Just did the same (Score:2, Interesting)
Devil's advocate here. Since this is a production environment, even though the Mac doest cost, having the hardware backed by some sort of warranty is important. An old workstation breaking that stores all their critical law data may cause them downtime and such. It might even bring malpractice lawsuits from clients.
The Mac Mini can be called a "server", as Apple states that as well. This is important, not for hardware but for legal eagle stuff. Plus, if anything breaks, Apple is good at the consumer/SOHO level of getting stuff fixed. Enterprise, different story, but this is just one NAS we are meaning. If two internal drives which are mirrored can hold the needed data, that would be close to ideal. Of course, having a backup system, at the minimum rotating external USB hard disks between the law office and a secure offsite location (Iron Maiden is the standard, but you could use a climate controlled storage with a heavy duty safe inside.)
At the minimum, I'd buy a low end Dell or HP server and install an OS on that. That way, clients can be assured that some reasonable precautions are kept with their data.
Of course, for long term archiving, just saving files to a DVD or Blu-Ray drive may not cut it. I prefer at least two disks on optical media, as well as a backup on a HDD or flash, just to be safe. Stashing stuff in a TrueCrypt container on DropBox is also OK, but use a keyfile and not just a passphrase if one wants to not worry about brute force guessing.
I vote no-NAS (Score:5, Interesting)
We also went through this a while ago, but the other way around. After kitting out a small office network, the one purchase we really regretted was the NAS (a Cisco-branded device, which in fact is a rebadged QNAP).
The hardware has not failed and supports hot-swapping drives if necessary, but those are about the only good things I have to say about this unit. It is in all other respects just a very limited and relatively expensive Linux server, where essential operations like scheduling regular, secure off-site back-ups are absurdly difficult, and where you can't easily install other server software (e-mail, calendars, DHCP, RADIUS, whatever) unless whoever supplied your NAS happens to make some sort of plug-in available for their particular style of firmware. Even Cisco gave up trying to provide any meaningful support in this area within a few months of the device launching, eventually just providing a mechanism for people to upgrade their firmware to QNAP's own.
When we were investigating options for a new device earlier this year, it looked like more recent NAS devices from other suppliers were little better, maybe differing in some of the details but essentially still the same old story.
My conclusion: NAS devices are for non-technical home users who want to plug in and go. If you're running a real business with serious requirements, and you have moderate Linux skills and/or a modest budget to bring in someone who does when you need them, then buy a real server with a specification suitable for your requirements. There is absolutely no advantage to buying a NAS for someone in that position, IME.