Skip to content
LockdownGuide
Data security • Reviewed October 25, 2026

TrueNAS & ZFS Hardening: Dataset Encryption, 3-2-1 Backups, and Snapshots

Protect private files against hardware theft and ransomware attacks using native ZFS encryption, scrubs, and automated off-site Restic/Borg backups.

Network-Attached Storage (NAS) appliances house our most sensitive personal records, tax returns, and private photos. Misconfigured storage servers expose unencrypted data to unauthorized network users and ransomware encryption campaigns.

ZFS Storage Hardening Protocol
Storage Layer Configuration Specification Operational Benefit
Dataset EncryptionAES-256-GCM native ZFS encryptionZero-knowledge physical drive theft protection
Data Integrity ScrubAutomated bi-weekly pool scrubDetects and heals silent bit rot data corruption
Off-site ReplicationEncrypted ZFS send/receive to secondary hostDisaster recovery surviving fire or physical destruction
SMB Share PermissionsExplicit user ACLs; Guest Access DisabledPrevents unauthorized local LAN file access

ZFS Native Dataset Encryption

Configure TrueNAS datasets using native ZFS AES-256-GCM encryption. By utilizing passphrase or keyfile protection, drive disks removed physically from the chassis cannot be mounted or inspected without the decryption passphrase.

Immutable Snapshots & Ransomware Protection

Configure automated hourly and daily ZFS snapshots with explicit retention lifetimes. Because ZFS snapshots are copy-on-write and read-only, ransomware running on a compromised client computer cannot overwrite past snapshot history.

Frequently asked questions

Can TrueNAS replicate encrypted datasets to an untrusted cloud without decrypting them?
Yes. Native ZFS raw send/receive allows replicating encrypted datasets directly to remote storage without decrypting the data or exposing encryption keys to the destination server.

Sources and references

More in Hardening guides