Sales Chat - Click Here

Knowledge Base

Search by either entering keywords/KB_ID or by selecting a category.

KB ID: 3260

Configuring Boot Authentication on a supported TeraStation

Last Updated: 10/14/2024


Learn more about what makes Buffalo NAS the market’s most secure storage here.

 

This article applies to TS5000, TS3010, and TS5010 series TeraStations. The required windows utility is available here.

The boot authentication system is designed to prevent a TeraStation from being used in an unauthorized environment. In other words, if the TeraStation is stolen it cannot be accessed unless the authentication server is present. Please refer to the User's Manual for your model TeraStation for more information.

When this feature is enabled on the TeraStation it will look for a designated server running the authentication software prior to starting the boot process. The authentication software is a Windows utility running on a server or other Windows system that is available at all times. If the authentication server is not found, the TeraStation will boot but the user interface and shares will not be accessible. The authentication software is compatible with both desktop and server versions of Windows.

​NOTE: Always make sure the utility database is backed up after configuration. Steps for backing up the utility are included in this article.

 

  1. The Boot Authentication Tool is a utility that runs as a service in Windows. It should be installed on a Windows system that is available at all times. Once the tool is installed and running it will appear in the system tray:
    systray_1.jpg
  2. As with most system tray utilities, right-clicking the icon will give you a menu:
    systray_2.jpg
  3. The utility itself has two tabs. The first tab, "Managed Devices", should show authenticated TeraStations:
    tool_1.jpg
  4. The "Options" tab will allow you to change the TCP port used by the utility as well as giving the option to block a TeraStation whose status shows "Warning":
    tool_2.jpg

    NOTE: Boot authentication and iSCSI cannot co-exist, therefore a TeraStation set up with iSCSI can't be configured for boot authentication and a TeraStation with boot authentication configured cannot be set up to use iSCSI! If you attempt to turn on boot authentication on a unit already configured for iSCSI they will get the following message:


    warning2.jpg
  5. The option for enabling boot authentication is in the TeraStation user interface on the "Management" tab. It should be listed as "Boot Authentication":
    auth_switch.png
  6. This will let you configure several options. Note: Setting the security level to "high" means that if you attempt a manual authorization with the wrong passcode three times the TeraStation can no longer be authorized manually! This means that the data will be lost! 
    configuration.jpg
    WARNING! When this option is activated, the drives WILL BE formatted!! Any data already on the unit will be ERASED!!
    warning.jpg
    Once the option is enabled all drives will be encrypted and the TeraStation will search for the pre-configured Boot Authorization Server during the boot process. If the TeraStation cannot locate the Boot Authorization Server the following message will be displayed on the LCD with a red background (TS3010 series units do NOT have an LCD!):
    IMAG0071.jpg
  7. If someone attempts to access the user interface on a TeraStation that is unable to properly authenticate against the authentication server the following screen will be displayed:
    image020.png

It is possible to perform a manual authentication in the event that the TeraStation is unable to communicate with the authentication server. In order to do so you must have access to the server running the boot authentication utility.

To perform a manual authentication, perform the following steps:

  1. Open the Boot Authentication tool on the Windows server, right-click the target TeraStation and click "Decrypt Passcode".
    manual1.jpg
  2. Enter the decryption key provided by the TeraStation and click "decrypt":
    image022.png
  3. This will return a 20 digit passcode:
    image024.png

That code can be entered into the TeraStation user interface to authenticate the TeraStation manually.

It is recommended that the tool be backed up whenever a new system is added. To accomplish this follow these steps:

  1. In the boot authentication tool, click "File" and then "Export Devices"
  2. Give the file a descriptive name and save it in a location that will be backed up and that can be easily located if necessary.
X