Jump to content

No Access to Protected SMB Shares


Revan335
Go to solution Solved by Frank1940,

Recommended Posts

52 minutes ago, dlandon said:

That's what I wanted you to figure out.  You didn't have any users defined for any shares.  It should be working now.  Be sure to use the Windows Network to browse to the share, and access it that way.

 

If you are still having issues, post the output of this command:

testparm -s

 

 

Sorry, no changes:

Public (Test2) Works with Read/Write Access without Login (Guest allowed Read/Write)

Secure (Test) Works with Read Access without Login, No Login Works for Write Access (Guest allowed Read)

Private (Test1) Don't Works, No Login Works for Read or Read/Write Access (No Guest allowed)

 

No Changes:

~# testparm -s
Load smb config files from /etc/samba/smb.conf
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)

Server role: ROLE_STANDALONE

# Global parameters
[global]
        disable netbios = Yes
        disable spoolss = Yes
        load printers = No
        logging = syslog@0
        map to guest = Bad User
        max open files = 40960
        multicast dns register = No
        ntlm auth = ntlmv1-permitted
        null passwords = Yes
        passdb backend = smbpasswd
        printcap name = /dev/null
        security = USER
        server min protocol = SMB2
        server multi channel support = No
        server string = MCP
        show add printer wizard = No
        smb1 unix extensions = No
        fruit:nfs_aces = No
        idmap config * : range = 3000-7999
        idmap config * : backend = tdb
        acl allow execute always = Yes
        aio read size = 0
        aio write size = 0
        create mask = 0777
        directory mask = 0777
        hide dot files = No
        include = /etc/samba/smb-shares.conf
        invalid users = root
        map archive = No
        map readonly = yes
        use sendfile = Yes
        wide links = Yes


[Test]
        guest ok = Yes
        path = /mnt/user/Test
        write list = test


[Test1]
        path = /mnt/user/Test1
        valid users = test
        write list = test
        

[Test2]
        guest ok = Yes
        path = /mnt/user/Test2
        read only = No        
        
Or This:

~# testparm -s
Load smb config files from /etc/samba/smb.conf
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)

Server role: ROLE_STANDALONE

# Global parameters
[global]
        disable netbios = Yes
        disable spoolss = Yes
        load printers = No
        logging = syslog@0
        map to guest = Bad User
        max open files = 40960
        multicast dns register = No
        ntlm auth = ntlmv1-permitted
        null passwords = Yes
        passdb backend = smbpasswd
        printcap name = /dev/null
        security = USER
        server min protocol = SMB2
        server string = MCP
        show add printer wizard = No
        smb1 unix extensions = No
        workgroup = Workgroupnamewithü
        fruit:nfs_aces = No
        idmap config * : range = 3000-7999
        idmap config * : backend = tdb
        access based share enum = Yes
        acl allow execute always = Yes
        aio read size = 0
        aio write size = 0
        create mask = 0777
        directory mask = 0777
        hide unreadable = Yes
        include = /etc/samba/smb-shares.conf
        invalid users = root
        map archive = No
        map readonly = yes
        use sendfile = Yes
        wide links = Yes


[Test]
        guest ok = Yes
        path = /mnt/user/Test
        write list = test


[Test1]
        path = /mnt/user/Test1
        valid users = test
        write list = test  
        
                
[Test2]
        guest ok = Yes
        path = /mnt/user/Test2
        read only = No      

 

Link to comment
1 hour ago, Revan335 said:

Public (Test2) Works with Read/Write Access without Login (Guest allowed Read/Write)

Secure (Test) Works with Read Access without Login, No Login Works for Write Access (Guest allowed Read)

Private (Test1) Don't Works, No Login Works for Read or Read/Write Access (No Guest allowed)

You started out without any users being defined for the shares on Unraid.  You now have users defined - user 'test' on 'Test' and 'Test1'. My suggestion is to now slow down and stop making so many changes,

 

Do the following:

  • Set your two shares (Test and Test1) for Private user access and set up 'test' as the user with read/write access on both shares.
  • On your Windows compuoter, delete the saved user credentials.
  • Browse to 'Network' on the PC and access the share and enter the credentials.
  • If you still have issues, try another PC.
Link to comment
28 minutes ago, dlandon said:

You started out without any users being defined for the shares on Unraid.  You now have users defined - user 'test' on 'Test' and 'Test1'. My suggestion is to now slow down and stop making so many changes,

 

Do the following:

  • Set your two shares (Test and Test1) for Private user access and set up 'test' as the user with read/write access on both shares.
  • On your Windows compuoter, delete the saved user credentials.
  • Browse to 'Network' on the PC and access the share and enter the credentials.
  • If you still have issues, try another PC.

Sorry, Dont Work.

A Win VM:

1838070045_Bildschirmfotovom2023-02-2720-37-57.png.9b6ff43dbfe1df239a050ac4c77f327e.png2012885203_Bildschirmfotovom2023-02-2720-37-02.png.e475098db9fb9df042728d9e3d471a75.png

 

Android Handy:

1880916848_Screenshot_20230227-204626_SolidExplorer.thumb.png.414362cdcb5c6f25c9e4338cc49495f3.png1612248075_Screenshot_20230227-203532_FolderSyncPro.thumb.png.906cba0004315220bd1d0043eda1d8b9.png94044555_Screenshot_20230227-205353_FolderSyncPro.thumb.png.e7d9e72f1749869c38244897a6cea4f7.png

 

Linux (Manjaro Arch Linux), Ubuntu dont work too:

483272904_Bildschirmfotovom2023-02-2720-36-25.png.d12c15ce1eb9a3f31db081a1e320e8b0.png

Link to comment

Make sure that you have setup a 'credential'  for your server in Credential Manager for the User 'test' on your Windows computer.  This must be the only credential to that server!  (Delete any other credentials for your Unraid server!)

 

Always run the following command on the command line of the Command Prompt App on your Windows computer before you test any configuration change-- on either the server or the Windows computer.   (This command will cause a complete reset of the Windows network--  Basically the same as rebooting the Windows Computer.)

net use * /delete

 

Link to comment
57 minutes ago, Frank1940 said:

Make sure that you have setup a 'credential'  for your server in Credential Manager for the User 'test' on your Windows computer.  This must be the only credential to that server!  (Delete any other credentials for your Unraid server!)

 

Always run the following command on the command line of the Command Prompt App on your Windows computer before you test any configuration change-- on either the server or the Windows computer.   (This command will cause a complete reset of the Windows network--  Basically the same as rebooting the Windows Computer.)

net use * /delete

 

1507405864_Bildschirmfotovom2023-02-2722-29-50.png.2f157032304d9e20053fac3ed04b6e38.png

105001235_Bildschirmfotovom2023-02-2722-30-14.png.59e7586cd75bcba89032ee0472710b72.png381930661_Bildschirmfotovom2023-02-2722-31-39.png.dba21e09dafaafd32c0797636548696e.png

 

No Access:

1838070045_Bildschirmfotovom2023-02-2720-37-57.png.9b6ff43dbfe1df239a050ac4c77f327e.png2012885203_Bildschirmfotovom2023-02-2720-37-02.png.e475098db9fb9df042728d9e3d471a75.png

I tried with name first.

Than remove the name, used the command/reboot.

Put the IP + Credentials in the Credential Manager, used the command, tryed the Access with the IP Adress to the Share.

Link to comment

image.thumb.png.df0dfc6f3971aa7b7e12d3a15bf4a7ef.png

and

image.png.e57b8986dc46359ffa0cf52ea146592e.png

 

Two comments:

  1.  I notice that you are not trying to access a proper share ('test' is not shown as being a defined share in the testperm output).   Also, please watch capitalization of letters in file/directory names as Linux is case sensitive and Windows is not case sensitive, Samba tries to address this problem to some extent but it is not always successful--- It can make a difference when you least expect it.  (I just checked and Windows Explorer is showing the shares names with the capitalization that I used when I named them on the server...)
     
  2.  You have tried to use both the   <IP_address>  or the   <Server_Name>     when logging into your server.  I have recently figured out that, apparently, you can no longer use both to establish two different links/logins to the same server. It seems that using one blocks the use of the other.   I am not sure if this was a change to SMB or Samba.   (This change is probably related to some security issue.)

 

 

 

image.png

Link to comment

I tried with Test Share, test User and Unraidname like Tower not tower on Android. The same errors.

 

I can tested on Win, Linux later.

Or fresh Linux, Win VMs or Live Systems.

 

I don't know why its closed your functionality, its works in the Past and a new Stick/fresh factory Config makes no different. On my Unraid Backup Server works the SMB Access by Name/IP.

 

Do you need the Diagnostic from this? @dlandon

Link to comment
40 minutes ago, Revan335 said:

I tried with Test Share, test User and Unraidname like Tower not tower on Android. The same errors.

??????    Most folks who are providing assistance on this forum have the most ( and. often, only) experience with using SMB with the Windows OS running on bare metal-- not VMs.   Particularly,  when trying to solve a problem.  The fewer variables in the equation will simplify the journey to the solution.

 

Remember to run that command to disconnect all network connection before you try the following!

 

Open up Windows Explorer.   On the URL bar, type     \\<server_name>    and hit the enter key.    You should get something like this:

image.png.00bd65d4eb93e6233360eac1be9cbe09.png

 

If you don't, get a screen capture of what you do get, showing the above and be sure to include the error message.  (Don't worry about what is in the screen capture.  If you have a router with a decent firewall, any information that is displayed would not be useful unless someone had access to your LAN (Local Area Network) who should not have access to your LAN.  If that were the case, they already know more that the requested screen capture will show!)  

 

Also let us know what Edition and Version of Windows you are running.  Example   Edition: Windows 10 PRO Version: 22H2 

 

 

Link to comment

In the output of tertparm is the following:

image.png.611ef5c09dd613e2c6cccaa39e740a32.png

 

I suspect this is limited to a maximum of  15 (or 16) characters and should be ALL CAPITAL letters.  Most people leave it set to the default of WORKGROUP   

If you change it, you also must change it on each of the computers/devices that you are going to be using to connect to this server.

 

It appears that there is a problem with your user 'test' being able to log into the server.   Make sure that the passwords match on both the server and the PC.  Avoid using special characters (Symbols) in the password until we get things working.   Remember that in passwords, capitalization is important.  Make sure that you still/(always) have a credential for the user 'test' in Credential Manager.   Don't forget to delete all of the network connections with that Windows command when you change anything.  (The reason for this is that SMB will only allow one user to be logged onto a server from each client computer.  If you attempt to logon a second user, it will always fail BUT the error message is totally erroneous and misleading!)

 

Another thing that most people don't realize is that Windows will provide a 'user name' and password whenever requested by the server.  If there is not a credential in Credential Manager, it supplies one from a predetermined list of candidates.  If that fails, SMB will attempt to establish a 'guest' login connection.  That will often succeed with Unraid.  You now have a login to the server and depending on the security settings (Private, Secure or Public) of the share, your access are limited to 'guest' privileges for any share on the server. (This process is why Mapped Drives can be automatically connected at the startup of your PC.)

Link to comment
6 hours ago, Frank1940 said:

In the output of tertparm is the following:

image.png.611ef5c09dd613e2c6cccaa39e740a32.png

 

I suspect this is limited to a maximum of  15 (or 16) characters and should be ALL CAPITAL letters.  Most people leave it set to the default of WORKGROUP   

If you change it, you also must change it on each of the computers/devices that you are going to be using to connect to this server.

I have changed to Default WORKGROUP.

 

6 hours ago, Frank1940 said:

It appears that there is a problem with your user 'test' being able to log into the server.   Make sure that the passwords match on both the server and the PC.  Avoid using special characters (Symbols) in the password until we get things working.   Remember that in passwords, capitalization is important.  Make sure that you still/(always) have a credential for the user 'test' in Credential Manager.   Don't forget to delete all of the network connections with that Windows command when you change anything.  (The reason for this is that SMB will only allow one user to be logged onto a server from each client computer.  If you attempt to logon a second user, it will always fail BUT the error message is totally erroneous and misleading!)

The PW is for the Test only with Numbers.

 

6 hours ago, Frank1940 said:

Another thing that most people don't realize is that Windows will provide a 'user name' and password whenever requested by the server.  If there is not a credential in Credential Manager, it supplies one from a predetermined list of candidates.  If that fails, SMB will attempt to establish a 'guest' login connection.  That will often succeed with Unraid.  You now have a login to the server and depending on the security settings (Private, Secure or Public) of the share, your access are limited to 'guest' privileges for any share on the server. (This process is why Mapped Drives can be automatically connected at the startup of your PC.)

Yes, the test User is with PW and name in the Credential Manager.

 

6 hours ago, Frank1940 said:

Don't forget to delete all of the network connections with that Windows command when you change anything.

Yes, i used the Command and Reboot of the Machine.

I have no Fastboot activated on Win.

 

It doesnt work.😭

 

Interesting, i have no Access/Access Denied on the Test2 Share that are Public. Is this correct, why he used the test User not the guest?

Edited by Revan335
Link to comment
4 hours ago, Revan335 said:

Interesting, i have no Access/Access Denied on the Test2 Share that are Public. Is this correct, why he used the test User not the guest?

 

What I suspect is happening that the user 'test' is not being logged onto the server for some reason and your client computer is then being defaulted to a 'guest' account.  So it has access to a 'Public' share.  A lot of information about how SMB works is discussed in that PDF file that I linked you to earlier.  SMB is largely a black box as to how it really works.  Much of what is going on is not accessible to the average user-- It might be accessible to those professional IT consultants who have a MS certification.  (Read the section that begins on page 9 of the PDF file for more insight that folks have discovered via trial-and-error, and follow on with the section beginning on page 11.)  

 

I realize that English is probably not your first language but you seem rather proficient in its use so I am hoping you can understand what is in the PDF.   (I had a year of college level German back in 2001 in preparation for a 2002 trip to visit my wife's relatives in the Dresden area.  I have forgotten 99% of what I learned.  Language has never been one of my strengths so I really in awe of those people are fluent in two or more languages!)  

 

Remember to be consistent with capitalization in user_names, passwords, and file/directory names.  It seems that in some cases, SMB ignores it and enforces it in other cases. 

 

One thing that just popped into my mind.  Try an other user_name besides    test     as it may be one of those reserved words.    The name    dumkopf   springs to mind as I often said it (to myself) when I was in Germany in 2002.   And I still feel that way so many times when I can't make SMB behave the way I think it should!  🤣

Link to comment
Don't work:
~# testparm -s
Load smb config files from /etc/samba/smb.conf
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)

Server role: ROLE_STANDALONE

# Global parameters
[global]
        disable netbios = Yes
        disable spoolss = Yes
        load printers = No
        logging = syslog@0
        map to guest = Bad User
        max open files = 40960
        multicast dns register = No
        ntlm auth = ntlmv1-permitted
        null passwords = Yes
        passdb backend = smbpasswd
        printcap name = /dev/null
        security = USER
        server min protocol = SMB2
        server string = MCP
        show add printer wizard = No
        smb1 unix extensions = No
        fruit:nfs_aces = No
        idmap config * : range = 3000-7999
        idmap config * : backend = tdb
        acl allow execute always = Yes
        aio read size = 0
        aio write size = 0
        create mask = 0777
        directory mask = 0777
        include = /etc/samba/smb-shares.conf
        invalid users = root
        map archive = No
        map readonly = yes
        use sendfile = Yes
        wide links = Yes


[Test]
        path = /mnt/user/Test
        valid users = test testb dumkopf
        write list = test testb dumkopf


[Test1]
        path = /mnt/user/Test1
        valid users = test testb dumkopf
        write list = test testb dumkopf


[Test2]
        guest ok = Yes
        path = /mnt/user/Test2
        read only = No



Work on my Backup Unraid Server:
~# testparm -s
Load smb config files from /etc/samba/smb.conf
lpcfg_do_global_parameter: WARNING: The "null passwords" option is deprecated
lpcfg_do_global_parameter: WARNING: The "syslog" option is deprecated
Loaded services file OK.
Weak crypto is allowed by GnuTLS (e.g. NTLM as a compatibility fallback)

Server role: ROLE_STANDALONE

# Global parameters
[global]
        disable netbios = Yes
        disable spoolss = Yes
        load printers = No
        logging = 0
        map to guest = Bad User
        max log size = 10000
        max open files = 40960
        multicast dns register = No
        ntlm auth = ntlmv1-permitted
        null passwords = Yes
        passdb backend = smbpasswd
        printcap name = /dev/null
        security = USER
        server min protocol = SMB2
        server string = Elfen Lied
        show add printer wizard = No
        smb1 unix extensions = No
        syslog = 0
        workgroup = NAMEWITHÜ
        fruit:nfs_aces = No
        idmap config * : range = 3000-7999
        idmap config * : backend = tdb
        access based share enum = Yes
        acl allow execute always = Yes
        aio read size = 0
        aio write size = 0
        create mask = 0777
        directory mask = 0777
        hide unreadable = Yes
        include = /etc/samba/smb-shares.conf
        invalid users = root
        map archive = No
        map readonly = yes
        use sendfile = Yes
        wide links = Yes


[Test]
        path = /mnt/user/Test
        read list = test
        valid users = test
        vfs objects = extd_audit recycle
        recycle:exclude_dir = .Recycle.Bin
        recycle:exclude = *.tmp
        recycle:versions = Yes
        recycle:minsize = 1
        recycle:touch_mtime = No
        recycle:touch = Yes
        recycle:keeptree = Yes
        recycle:directory_mode = 0777
        recycle:repository = .Recycle.Bin

The Workgroup Name have a Ü in his Name. Thats what i meean with NAMEWITHÜ

 

Its working in the Past. But why dont now, and no with a new Config? I dont know.

The Mainserver its not finaly configured through the new Config on a new Stick.

 

44 minutes ago, Frank1940 said:

What I suspect is happening that the user 'test' is not being logged onto the server for some reason and your client computer is then being defaulted to a 'guest' account.  So it has access to a 'Public' share. 

Yes, That's what I think too. But why? And why from Day/Time working, to Day/Time dont working on old, new ... Config on the same Server, thats working in the Past.

Maybe working in 6.12 again and its a Bug thats the Mainserver infected, are the Backup Server working.

 

1 hour ago, Frank1940 said:

Language has never been one of my strengths so I really in awe of those people are fluent in two or more languages!

Me too! ❤️

Link to comment
2 hours ago, Revan335 said:

Is SMB/SAMBA not Open Source or Reversed Enginered and that's why implemented in Linux, Kernel?, Distributions and .....?

 

It is complicated.  Here is a link that explains what is going on:

 

     https://en.wikipedia.org/wiki/Server_Message_Block

 

SMB is actually a Microsoft controlled product.  I believe Microsoft's code is propriety. Apparently, there is a spec for it.  Samba is a reversed engineered version of SMB and is open source.  Here is a link to the portion of the article that gives some of the details:

 

      https://en.wikipedia.org/wiki/Server_Message_Block#Specifications

 

As you can see, SMB is running on your Windows computers and Samba is running on your Unraid server.  Many of us tend to interchange the terms (SMB/Samba) in an incorrect manner which probably causes confusion...    🙄

 

4 hours ago, Revan335 said:

Maybe working in 6.12 again and its a Bug thats the Mainserver infected, are the Backup Server working.

 

There is a new of Samba and I believe that it is scheduled to be included in version 6.12.   However, I don't know if a new Samba version is going to fix your problem.  At this point, I have no new suggestions for you to try.  If it were me, I would take a day or two off.  During that period, I would carefully review the PDF and the contents of this thread.  Then double check how I had everything setup and verify that I had not made some silly mistake.  The shutdown both the server and the windows client.  Start up the server.  Ten minutes later, start up the Windows client.  (After all, there are hundreds of folks who are not having any problems using SMB/Samba.) 

 

This is an off the wall question.   Have you enable NFS on your Windows computer? 

Link to comment
2 hours ago, Frank1940 said:

Have you enable NFS on your Windows computer? 

Thats a Option?

No, I don't activated this.

Can I used NFS under Win?

That's maybe a Alternative for the Main Working Linux Systems, Android and Win for Gaming and Co.

 

Do you have any Idea or need Logs, Diagnostic (Anonymous or not) .... @dlandon

Link to comment
6 hours ago, Revan335 said:

Thats a Option?

No, I don't activated this.

Can I used NFS under Win?

That's maybe a Alternative for the Main Working Linux Systems, Android and Win for Gaming and Co.

 

Do you have any Idea or need Logs, Diagnostic (Anonymous or not) .... @dlandon

 

I believe you need at least Windows 10 PRO.  (I seem to recall that was not included as an option in Windows 10 HOME.) Googling found these instructions:

 

      https://www.ibm.com/docs/en/flashsystem-v7000u/1.6.2?topic=system-connecting-using-nfs-from-microsoft-windows-client

 

Now be careful as there is a reason why SMB is preferred by most people who have to manage a Network.  (Fifteen years ago, NFS might have been a little faster as it has a bit less overhead than SMB.   That advantage is largely gone with updates found in the later SMB versions and faster CPU's.)  NFS should have been updated to address security concerns in much the same way as SMB has.  I suspect that getting an NFS networking working today has many of the same type of landmines as SMB.   Google will probably become your best friend (and, possibly, your only friend) if you go down down this path.  

Edited by Frank1940
Link to comment
10 minutes ago, Revan335 said:

I used a New Test Disk in this Fall the second empty NVMe for a New Array.

The bold word in the quote has two board definitions in American English (as a noun).  One of them is the season of the year between Summer and Winter-- Autumn.   The second one is the act of downward movement caused by the force of gravity.  (Plus, this is an old word in the English language and has a great many different meanings/definitions in certain contexts.  See here:  https://www.merriam-webster.com/dictionary/fall   This makes English a very difficult language to translate using a one-to-one translation table into other languages.)  As a result, the sentence makes no sense to me. 

 

49 minutes ago, Revan335 said:

for a New Array

Is this "New Array" a NVMe drive assigned to a Pool?  

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...