unraid does not ask for login and password on the new computer

[mavaros82]

Hello
I've been using unraid for a few months now and at first everything was fine. I had a user created and when I tried to log in to resources on a new computer, Windows asked for the login and password. Recently, I had to reinstall the system and after installation, when I tried to enter the server, windows did not ask me for my login and password. I checked the same on the laptop of a friend who has never logged in to the server, he also has full access to my shared resources without a login and password.

For test, I deleted the user through which I logged into the server and that didn't help either. I still have full access without entering my login and password.
Someone can help?
I don't want every person who logs in to my home network to have access to the resources

[itimpi]

You should post the settings for a share exhibiting this behaviour so we can see how you have its security set up.   Alternatively you are likely to get better informed feedback if you attach your system’s diagnostics zip file to your next post in this thread. It is always a good idea when asking questions to supply your diagnostics so we can see details of your system, 

[mavaros82]

system’s diagnostics file in attachment

unraid-diagnostics-20240408-2318.zip

now i dont have any created users for smb share acces but still can access from any pc on my network

Edited April 8 by mavaros82

[itimpi]

Looks like most of your shares have the share security set as “public” which means anyone can access them.   If you do not want this you need to set them to one of the more secure modes - whichever is appropriate for your use.    

[mavaros82]

I don't know what's wrong but at the moment I don't have any user to browse the smb resources but I can still browse them without any problem. Additionally, as you wrote, I set all resources as secured. But it didn't help
I am sending the diagnostics in the attachment

unraid-diagnostics-20240408-2344.zip

[Frank1940]

I looked at your Diagnostics.  I found four shares that were being exported and all were set to 'Secure'.  Please look at what the 'Secure' setting says:

(This is the SMB settings section of one of my shares and I have turned on the "HELP" for the 'Security:' setting.)

 

Notice that everyone including 'Guests' will have read access to every share on your server!   This implies that no one will asked for a password until that user attempts to do a file operation that will result in a write operation on the server!   (I know that one can copy a file off the server when that user has read-only privileges.  I suspect that one can open a file for editing but it when you attempt to save it back to the server, that is when you will be prompted.) 

 

[Frank1940]

One more quick comment.  I, personally, would never use Secure as a Security setting unless I was still using a 2010 era set-top Media player.  Either use Public or Private, if you are concerned about privacy and security.  You know what you are getting with those two!  Secure is a bad mix of the two which can lure one into a false sense of security. 

 

One more thing. Use Windows Credential manager to set up a auto login to your server.   If you use Private for some of your shares and Public or Secure for others, you can get locked of being able to log onto your server if you access a read-only share.  You can easily be logged in as 'Guest'.   Windows will prevent you from making a second login to a server with a cryptic error message that provides not a clue as to what is happening!)

Edited April 8 by Frank1940

[mavaros82]

Then if the shares are set to public, every computer in my home network has access to the shares without entering a login and password, and can also add, delete and change files without any problems? If so, is it possible to somehow change the permissions of the guest account to, for example, read-only or disable them completely?

I wouldn't want guests to be able to log in to the server without any problems

 

Edited April 9 by mavaros82

[Frank1940]

1 hour ago, mavaros82 said:

Then if the shares are set to public, every computer in my home network has access to the shares without entering a login and password, and can also add, delete and change files without any problems?

Yes!

 

1 hour ago, mavaros82 said:

If so, is it possible to somehow change the permissions of the guest account to, for example, read-only or disable them completely?

IF you use  Secure, this will be the case.   But read-only allows files to be copied.   And anyone who gains access to your LAN via WiFi also has access.  (I have been told in the past, that hacking into a WiFi network is not that difficult...)

 

If you use Private,  You can set up a special Share Access user for visitors with a password.  You then assign the privileges on each share that you want for your visitors.  (Your choices are 'No access', 'Read-only', or 'read-write'.)   But, again, read-only does allow for copying of files  BUT the big difference is that if you give the Log-in info to a visitor, you probably have more trust in them.  Of course, this means that you have to setup the Share Access user on the server and give out the login and password information to your visitors.   (BTW, you can have several visitors all using the same 'visitor' share-access user account logged on at the same time.  Unraid 'knows' that they are on separate devices and uses that info in processing requests!)

 

IF you want more information about setting up SMB on Windows and Unraid, read the PDF files in the first post of this thread:

 

       https://forums.unraid.net/topic/110580-security-is-not-a-dirty-word-unraid-windows-10-smb-setup/

 

 

[mavaros82]

Thank you all for your help and explaining everything
I found a way to block anonymous/guest logins to the unraid server.
Just add a line in the smb settings

 

restrict anonymous = 2

 

From now on, when trying to enter the server from a network environment, the system will ask us for a password.

I hope someone finds it useful

Edited April 9 by mavaros82
found solution