I had to set up a new computer and took my Windows 10 computer out (computer could not be upgraded to Windows 11). The new Windows 11 computer is asking for network credentials for my unraid server.  I stupidly typed in "root" during one attempt to access, and now Windows has kept that and asks for a password.  (Note: I have multiple other windows 11 computers, and none of them needed a username or password. They are all Windows 11 home though..)  Everything currently is open and public. 

 

This computer has Windows 11 pro.  I've gone through part of this:

 

 

And this:

 

 

And this:

https://techcommunity.microsoft.com/blog/filecab/accessing-a-third-party-nas-with-smb-in-windows-11-24h2-may-fail/4154300

 

I have done everything on the above page (access gpedit and modify settings to allow "insecure" communications with the unraid server), and set my network to private. Does not work.

 

I have seen Frank's Unraid & Windows 10 SMB Setup PDF, but I have not needed to use this with my 4 other computers running the Home version of Windows 11.  Do I really need to set up a username and password for using unraid with my 5 computers?

 

And how do I get rid of the "root" part of Windows security, because it does not give me the option to change this? (And, it now opens two of these windows. No idea why.)

 

Thank you.

46 minutes ago, ctviggen said:

And how do I get rid of the "root" part of Windows security,

Use the Windows Credentials Manager

See if this helps:

https://forums.unraid.net/topic/177975-formatted-my-pc-and-installed-fresh-windows-11-now-cant-access-smb-shares/?do=findComment&comment=1478526

 

2 hours ago, ctviggen said:

I have seen Frank's Unraid & Windows 10 SMB Setup PDF, but I have not needed to use this with my 4 other computers running the Home version of Windows 11.  Do I really need to set up a username and password for using unraid with my 5 computers?

 

 

It is a one time setup for each computer.  If you have been using PUBLIC access to your Unraid server, you only need to setup one user on your Unraid server---   smbuser for example.  After all, the 'user name' is nothing but a set of rules to permit access to your server.  You can set those rules to as restrictive as you desire.  Then use the name (smbuser) to log on from every client computer.  (SMB/Samba will prefix that user name with the name of the client computer.  Thus every login to your Unraid will be unique!) 

 

SMB signing is easy to enable in Unraid.  (LimeTech has plans to implement SMB signing when version 7 is released.)  To enable it in earlier versions, you can do this (from my post on setting up a secure server):

 

The first major change is that they are requiring SMB signing going forward.  (SMB signing has been optional for about 30 years.)   This is to address some security concerns with malicious servers and tampering with SMB data as it travels through the network.  

 

You should be able to tune SMB signing on your Unraid server by adding the following to the    Samba Extras   section of the    SETTINGS    >>>  SMB

 

[global]
server signing = auto

 

(If there already is a [global] section heading, just add the second line.)   I tested this by upgrading a WIN11 Pro mini computer to 24H2 and verifying that SecuritySigniture was required.  (I had to turn it on-- not sure why??)   And everything worked for the client computers which are still running WIN11 Pro 23H2.  

 

I don't quite understand why folks think they don't need security in this modern age.  Most home LAN's will have WIFI set up on them and WIFI is hackable with kiddy-scripts.  Many folks will pass out the WIFI credentials to visitors.  These credentials may well connect to the  home LAN if they have not set up a 'Guest' WIFI network.  So you really want all your friends and relatives to have access to your personal and financial information?  Once you setup a a Windows credential in Credential Manager for a client computer, you will never have to do anything more to keep it working.  Attempting to bypass MS Security updates (to keep a networking setup from the 2010 era)  has been a whack-a-mole game for many years and there is no reason to expect things to change.)   

 

One more thing, those instructions were for those people running NSA boxes whose manufacturers are not longer supporting them.  Unraid and Samba are a supported products and they will support MS current security requirements.   The release of 24H2 has been a disaster on MS's part!  It still has not been completely released to the general public and every time they try for a general release, another major problem crops up.  But I understand it is installed some new computers that are for sale...

2 hours ago, Frank1940 said:

[global]
server signing = auto

This should not be needed, it's already the default, even for older Unraid releases, but it won't hurt, of course.

 

 

2 hours ago, JorgeB said:

This should not be needed, it's already the default, even for older Unraid releases, but it won't hurt, of course.

 

 

 It may not be what you think is happening.  This is from a series of private messages from myself to another Unraid user discussing this problem:

 

 

This message was written on May 31st of this year so the version of Unraid was fairly recent as of that date.  You can see that the setting is 'default' and the description form samba.org indicates that signing is only supported in the when the server is in the Active Directory mode which most Unraid users would not be using.  With the 'auto' setting in Samba Extras and Unraid version 6.12.14, testparm gives this as the setting:

 

 

I understand that SMB signing requires substantial CPU overhead and that is why it was not forced previously.  However, with the increase in CPU processing power, MS  (apparently) was decided that forcing support would not cause a substantial performance hit. 

 

Edited December 28, 20241 yr by Frank1940

13 hours ago, Frank1940 said:

It may not be what you think is happening. 

As mentioned in that text, for SMB2, server signing cannot be disabled, if the client asks for it, i.e., Windows 11 24H2, it will be used.

 

 

I've also tested this myself, running Unraid 6.12.0, a new Windows 11 24H2 install, and it connected fine after adding the user to the credential manager, no need to add/change any SMB settings.

 

 

Thanks, All.  I added a new user to the unraid server with a username and password, then using the credentials manager in Windows, I removed the "root" credential and added the credentials for the server and new username and password.  That worked!

 

What happens if I don't remember the password 1-3 years from now?

 

I don't see how this corrects any security issue, though, because everything is still public.  And, I have so much to do and no time to do it, that I can't be concerned with this.  I have multiple issues with the unraid server (the parity drive threw an error a while back, have a new drive, no time to fix it; the motherboard is the type you can log into, but the board somehow misplaced the password, can't fix it; the system only shuts down with a hard shutdown, can't fix it).  I could list off 50+ things I'd like to be doing, but don't have the time to do.

 

I now have to install a huge list of software on this computer, some of which requires material from the unraid server.

 

Thanks for the help, and if I run into any other issues, I'll report back.

 

 

 

 

25 minutes ago, ctviggen said:

What happens if I don't remember the password 1-3 years from now?

Use a password manager or a notebook.  

 

25 minutes ago, ctviggen said:

I don't see how this corrects any security issue, though, because everything is still public.

SHARES   >>>   {share_name}     It takes about one minute per share to make things private:

 

Don't see how Unraid could make it less simple!  (Unless you have 50 shares then you made things complicated...    😊)

 

Edited December 29, 20241 yr by Frank1940

2 hours ago, JorgeB said:

As mentioned in that text, for SMB2, server signing cannot be disabled, if the client asks for it, i.e., Windows 11 24H2, it will be used.

 

 

I've also tested this myself, running Unraid 6.12.0, a new Windows 11 24H2 install, and it connected fine after adding the user to the credential manager, no need to add/change any SMB settings.

 

 

Thanks for pointing out that SMB signing is implemented in Samba for SMB2 and higher when using the 'default' signing option. 

 

There are still a few-many(???) folks still using SMBv1 on their Unraid systems.  (That is a major problem with trying to provide help for SMB issues.  So many users have hacked Windows in an attempt to avoid using any security on their Unraid server that you never know what type of setup you are dealing on the Windows client end. Plus, there are subtle  differences in SMB between the various versions of Windows----  Home, Pro, Enterprise, Education, etc.  And this doesn't include what MS does when they silently do their monthly updates on, or soon after, the second Tuesday.  Most folks just let those updates 'happen' and then can't figure why things stop working.)

1 hour ago, Frank1940 said:

There are still a few-many(???) folks still using SMBv1 on their Unraid systems.

Yes, for those, it could be more complicated, but we should also try to move all users to smb2/3, smb1 is very unsafe now, though some users may have older devices that can only connect with smb1.

I know you people think this is fast.  I have a daughter who has pediatric acute-onset neuro-psychiatric syndrome (PANS) who tried to kill herself by taking an overdose.  She then developed actual anorexia, where we thought she was eating, but was throwing food away. (Most of these PANS kids have disordered eating, which they refer to as "anorexia", but it's more that they eat less.) Because she was not eating and we were giving her NSAIDs along with other drugs, which she was taking on an empty stomach, she developed a puncture to the lining of her intestine.  She had to have surgery. Because of her condition, she has suicidal ideation, and they have put her in a psychiatric hospital.  (PANS kids have inflammation of the brain; if she was having psychiatric symptoms, we'd give her NSAIDs, and within 20 minutes, she'd be calm. So, we were living on NSAIDs.)

 

I have another teen who is actively looking at schools for college, and we're doing all the college entrance crap, which is hours of entering in data, going to see schools, seeing her final projects, helping with the play she's in.

 

I am working a lot of weekends because I'm at a job where that happens.

 

I have zero time. No time. I CANNOT take the time to fix ANYTHING on my massive list.  NOTHING. If it works, it's so far down on my list that I CANNOT do anything about it.

 

I'm back here because now another one of my computers won't let me access the NAS. And I already don't remember the password I used.

 

Anyway, I am thankful for the help.  But I do NOT HAVE TIME do do any of this stuff, until it breaks. If it breaks, I have to fix it. That's what I'm doing now.

33 minutes ago, ctviggen said:

And I already don't remember the password I used.

I realize that you have a lot of very serious problems right now. 

 

Remembering passwords should not be one of them.  If your location is reasonably secure, you could just write them in a notebook.  If you think you require more security, you could use a password manager.  While it probably won't auto-fill a SMB login, it will be available for lookup. 

 

Many people in your situation will use a a single SMB user with a common password for all SMB logins.  Since you are complaining that Windows is now requiring a SMB login, you obviously don't care who has access to the data on your server.  You could chose a password like "1234" (or a pet's name) and Windows would be perfectly happy.  (I am elderly and I actually have a card with all of the passwords for that server pasted right on the server.  They are there for when my executor will require them!)