Repeated prompts for credentials on windows client; cannot log in

[jleveille]

Hi,

I have a QNAP TS-212. It is named bratwurst. I have it set up with windows networking enabled using local users so no Active Directory or LDAP integration. I have WINS enabled and a simple home network 192.168.0.0 network. There are two users defined in the configuration which I can see when I use the web browser to step through the system configuration interface. Under "Security" I have checked "Allow all connections" and I have not enabled any network access protections that would lock out a client based on failed login attempts. Under Privilege Settings->Shared Folders I have opened up the permissions as wide as possible on all network shares. "Enable Advanced Folder Permissions" and "Enable Windows ACL Support" are both unchecked. The folder permissions on the "Public" share and all other shares are all set to "Guest access right = Full Access" plus both users and the group Everyone have read/write allowed. So, as far as I can tell, this should be a wide open NAS device that I can address using UNC paths or mapped drive without the need to supply credentials.

Oh, and I have logged into the web interface for the QNAP with each of the defined userids so I know that I have the proper credentials.

Problem: When I try to address \\bratwurst I am able to browse the list of shares in windows explorer. No prompting for credentials happens at this time. So far so good. When I double click "Public" I get a prompt for credentials. Why? Can I turn this off? Sadly, when I supply the credentials for either of the two users I am unable to gain access to the Public share. I tried this test from my Windows 8 laptop (work machine) and my wife's Windows 10 laptop (home machine). Same results.

How can I debug this further?

Thanks,
John

[jleveille]

Oddly, there is a share called "home" that I can log in to without any prompt for credentials (or it is silently accepting the credentials I supplied before when Public folder prompted for credentials).

[schumaku]

Hello John,

Nothing odd - welcome to Windows! Windows will _never_ let you use another set of credentials between one Windows client and one server. Before Windows 10 ... it will simply loop asking for username and password forever ... and you can try as many as you want, the authentication attempt will always fail (even with perfectly correct credentials). Why have I mentioned windows 10? Windows 10 will let you know about this.

I have WINS enabled and a simple home network 192.168.0.0 network

Unless you operate a network with multiple segments individually connected to the NAS, WINS is not required.

The trick is most simple:

1. Set-up the same user account on the Windows machine for the desktop login and on the NAS - same username, same password.
2. Enforce a login on Windows with username and password in case it's disabled.
3. Create group(s) with users sharing the similar access rights.
4. Grant the shared folder access based on groups only.
5. Remove any stored NAS credentials from the Windows local credentials manager
6. Remove any shared folder access rights for everyone (do _not_ set it to deny - delete the entry)

Can't be easier: One login - and you have direct access to your NAS shared folders. That's the way Windows Workgroups are set-up and working - for 25 years.

Beyond remember: If you ever get challenged for credentials when accessing shared folder resources (by SMB) ... something is wrong.

Not a NAS issue at all.

Regards,
-Kurt.

[jleveille]

Thanks for the guidance. I think you misunderstood something. I am not trying to use two userids. I just happen to have two accounts defined on the NAS. I have one that is an administrator and one that is not. I can attempt to open the Public share using either set of credentials and neither one works. So I am not trying the second set of credentials until I failed on the first set. Again, I am just noting that I have two defined. Two sets of credentials are not required to demonstrate my problem.

At present, my Public share is not accessible and I seem to have no way to get into it.

I used "net use" to show me the active shares. Then I used net use /delete to get rid of everything. Despite clearing them out, Public share still prompts me for login and refuses all credentials supplied.

I will tinker with group permissions to see if I can get different behavior on the Public share, but the "everyone" group is already defined and has read and write access along with guest user having full control. So I do not see how I am misconfiguring QNAP. It looks like some kind of defective behavior, IMO. Having said that, perhaps I am yet misunderstanding what it means to "drop the security pants" on this device...

[schumaku]

I am not trying to use two userids. I just happen to have two accounts defined on the NAS.

...where only one can be used at the same time. The only difference of a NAS administrator account is that you can manage the NAS to some extent from the QTS desktop. To the file sharing, this does not make a difference.

I can attempt to open the Public share using either set of credentials and neither one works.

So something wrong with the Public shared folder access rights. Post a screenshot of the shared folder Public access rights.

Example: This is a Public share where the user admin, the group everyone (all local NAS users), and the non-authenticated guest account (not possible on Windows anymore) have full r&w access. Note: There is no "guest" account required on the authentication side (even if the non-authenticated access is mapped to a uid internally).

Public - everyone admin.PNG

You will gain access to the /home share related to the user account which was used (successfully) - evne if the access to the Public share was not granted. Windows does keep the credentials for the same user.

At present, my Public share is not accessible and I seem to have no way to get into it. I used "net use" to show me the active shares. Then I used net use /delete to get rid of everything. Despite clearing them out, Public share still prompts me for login and refuses all credentials supplied.

All this would not be required if using the same user credentials approach.

[jleveille]

I understand that only a single set of credentials can be used for a given workstation/laptop to connect to the NAS. I'm good there. Understood. I think it is also useful to communicate that I have spent over 20 years in software development so I understand advanced concepts like caching, protocols, client v. server, etc. I also know how to operate the windows command line should that prove useful to peek behind the behavior of the GUI and try to push a set of credentials through a drive mapping command. I also have putty and winscp on my machine should those tools prove useful in the diagnostic exercise. For example, I used putty to prove to myself that I could log on to the NAS using SSH with the credentials for admin and then with the credentials for jleveille - so I am certain I have either set of credentials to try and both work through SSH, not just through the web interface of the NAS.

As you requested, attached is the screen shot of the permissions for the Public share. As a further probe to see if I could change the behavior, I even deleted the ACLs shown and recreated them. It did not change the behavior.

2016-04-27 07_42_54-bratwurst.png

Thanks for your assistance,
John

[schumaku]

Public shared folder looks OK. Enable the System Connection log, reboot the Windows box, and re-run your test - now you should see what is going on...

[jleveille]

Logging enabled. I see login attempts by "guest" and "admin". The login attempt by guest appears to have be caused by first touching the IPC$ share (the root folder view that shows the shares available on the NAS). I supplied the admin credentials into a credentials prompt in this first contact from the client to the server which I believe caused the login attempt by admin.

The NAS showed the root level shares in my windows explorer.

Then I tried clicking into the public folder and other folders. All prompted for credentials again and did not allow me to view their contents aside from the "home" folder that does not prompt me and shows me its contents. This is the same behavior I have experienced from the start of this posting. So no change in behavior.

During the repeated attempts to access the network shares I saw only two additional records appear in the connection log window (despite having all logging options enabled). These two log records say that admin is accessing admin/@Recycle/deskop.ini with Read access. Status of log records is Info which to me says that there was no error.

Interestingly, no record appears about the Public, Download, Multimedia or other folders that I attempted to access and was refused.

It appears I need a better tool for diagnosing the handshake between the windows client and the NAS. The toolset I am using seems poor, indeed.

[schumaku]

All prompted for credentials again and did not allow me to view their contents aside from the "home" folder that does not prompt me and shows me its contents.

So there must be a credential set in use - write to the /home shared folder, and look up in which users home folder (in /share/homes/[username] for example. Check the Windows user credentials store for any stored credentials for the NAS - guess you don't use a Windows user named admin of course.

Strange that admin should not be able to access the Public shared folder with the settings shown.

[Don]

Remove all connections from the Windows PC. Verify that they are all gone by using 'net use' at a Windows command prompt. Then try mapping drives. If your windows ID and PW are the same as your ID and PW then you should not get promoted for credentials.

[jleveille]

I wrote a file into the homes folder and then logged on via ssh, snooped around and found that the file belongs to the account "admin" as it resides in that user's home folder and the owner of the file in the putty shell showed as "admin". Recall that I had to use ssh to verify this as I cannot access the "home" folder under SMB protocol. I can only access "homes". Odd behavior by the way.

Potentially important for interpreting the info below: My laptop is my work laptop. It is part of the D-WISE windows domain belonging to my work. I am currently not connected to the work VPN. I am logged on to the laptop as D-WISE\jleveille.

Next I verified that net use showed no connections and I tried mapping a drive using the command line. I was refused on repeated attempts. Please review the info below to see what I did. All attempts failed.

C:\Users\jleveille>net use q: \\bratwurst\Public /user:admin
Enter the password for 'admin' to connect to 'bratwurst':
The password is invalid for \\bratwurst\Public.

Enter the password for 'D-WISE\admin' to connect to 'bratwurst':
System error 5 has occurred.

Access is denied.


C:\Users\jleveille>net use q: \\bratwurst\Public /user:workgroup\admin
Enter the password for 'workgroup\admin' to connect to 'bratwurst':
The password is invalid for \\bratwurst\Public.

Enter the password for 'workgroup\admin' to connect to 'bratwurst':
System error 5 has occurred.

Access is denied.


C:\Users\jleveille>net use q: \\bratwurst\Public /user:bratwurst\admin
Enter the password for 'bratwurst\admin' to connect to 'bratwurst':
The password is invalid for \\bratwurst\Public.

Enter the password for 'bratwurst\admin' to connect to 'bratwurst':
System error 5 has occurred.

Access is denied.

[Don]

Why are you using admin? Don't you have a jleveille user ID on the NAS?

[jleveille]

Just for completeness I went to the NAS, created the userid "patti" to represent my wife. I gave read/write access to Public share to that new user. I made her password match the one that she uses on her Windows 10 laptop. Her laptop is not a member of any windows domain for work. It is a personal laptop we bought at best buy. Her userid is patti on both the laptop and the NAS. Passwords match.

Cannot access the Public share from her laptop and neither can I map a drive using command line on her laptop. Same Access is denied message with System error 5.

So it does not seem that my core issue is because of the fact that my laptop belongs to my work domain.

[jleveille]

Enabled logging level 10 and restarted SMB service from putty command window. Attempted connecting from my wife's PC using the new "patti" account and was denied. Massive logging output yielded this detail that I cannot interpret.

[2016/05/01 11:00:10.748704, 4] smbd/uid.c:460(push_conn_ctx)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2016/05/01 11:00:10.749028, 4] smbd/sec_ctx.c:314(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2016/05/01 11:00:10.749181, 5] ../libcli/security/security_token.c:53(security_token_debug)
Security token: (NULL)
[2016/05/01 11:00:10.749323, 5] auth/token_util.c:527(debug_unix_user_token)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2016/05/01 11:00:10.749700, 4] smbd/sec_ctx.c:422(pop_sec_ctx)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2016/05/01 11:00:10.749858, 10] passdb/lookup_sid.c:1256(legacy_sid_to_gid)
LEGACY: mapping failed for sid S-1-5-11
[2016/05/01 11:00:10.750013, 10] passdb/lookup_sid.c:1221(legacy_sid_to_uid)
LEGACY: mapping failed for sid S-1-5-11
[2016/05/01 11:00:10.750172, 10] auth/auth_util.c:506(create_local_token)
Could not convert SID S-1-1-0 to gid, ignoring it
[2016/05/01 11:00:10.750323, 10] auth/auth_util.c:506(create_local_token)
Could not convert SID S-1-5-2 to gid, ignoring it
[2016/05/01 11:00:10.750486, 10] auth/auth_util.c:506(create_local_token)
Could not convert SID S-1-5-11 to gid, ignoring it
[2016/05/01 11:00:10.750659, 10] ../libcli/security/security_token.c:63(security_token_debug)
Security token SIDs (7):
SID[ 0]: S-1-5-21-2241368403-3956901757-1633600157-2002
SID[ 1]: S-1-5-21-2241368403-3956901757-1633600157-1201
SID[ 2]: S-1-1-0
SID[ 3]: S-1-5-2
SID[ 4]: S-1-5-11
SID[ 5]: S-1-22-1-501
SID[ 6]: S-1-22-2-100
Privileges (0x 0):
Rights (0x 0):
[2016/05/01 11:00:10.751393, 10] auth/token_util.c:527(debug_unix_user_token)
UNIX token of user 501
Primary group is 100 and contains 1 supplementary groups
Group[ 0]: 100
[2016/05/01 11:00:10.751664, 10] auth/auth_ntlmssp.c:174(auth_ntlmssp_check_password)
Got NT session key of length 16
[2016/05/01 11:00:10.751811, 10] auth/auth_ntlmssp.c:181(auth_ntlmssp_check_password)
Got LM session key of length 8
[2016/05/01 11:00:10.751964, 10] ../libcli/auth/ntlmssp_server.c:496(ntlmssp_server_postauth)
ntlmssp_server_auth: Using unmodified nt session key.
[2016/05/01 11:00:10.752139, 3] ../libcli/auth/ntlmssp_sign.c:535(ntlmssp_sign_init)
NTLMSSP Sign/Seal - Initialising with flags:
[2016/05/01 11:00:10.752284, 3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
Got NTLMSSP neg_flags=0xe2088215
NTLMSSP_NEGOTIATE_UNICODE
NTLMSSP_REQUEST_TARGET
NTLMSSP_NEGOTIATE_SIGN
NTLMSSP_NEGOTIATE_NTLM
NTLMSSP_NEGOTIATE_ALWAYS_SIGN
NTLMSSP_NEGOTIATE_NTLM2
NTLMSSP_NEGOTIATE_VERSION
NTLMSSP_NEGOTIATE_128
NTLMSSP_NEGOTIATE_KEY_EXCH
NTLMSSP_NEGOTIATE_56
[2016/05/01 11:00:10.753058, 10] smbd/password.c:293(register_existing_vuid)
register_existing_vuid: (501,100) patti patti BRATWURST guest=0
[2016/05/01 11:00:10.753219, 3] smbd/password.c:298(register_existing_vuid)
register_existing_vuid: User name: patti Real name: Linux User
[2016/05/01 11:00:10.753367, 3] smbd/password.c:308(register_existing_vuid)
register_existing_vuid: UNIX uid 501 is UNIX user patti, and will be vuid 100
[2016/05/01 11:00:10.753576, 10] lib/dbwrap_tdb.c:102(db_tdb_fetch_locked)
Locking key 49442F383732302F3130
[2016/05/01 11:00:10.753763, 10] lib/dbwrap_tdb.c:131(db_tdb_fetch_locked)
Allocated locked data 0x0x2099240
[2016/05/01 11:00:10.754076, 10] lib/dbwrap_tdb.c:44(db_tdb_record_destr)
Unlocking key 49442F383732302F3130
[2016/05/01 11:00:10.754331, 7] param/loadparm.c:9958(lp_servicenumber)
lp_servicenumber: couldn't find patti
[2016/05/01 11:00:10.754483, 5] lib/username.c:171(Get_Pwnam_alloc)
Finding user patti
[2016/05/01 11:00:10.754625, 5] lib/username.c:116(Get_Pwnam_internals)
Trying _Get_Pwnam(), username as lowercase is patti
[2016/05/01 11:00:10.754780, 5] lib/username.c:149(Get_Pwnam_internals)
Get_Pwnam_internals did find user [patti]!
[2016/05/01 11:00:10.754924, 3] smbd/password.c:238(register_homes_share)
Adding homes service for user 'patti' using home directory: '/share/homes/patti'
[2016/05/01 11:00:10.755133, 7] param/loadparm.c:9958(lp_servicenumber)
lp_servicenumber: couldn't find samba_default_home
[2016/05/01 11:00:10.755359, 6] param/loadparm.c:7605(lp_file_list_changed)
lp_file_list_changed()
file /etc/config/smb.conf -> /etc/config/smb.conf last mod_time: Sun May 1 10:44:11 2016

[2016/05/01 11:00:10.755754, 5] lib/util.c:336(show_msg)
[2016/05/01 11:00:10.755854, 5] lib/util.c:346(show_msg)
size=106
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51203
smb_tid=65535
smb_pid=65279
smb_uid=100
smb_mid=128
smt_wct=4
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 9 (0x9)
smb_bcc=63
[2016/05/01 11:00:10.756821, 10] ../lib/util/util.c:415(dump_data)
[0000] A1 07 30 05 A0 03 0A 01 00 51 00 54 00 53 00 00 ..0..... .Q.T.S..
[0010] 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 00 2E .S.a.m.b .a. .3..
[0020] 00 36 00 2E 00 32 00 35 00 00 00 57 00 4F 00 52 .6...2.5 ...W.O.R
[0030] 00 4B 00 47 00 52 00 4F 00 55 00 50 00 00 00 .K.G.R.O .U.P...
[2016/05/01 11:00:10.771130, 10] lib/util_sock.c:519(read_smb_length_return_keepalive)
got smb length of 88
[2016/05/01 11:00:10.771359, 6] smbd/process.c:1608(process_smb)
got message type 0x0 of len 0x58
[2016/05/01 11:00:10.771516, 3] smbd/process.c:1610(process_smb)
Transaction 3 of length 92 (0 toread)
[2016/05/01 11:00:10.771666, 5] lib/util.c:336(show_msg)
[2016/05/01 11:00:10.771753, 5] lib/util.c:346(show_msg)
size=88
smb_com=0x75
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=0
smb_pid=65279
smb_uid=100
smb_mid=192
smt_wct=4
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 88 (0x58)
smb_vwv[ 2]= 8 (0x8)
smb_vwv[ 3]= 1 (0x1)
smb_bcc=45
[2016/05/01 11:00:10.772720, 10] ../lib/util/util.c:415(dump_data)
[0000] 00 5C 00 5C 00 42 00 52 00 41 00 54 00 57 00 55 .\.\.B.R .A.T.W.U
[0010] 00 52 00 53 00 54 00 5C 00 50 00 55 00 42 00 4C .R.S.T.\ .P.U.B.L
[0020] 00 49 00 43 00 00 00 3F 3F 3F 3F 3F 00 .I.C...? ????.
[2016/05/01 11:00:10.773265, 3] smbd/process.c:1415(switch_message)
switch message SMBtconX (pid 8720) conn 0x0
[2016/05/01 11:00:10.773419, 4] smbd/sec_ctx.c:314(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2016/05/01 11:00:10.773566, 5] ../libcli/security/security_token.c:53(security_token_debug)
Security token: (NULL)
[2016/05/01 11:00:10.773709, 5] auth/token_util.c:527(debug_unix_user_token)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2016/05/01 11:00:10.773925, 5] smbd/uid.c:400(change_to_root_user)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2016/05/01 11:00:10.774107, 4] smbd/reply.c:794(reply_tcon_and_X)
Client requested device type [?????] for share [PUBLIC]
[2016/05/01 11:00:10.774326, 5] smbd/service.c:1365(make_connection)
making a connection to 'normal' service public
[2016/05/01 11:00:10.774514, 0] lib/access.c:338(allow_access)
Denied connection from 192.168.1.27 (192.168.1.27)
[2016/05/01 11:00:10.774691, 3] smbd/error.c:81(error_packet_set)
error packet at smbd/reply.c(803) cmd=117 (SMBtconX) NT_STATUS_ACCESS_DENIED
[2016/05/01 11:00:10.774849, 5] lib/util.c:336(show_msg)
[2016/05/01 11:00:10.774938, 5] lib/util.c:346(show_msg)
size=35
smb_com=0x75
smb_rcls=34
smb_reh=0
smb_err=49152
smb_flg=136
smb_flg2=51203
smb_tid=0
smb_pid=65279
smb_uid=100
smb_mid=192
smt_wct=0
smb_bcc=0
[2016/05/01 11:00:10.775669, 10] ../lib/util/util.c:415(dump_data)
[2016/05/01 11:00:10.777370, 10] lib/util_sock.c:519(read_smb_length_return_keepalive)
got smb length of 39
[2016/05/01 11:00:10.777567, 6] smbd/process.c:1608(process_smb)
got message type 0x0 of len 0x27
[2016/05/01 11:00:10.777721, 3] smbd/process.c:1610(process_smb)
Transaction 4 of length 43 (0 toread)
[2016/05/01 11:00:10.777869, 5] lib/util.c:336(show_msg)
[2016/05/01 11:00:10.777956, 5] lib/util.c:346(show_msg)
size=39
smb_com=0x74
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=48467
smb_pid=65279
smb_uid=100
smb_mid=256
smt_wct=2
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_bcc=0
[2016/05/01 11:00:10.778828, 10] ../lib/util/util.c:415(dump_data)
[2016/05/01 11:00:10.778923, 3] smbd/process.c:1415(switch_message)
switch message SMBulogoffX (pid 8720) conn 0x0
[2016/05/01 11:00:10.779072, 4] smbd/sec_ctx.c:314(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2016/05/01 11:00:10.779216, 5] ../libcli/security/security_token.c:53(security_token_debug)
Security token: (NULL)
[2016/05/01 11:00:10.779756, 5] auth/token_util.c:527(debug_unix_user_token)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2016/05/01 11:00:10.780007, 5] smbd/uid.c:400(change_to_root_user)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2016/05/01 11:00:10.780199, 10] lib/dbwrap_tdb.c:102(db_tdb_fetch_locked)
Locking key 49442F383732302F3130
[2016/05/01 11:00:10.780395, 10] lib/dbwrap_tdb.c:131(db_tdb_fetch_locked)
Allocated locked data 0x0x209b028
[2016/05/01 11:00:10.780598, 10] lib/dbwrap_tdb.c:44(db_tdb_record_destr)
Unlocking key 49442F383732302F3130
[2016/05/01 11:00:10.780799, 3] smbd/reply.c:2096(reply_ulogoffX)
ulogoffX vuid=100
[2016/05/01 11:00:21.526957, 1] smbd/process.c:458(receive_smb_talloc)
receive_smb_raw_talloc failed for client 192.168.1.27 read error = NT_STATUS_CONNECTION_RESET.
[2016/05/01 11:00:21.527247, 4] smbd/sec_ctx.c:314(set_sec_ctx)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2016/05/01 11:00:21.527413, 5] ../libcli/security/security_token.c:53(security_token_debug)
Security token: (NULL)
[2016/05/01 11:00:21.527564, 5] auth/token_util.c:527(debug_unix_user_token)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2016/05/01 11:00:21.527787, 5] smbd/uid.c:400(change_to_root_user)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2016/05/01 11:00:21.528246, 3] smbd/server_exit.c:181(exit_server_common)
Server exit (failed to receive smb request)

[schumaku]

[2016/05/01 11:00:10.774514, 0] lib/access.c:338(allow_access)
Denied connection from 192.168.1.27 (192.168.1.27)

There must be Microsoft Networking host access configured for the shared folder(s) in question - the access for this IP to the Public shared folder is simply denied.