my admin accout is disabled but i still can see entries in qnap Access Log stating
that Admin login succesfully logged in from localhost (127.0.0.1) with Administration access
is it bug or maybe i've been infected ?
succesfull login for admin account from 127.0.0.1
-
- New here
- Posts: 5
- Joined: Thu Jun 02, 2016 2:17 pm
-
- Experience counts
- Posts: 2043
- Joined: Thu Mar 03, 2016 1:11 am
Re: succesfull login for admin account from 127.0.0.1
Keep calm . Such entries from localhost (127.0.0.1) arer usually from a service running at NAS.
If there would be any unknown, foreign IP, then you should investigate.
BTW: the weird advice to disable the admin account does not protect you in any way from malware!
Hopefully the NAS is not exposed to internet in any way? -> UPnP disabled at router and NAS, no port forwardings!?
Regards
If there would be any unknown, foreign IP, then you should investigate.
BTW: the weird advice to disable the admin account does not protect you in any way from malware!
Hopefully the NAS is not exposed to internet in any way? -> UPnP disabled at router and NAS, no port forwardings!?
Regards
A raid is never a substitute for backup! Never!
Deadbolt - READ 1st post!!!
Deadbolt - information
Deadbolt - find your OP_RETURN!
VPN=VPN? No!
How to clean up your NAS after malware attack
www.raidisnotabackup.com
Deadbolt - READ 1st post!!!
Deadbolt - information
Deadbolt - find your OP_RETURN!
VPN=VPN? No!
How to clean up your NAS after malware attack
www.raidisnotabackup.com
-
- New here
- Posts: 5
- Joined: Thu Jun 02, 2016 2:17 pm
Re: succesfull login for admin account from 127.0.0.1
Yep I disabled UPnP some time ago, when my Q started behaving badly - restarting , reseting admin passwords every few minutes etc.
I updated device, started using 2fa, disabled admin account and it is stable now I think but still I suspect that something could be left in system
these logs are so ... poor, I demand more information not just that admin logged from local IP
anyway why admin account is used by service (what service) and why it logs to https service ?
I updated device, started using 2fa, disabled admin account and it is stable now I think but still I suspect that something could be left in system
these logs are so ... poor, I demand more information not just that admin logged from local IP
anyway why admin account is used by service (what service) and why it logs to https service ?
-
- Easy as a breeze
- Posts: 477
- Joined: Sun Dec 30, 2007 4:55 pm
Re: succesfull login for admin account from 127.0.0.1
For more information, you may wish to google 'Loopback IP Address'.
NAS Model: TS-453B Mini/TS-253P
FW Ver: 4.4.3.1421 / 4.4.3.1421
OS: Win10 (MS Edge)
No. of HDDs: 4/2
HDD Model: WD Red
HDD Capacity: 6/3TB
RAID Config: RAID 1
Services enabled: All standard services
Ext. Devices: USB Printer (HP Laser Jet 1320)
NAS Speed/MTU: 100Mbps/1500 Bytes
FW Ver: 4.4.3.1421 / 4.4.3.1421
OS: Win10 (MS Edge)
No. of HDDs: 4/2
HDD Model: WD Red
HDD Capacity: 6/3TB
RAID Config: RAID 1
Services enabled: All standard services
Ext. Devices: USB Printer (HP Laser Jet 1320)
NAS Speed/MTU: 100Mbps/1500 Bytes