Qts 4.5.1.1495 loggin from disabled admin

Discussion on setting up QNAP NAS products.
Post Reply
Errorbit
New here
Posts: 6
Joined: Wed Nov 25, 2020 12:17 pm

Qts 4.5.1.1495 loggin from disabled admin

Post by Errorbit »

Hallo Community,
This is my fist post here, I don't know if I am on right place with this topic here.
I have security problems in my home network.

My Nas is TS-453BE

I have yesterday complete reset the Nas without hhds, pluget one HDD in and initialize the system (Qts 4.5.1.1.1480).
I done this :
Update to new firmware.
Disabled admin account
Disabled all services on the wan interface (service binding)
Disabled bonjour, other stuff I don't need.

But I still see logins from admin without any IP shown as "---"
I just installed one app "virtualization station".

Recognized if I login with my user , quickly after that I see second user online (disabled admin account over http/Https)

Is this normal behaviour ? I mean this user is security reasons disabled ....

Pleas help.

Qnap is a nice product :)
Regards errorbit
Mousetick
Experience counts
Posts: 1081
Joined: Thu Aug 24, 2017 10:28 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Mousetick »

Errorbit wrote: Mon Nov 30, 2020 3:17 am Disabled admin account
Where did you disable the admin account?
But I still see logins from admin without any IP shown as "---"
Where do you see logins from admin?
Recognized if I login with my user , quickly after that I see second user online (disabled admin account over http/Https)
Where and what do you see exactly?
Errorbit
New here
Posts: 6
Joined: Wed Nov 25, 2020 12:17 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Errorbit »

Hello Mouseticks,
Here is screenshot.

Image
Where did you disable the admin account?
in the user panel see screenshot.
Where do you see logins from admin?
In the dashboard and in qulog users online
Where and what do you see exactly?
Login from this user, I don't know how it is possible... This user is disabled....
Errorbit
New here
Posts: 6
Joined: Wed Nov 25, 2020 12:17 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Errorbit »

Is my Nas hacked again ?
Mousetick
Experience counts
Posts: 1081
Joined: Thu Aug 24, 2017 10:28 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Mousetick »

Ok, thanks for the answers.

Can you look at the System Access Logs in QuLog Center, and see what resources are accessed by admin user. See screenshot below.
sysaccesslog.png
Errorbit wrote: Tue Dec 01, 2020 12:22 am Is my Nas hacked again ?
It's unlikely but I wouldn't store any data on it until the strange admin activity is explained. Did you mean your NAS had been hacked before you reinitialized it?
Disabled all services on the wan interface (service binding)
Service binding settings don't disable services, they're still enabled and listening on all network interfaces. You need to turn off each service individually in Control Panel, and each app individually in App Center (click the 'down arrow' button and select 'Stop' if the choice is available).
You do not have the required permissions to view the files attached to this post.
Errorbit
New here
Posts: 6
Joined: Wed Nov 25, 2020 12:17 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Errorbit »

Hello Mausetick,
Yes I think so, I had several VMS on the Nas with manipulated SSH keys, I was not able to login from local lan with SSH anymore, also in the passt I heard hard drive activities but I didn't do anything, also no VMS are present to the nois time (it's random time) (HDD is noisily if you read or write on it)
I also recognized that some of my internet resources (we hosting, outside from the Nas (hosting provider in Germany) passwords changes ....
I already switched to Linux at home :)

The system access log don't have any entries about admin user ....
Only that from my user, they are ok.

I also recognized after I start the app "virtualization station" and the console of VMS appears immidiantaly the admin user gets logged in ...


What's going on on this Nas ????
Need help....sos
Errorbit
New here
Posts: 6
Joined: Wed Nov 25, 2020 12:17 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Errorbit »

The system access log seams to be stopped !
I just connected to the Nas over samba there is no new entry about SMB connection.
Also the log is cleared , first entry is whit my IP and this admin user over NFS .... I didn't use NFS after reinstall the Nas :-0 :-0 :-0
Mousetick
Experience counts
Posts: 1081
Joined: Thu Aug 24, 2017 10:28 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Mousetick »

Errorbit wrote: Tue Dec 01, 2020 5:43 am What's going on on this Nas ????
Need help....sos
When you disable the admin user as you did, it's not possible to login to the NAS as that user. But the admin user account still exists on the NAS and is still used to perform system-level operations on and by the NAS itself. It's essential to the OS itself. Since you switched to Linux at home, you can easily understand this: the admin user on QNAP NAS is just a different name for the root user (UID 0). Pretty much all services and apps run as the admin/root user on QNAP NASes.

I suspect the weird admin activity you're seeing is caused by Virtualization Station compounded with bugs in the QuLog Center app, but I don't use VS myself, so can't compare with my own experience. I'd suggest you contact QNAP tech support (file a ticket) so they can give you an official explanation.

Lastly, hearing the spinning hard disks making grinding noises while you're not actively using the NAS, is not necessarily an indication of suspicious/malicious activity. If the drives are making noises without the front HD activity lights blinking at the same time, it's just the drives performing their automatic self-check and maintenance routine on their own - which happens more or less often and takes more or less time depending on disk type/firmware/model/brand. If the front HD lights are blinking at the same time, it could be a process performing some maintenance on their own. For example, if you leave Windows running in a VM on the NAS, it will perform all kinds of scheduled maintenance tasks (trim logs, optimize filesystems, clean up temporary files, gather telemetry info and send it to MS, scan for and download updates, etc. etc.) that will cause disk activity.
Errorbit
New here
Posts: 6
Joined: Wed Nov 25, 2020 12:17 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Errorbit »

Hello Mauseticks,
Thank you for your advice! can you answer my a essential question ?
If I flash the Nas with the original QTS operation system, does some scripts or other stuff survive (from the old installation in the flash,adoption that he NAS was manipulated)?

This are no bugs , this are manipulations from person(s) ho is(are) not grown up enough mentally I think.
Mousetick
Experience counts
Posts: 1081
Joined: Thu Aug 24, 2017 10:28 pm

Re: Qts 4.5.1.1495 loggin from disabled admin

Post by Mousetick »

Errorbit wrote: Tue Dec 01, 2020 3:03 pm If I flash the Nas with the original QTS operation system, does some scripts or other stuff survive (from the old installation in the flash,adoption that he NAS was manipulated)?
Yes, possibly.

Go to Control Panel > System > Hardware > General, and verify the settings for 'Run user defined processes during startup' (see following screenshot).
autorun.png
Click on the 'View autorun.sh' link to see if you have some script that is installed but you didn't install yourself. If you have some script installed, contact QNAP to remove it.

Make sure the check box before 'Run user defined processes during startup' is NOT selected (my screenshot shows it selected because I use the feature, but for your security it must NOT be selected).

If the check box is not selected, the startup script will not be executed, even if there is one installed.

If you change the state of the check box between selected and not selected, you need to reboot the NAS for the change to take effect.
You do not have the required permissions to view the files attached to this post.
Post Reply

Return to “Turbo Station Installation & Setup”