Guest access is set to Full but users can't write to share

[lolmaus]

Hi!

QNAP 439 Pro II+, firmware 3.4.3 Build 0520T.

I've got a Samba share. Advanced folder permissions are disabled. It is not part of an Active Directory domain, configured as a workgroup (Windows users are members of a Win2003 AD, but i hope that doesn't matter).

I want all users within my secure LAN to access the share with write permissions. No restrictions are necessary.

1) If i set guest access to read and write, users access the share in read-only mode! They cannot save to share! Whyyy?

2) Giving read and write access to the group "everyone" seems to be ignored.

3) I set guest access to deny, create a NAS user and grant him read and write permissions to my share. Windows users can no longer access the share, a login dialog window appears. But it won't authenticate with the NAS user's credentials! I tried logging in both with "username" and "NASNAME\username". It fails immediately (wrong password)! Whyyyy?

I found similiar threads:
http://forum.qnap.com/viewtopic.php?f=189&t=41498
http://forum.qnap.com/viewtopic.php?f=1 ... ilit=write
But there's no solution.

[schumaku]

The default configuration of the Public share (Guest r+w, everyone r+w, ...) does allow unauthenticated access to the share for read and write.

Deploying the same scheme to any other share does allow the same. Can't see any problems accessing and Public share on a QNAP NAS from an AD member system using an AD login, as well as any other standalone Microsoft Networking client.

A typical cause, why authentication requests fail as you show is related to the fact, that only one identity (one set of credentials) can be used to login from the same client to the same server/NAS. The almost legacy XP and earlier Windows were not very user-friendly in this point. Check System Administration >> System Logs -> Online Users in case.

[lolmaus]

schumaku

Well, what you say didn't help me resolve my problem.

But i solved the issue accidentially!

I removed all users and groups (including "everyone") from share's permissons, leaving "Guest Right Accesss" set to Full.

I also used "net use" to make Windows XP forget credentials.

After that the share let me in with read-write permissions! Windows also didn't save credentials because public (non-credential) access was used.

Ain't it a bug?

[schumaku]

I think it's correct. Let's take it into pieces:

1. Enabling Guest Access to Full access does allow any kind of unauthenticated access to the share. The file and folder ownerships are mapped to guest:everyone.

2. Adding "everyone" (slightly different from AD, everyone are "all local authenticated users") r+w access allows to use the share with accounts known on the NAS, and is mapping the ownersip accordingly. This shuld - in my opinion - not break your usage case, but it's not really mandatory.

The only thing I could imagine to break the access, will be when the same user exists on the AD and the NAS - and the credentials (password) does not match.

[lolmaus]

The issue persists! ((

My share's access list is empty and guest access is set to full:


Advanced Folder Permissions are disabled.

Client's Windows XP does NOT store the share's credentials:


Users can access the share, but when i drag a file into it, a "Permission denied" error appears:


QNAP Y U NO LET ME WRITE???

Seriously, that's not funny. A read-only NAS is useless to my company. Help!

PS Here's how the access log entry looks like:

Code: Select all

Type	 Login date	 Login time	 Users	 Source IP	 Computer name	 Connection type	Accessed resources
			2011-07-28	09:46:07	guest	192.168.20.202	gergel	Samba	STK
(...)

[lolmaus]

I've given a NAS user read/write access to the share. Then accessed the share:

Code: Select all

C:\Documents and Settings\gergel>net use \\stor\stk 123 /user:stor\stk
The command completed successfully.

But the result is the same: read access OK, but write access is forbidden! WHYYYYYYY

[lolmaus]

Hey QNAP techsupport, i've found something that might help you debug my issue.

I've given the admin user write access to the share, accesssed the share with "net use", and i do have write access to the share!

But it's kinda wrong to give admin credentials to users. I want them to access the share as guests with write permissions.

[schumaku]

Hey QNAP techsupport, i've found something that might help you debug my issue.

This is no tech support here. This is a pure community forum, not an official tech support channel. Users without QNAP.... usernames are not acting on behalf of QNAP here.

But it's kinda wrong to give admin credentials to users. I want them to access the share as guests with write permissions.

Clarification: If you want allow access to your AD identified users only, you must integrate the NAS into the AD, and grant the access rights accordingly. Otherwise, anybody with access to your network has full guest access to your NAS shares.

Does the NAS see the access by the user stor\stk as a local user access for the user stor, or as a guest access?

Curious: When you login ot aour AD server - as administrator or as a normal user - can you write to the share?

[lolmaus]

Clarification: If you want allow access to your AD identified users only, you must integrate the NAS into the AD, and grant the access rights accordingly. Otherwise, anybody with access to your network has full guest access to your NAS shares.

No, we don't need any restrictions, i want anybody who's in the LAN to have write access.

(Actually, i'm going to reinstall everything in the network, create a new domain, etc. When i do, i'll connect the NAS to the domain. But for now i need a transitional network storage: so that i can reinstall the server without preventing users from accessing their data.)

Does the NAS see the access by the user stor\stk as a local user access for the user stor, or as a guest access?

1) NAS user not in permissions list, access as guest → NAS sees user "guest", it has read-only access.

2) NAS user not in permissions list, access as NAS user → won't let him in.

3) NAS user has write permission, access as NAS user using command

Code: Select all

net use \\stor\stk 123 /user:stor\stk

NAS sees him like this:

Code: Select all

Login date	 Login time	 Users	 Source IP	 Computer name	 Connection type	Accessed resources
	2011-07-28	10:40:08	stk	192.168.20.3	charlie	Samba	STK

Looks like that's not a local user? But if i access as NAS's user "admin", it's also seen with "computer name: charlie", but it DOES have write access.

Ain't it a file permissons issue, not Samba persmissions issue?

Code: Select all

chmod -R ugo+rw /share/STK

KOWABUNGA!

[lolmaus]

[schumaku]

Because of ... it's simply not required The U**x permissions are pure standard and are created all the same. Why do you play with permissions at all? You don't have to...

Any new share that is created has a destination folder with the correct permissions. There is no need to touch U**x permissions, file and folder ownerships (owenr GID and UID), under normal operating conditions.

Exceptions:

1. NFS - you might have to adjusst the default permissions to gain interoperability with SMABA, AFP, ...
2. Imported daa from external storage media.

[lolmaus]

Right. I've got the data by running rsync on the NAS via SSH.

This kinda explains the reason of the problem.

Thx schumaku.

[dr_pangloss]

I would like to say the above is kinda BS. I just spent an hour or more trying to copy a file to this freakin POS. (TS-469L)

Why on earth is this hardware/software so unfriendly.

In the end, I followed the advice here and deleted the share and re-added: WORKED FINE.

Having to delete the share to flush some crap on the NAS is bush league. This is an expensive product, it should work better than my mother's western digital.

[Don]

Really? Your first post and it is to post a complaint on a 5 year old thread.

[schumaku]

I would like to say the above is kinda BS. I just spent an hour or more trying to copy a file to this freakin POS. (TS-469L)

And what BS has the admin done to make it fail?

Why on earth is this hardware/software so unfriendly.

The NAS does just reflect you. This is a community forum, some basic attitude of saying hello, and provide details about the NAS configuration (Advanced Folder Permissions or plain shared folder permissions only in place, a view in the shared folder configuration in place, a view on the U*x folder permissions and the ACLs if applicable, and probably if and how some sub-folders on the share in questions had been added. Then the community might be able and willing to help.

In the end, I followed the advice here and deleted the share and re-added: WORKED FINE. Having to delete the share to flush some ** on the NAS is bush league. This is an expensive product, it should work better than my mother's western digital.

Zero problems to create as many custom shared folders of shared folders, grant the access rights, and access these accordingly.

Welcome to the QNAP NAS Community Forum!