SMB is wonky from domain-joined Windows device

[mrslother]

SMB access is wonky. My u4-423 is domain joined and access works properly from domain-joined Windows devices using domain credentials.
But I get different results depending on the NAS' host name used:

This works (from a Windows commandline):

• dir \\nas\myShare

• dir \\nas.mydomain.com\myShare

But these give me access denied:

• dir \\nas.local\myShare

• dir \\192.168.x.y\myShare

If an am accessing a Windows shared directory it doesn't matter what host I use as long as it resolves to the device being queried. But apparently the Terramaster NAS is more sensitive? Can anyone explain what setting I need to set to provide Windows parity?

[RyanYang]

I would like to know which version of TOS you are using. Are there any error messages when the connection is refused?
You might try restarting the Windows "explorer" process, or try the solutions mentioned in the following link: viewtopic.php?t=2759
Additionally, please check if all devices have the correct DNS configuration, and verify the firewall and network settings to ensure there are no rules blocking connections using the IP address.

[mrslother]

Thank you for your response, TMRyan. This morning it is working as expected. I cannot explain what the difference is between last night and this morning. I the tests last night and this morning ran it on the same Windows server. I am at a loss for words.

The DNS server used have all the various NAS host names registered except for nas.local, which is resolved via mDNS on the NAS box itself.

At the time of the failures pinging all the various host names resulted in proper IP lookup and ping responses.

If this happens again I'll re-engage this thread. But in the meantime it appears to be fine. Thanks for your help.

[mrslother]

It happened again. Not sure why it started working but I verified on 2 different Windows machines (desktop & server):

All 3 names properly resolve the correct IP address. Yet if I access a shared directory using nas.local or IP address it denies access.
NOTE: this shared directory provides my user account full access and guest read only access.

First, try just using the netbios name (let the DNS resolver manage it). This is successful:

Code: Select all

c:\>ping nas

Pinging nas.mydomain.com [192.168.1.5] with 32 bytes of data:
Reply from 192.168.1.5: bytes=32 time=1ms TTL=64
Control-C
^C

c:\>net view \\nas
Shared resources at \\nas

NAS

Share name  Type  Used as  Comment

-------------------------------------------------------------------------------
MySharedFolder       Disk
The command completed successfully.

Next, specify the FQDN. This, too, is successful:

Code: Select all

c:\>ping nas.mydomain.com

Pinging nas.mydomain.com [192.168.1.5] with 32 bytes of data:
Reply from 192.168.1.5: bytes=32 time<1ms TTL=64
Control-C
^C

c:\>net view \\nas.mydomain.com
Shared resources at \\nas.mydomain.com

NAS

Share name  Type  Used as  Comment

-------------------------------------------------------------------------------
MySharedFolder       Disk
The command completed successfully.

Now, resolve the IP using mDNS. This will fail access:

Code: Select all

c:\>ping nas.local

Pinging nas.local [192.168.1.5] with 32 bytes of data:
Reply from 192.168.1.5: bytes=32 time<1ms TTL=64
Control-C
^C

c:\>net view \\nas.local
System error 5 has occurred.

Access is denied.

Finally, just use the actual IP address. This, too, fails:

Code: Select all

c:\>ping 192.168.1.5

Pinging 192.168.1.5 with 32 bytes of data:
Reply from 192.168.1.5: bytes=32 time<1ms TTL=64
Control-C
^C

c:\>net view \\192.168.1.5
System error 5 has occurred.

Access is denied.

At this point I am at a loss to explain this. I have configured Samba on various linux devices and access (net view or net use) renders properly regardless of how I access it (dns host name, FQDN, IP, mDNS, ...).

[IrisLi]

Can you tell me the version of the system you are using?
This could be due to a network or permission setting issue.
1. You can try changing the access user's permissions for MySharedFolder from read/write to read-only and then read/write, then try connecting and check if the problem still occurs.

2. Use an IPC connection: Although this is not a direct way to view shared resources, you can try using an IPC connection to test network connectivity and permissions. Use commands such as

Code: Select all

net use \\192.168.1.5\IPC$ /user:username password

(replace username and password with the actual username and password)

3. Multiple connections to a server or shared resource by a user with more than one username are not allowed. Disconnect all connections to this server or shared resource and try again.

[mrslother]

Current TOS version: 6.0.535
BIOS/InitBoot version: 5.19

Answers:
1. I did try changing permissions as you described; no luck.
I changed the TOS user and the TOS guest accounts. I also changed the domain group that my user is part of; toggling to read only, confirmed, then reopened the dialog and changed it back to read/write, confirmed.
None of these made any difference.

2. I did connect to the IPC$. When doing so using the host name:

Code: Select all

net use \\nas\ipc$ /user:xxxx

The command is successful and I can net view and dir with success as long as I use the host name like:

Code: Select all

dir \\nas\myshare

Even though \\nas\ipc$ is properly connected it still fails if I use:

Code: Select all

dir \\192.168.1.5\myShare

Error is "System error 5 has occurred. Access is denied.

If I delete the IPC$ connection then try:

Code: Select all

net use \\192.168.1.5\ipc$ /user:xxxx

it properly asks for my password but then fails with the same access denied error.

3. In my scenarios I am ensuring no other connections from the same machine are active:

Code: Select all

c:\>net use
New connections will be remembered.

There are no entries in the list.

Further details ... I get the same results from an Android device (nVidia Shield) on my network. When trying to view pictures (using fotos app) I have to rely on SMB access via IP address. Accessing using this IP always prompts for user/password even though I connect as guest (guest is enabled as readonly for the target share).

[TMeric]

If it's convenient, you can book a technical engineer through our website's online support to remotely troubleshoot the issue for you.

[mrslother]

Thank you, Eric. I would rather not take up valuable time during my work day troubleshooting something like this. Is there a more detailed help page or list of options available? From the forums and Reddit this certainly seems like a common type of problem.

If I need to I'll schedule time. But would prefer alternatives first.

[TMLila]

Thank you, Eric. I would rather not take up valuable time during my work day troubleshooting something like this. Is there a more detailed help page or list of options available? From the forums and Reddit this certainly seems like a common type of problem.

If I need to I'll schedule time. But would prefer alternatives first.

We suspect that your file may be corrupted, which could lead to issues with SMB connectivity. To address this, please follow these steps:

1. View the file contents: Run the following command to inspect the file:

cat /etc/samba/smb-extend.conf

2. Restore the file from backup: If the file is indeed corrupted and you have a backup, you can attempt to restore it by executing:
sudo cp /etc.default/samba/smb-extend.conf /etc/samba/smb-extend.conf

We hope these steps will be helpful in resolving your issue. Should you continue to experience difficulties, please do not hesitate to contact our technical team for remote technical support.

[mrslother]

Thank you for responding. The file does not look corrupted (settings seem reasonable).
However since I posted this I have updated to v6.0.555. This broke my active directory join (TM support acknowledged this and will have a fix in the future). But, as a result of the domain break, all of the methods to access the NAS are working! I can use a host of FQDN, Netbios name, IP, whatever. All of the examples I cited above are working; just without domain credentials.

I suspect that the problem I was running into is domain joined related.