Topic: Can't access SMEserver shares from windows 7 authentication problems

[NathanLundholm]

I can't access SMEserver shares from Windows 7.  I am having authentication problems.  Neither is in a domain, both are in the same workgroup, called WORKGROUP.  Username I type is admin.  Windows changes it to \\LIVINGROOMPC\admin.  Other computers on the network, such as BEDROOMPC and LAPTOP, have the same issue.  Before and after screencaps attached.

[mmccarn]

My up-to-date windows 7 workstation has no problem connecting to my up-to-date SME 9.2 server using windows networking (SMB).

Here are some things that might be causing your issue:

SME Server SMB/NMB Settings
Here are some notes on the smb, smbd and nmbd configurations on my server so you can compare them to yours.

If your SME is not already set as a workgroup and domain controller I would not change that setting before exhausting other options.

* server-manager -> configuration -> workgroup -> workgroup and domain controller
  * This is set to 'yes' on my server
  * the windows 7 system is *not* joined to the domain
  * the workstation workgroup is 'WORKGROUP'
  * the server's "windows workgroup" is not workgroup

Code: [Select]

# config show smb
smb=service
    DeadTime=10080
    KeepVersions=enabled
    OpLocks=enabled
    OsLevel=35
    RecycleBin=enabled
    RoamingProfiles=no
    ServerName=office
    ServerRole=PDC
    ShadowCount=10
    ShadowDir=/home/e-smith/files/.shadow
    UnixCharSet=UTF8
    UseClientDriver=yes
    Workgroup=myworkgroup
    status=enabled
# config show smbd
smbd=service
    TCPPorts=139,445
    access=private
    status=enabled
# config show nmbd
nmbd=service
    UDPPorts=137,138
    access=private
    status=enabled

Network Layout
My workstations are all on the same class C subnet as the SME server's LAN interface.  I have a dim memory that windows networking may not work across subnet boundaries without extra gymnastics. 

If your workstations are not on the SME server's LAN subnet, try putting something on that network to see if you can connect from there.

SMB v1 support on your workstations
Since Wannacry the standard advice has been to disable SMBv1 on all systems.  Unfortunately, SME still requires SMBv1 support.  If you followed a procedure intended to disable SMBv1 your workstations will not be able to connect to a SME server.

To get to the SME server using Windows networking, you would have to re-enable SMB on each workstation.  You can create firewall rules on each workstation to prevent SMB  to/from anyplace but the SME server.

There are lots of ways that SMBv1 can be disabled:
  * un-check 'File and Printer Sharing for Microsoft Networks' in the network adapter properties on the Windows systems
  * custom firewall rule(s) blocking traffic on ports 445 and 135-139
  * (I think, maybe) using registry edits

Antivirus software on your workstations
If you're running antivirus software on the windows systems it may have started blocking SMBv1

Switch Configuration
While unlikely for a home network, an intelligent switch can be configured to block SMB traffic in the switch itself.

DNS
The windows workstations need to be connecting to the LAN interface of the SME server.  If you are connecting by server name, the name used must resolve to the LAN IP.  If the name resolves to the WAN IP I don't think you'll be able to connect.

[janet]

NathanLundholm

Try this
https://wiki.contribs.org/Windows_7_Support

[NathanLundholm]

I tried both of these.  I know the server was set up right because it WAS working fine.  I had to reformat the Windows PC but I did not touch the SMEserver box.  So whatever the issue was is with the default Windows 7 settings.  I am beginning to think it's totally completely impossible.

[ReetP]

I'm a bit confused here.

First you say:

Other computers on the network, such as BEDROOMPC and LAPTOP, have the same issue.

Which seems to indicate BEDROOM and LAPTOP have the same logon issue as the 'Windows PC' that you had to reformat (for reasons unknown)

Can you take a step back and describe what happened prior to the machine requiring reformatting?

How many desktop/windows computers?

Were they all logging on ok?

Why were you using the 'admin' account to logon and not 'user' ?

When did you last update SME?

  I am beginning to think it's totally completely impossible.

"Once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth."

Admittedly problems can seem impossible, especially with Windows. But logic dictates that is not true. There is a rational explanation somewhere.

So assuming it all worked before, what was changed and why?

[janet]

NathanLundholm

I tried both of these.  I know the server was set up right because it WAS working fine.

You need to be much more verbose & provide far greater details about your settings & exactly what you did when you "tried both of these".
As Reet has asked, you need to provide more details about your setup (Windows & SME), about why you reinstalled Windows, & what settings you selected when setting up Windows.

Please do not give us your believed solution, but give us details & let us decide or work out what is wrong.

From SME server please provide output of
config show smb
config show smbd
config show nmbd

From Windows show us a screen image of the
Control Panel, System, Advanced System Settings, Computer name (Tab)

The first screen image you gave is referring to a Domain: LIVINGROOMPC which suggests you did have a DOMAIN set up.
But your words suggest that is the name of the PC.

Do you know what you are doing ?
Are you a competent SME user & Windows user ?
Do you understand setting up DOMAINS (in Windows networking parlance) ?

Sorry to ask simple questions & query your skill level, but troubleshooting has to start with basics.

[NathanLundholm]

Yes, I am competent with Windows.  I am a beginner with SMEServer.  I don't know how to access the commandline so not sure how to get you those config files you asked for for the server.  For the Windows system, here are the screenshots you asked for.
Before the reformat, only living room PC was accessing shares on the server.  None of the other computers were.  I did get a virus off the web (thanks to my friend's son who can't touch my computers anymore) and I reformatted living room PC and it lost its ability to connect to shares on the server.  As you can see from the screenshots there ARE NO domains set up.

[TerryF]

A little more info will help, what role is your sme server in, server only, server-gateway?
What controls DHCP services on your network? SME server, modem/router, wifi router
Is your network setup using Cabling or Wifi
What are , Windows 7 PC IP, Sme Server IP, Gateway IP

I have a mixed windows setup, server in server/gateway,  windows 10,  windows 7 and an old Vista box all chug along happily only issues have been when Mr MS decided to bork windows 10 samba over 12 months ago, took nearly 12 months to be fully rectified. Windows 7 was not affected and I have never had an issue.

[janet]

NathanLundholm

I don't know how to access the command line so not sure how to get you those config files you asked for for the server........ As you can see from the screenshots there ARE NO domains set up.

To access command line log in to the SME server console (keyboard & monitor) as user root & use the admin password.
Issue the commands shown one by one, press Enter key after each.
Record the output.
type exit & press Enter key to exit

If you cannot directly access the server console, then you need to setup Putty to ssh into the server, then do as above.

Also you can access the server manager
https://SMELANIP/server-manager
or
https://yourdomain.xxx/server-manager

login as admin

Show us the output of the server configuration panel (which is towards the bottom of the server manager)

Sounds like you need to read the online manual to understand how to use SME server, see the contribs.org wiki
also accessible via Documentation link at top of forums

There are quite a few other questions that myself, ReetP & Terry have asked, you need to re-read what we asked & answer them all, one by one.

[NathanLundholm]

Server is in Server Only mode.  DHCP is provided by the router but none of the wired devices get their IP from DHCP.  The PC's IP is 10.1.1.1.  The server's IP is 10.0.0.2.  Subnet mask is 255.0.0.0.  Gateway is the router, 10.0.0.1.  All computers are wired LAN.  The only thing on Wifi are my smarthome devices that won't allow wires, because I prefer wires whenever possible.  Attached are results of server config panel and server config commands.

[NathanLundholm]

Interesting development.  As a test I JUST created a new user.  That was able to connect to the shares, share files in its own folder, etc.  Still can't do this with admin account.  This is not a viable option because I need the files stored on admin account but at least this tells us it's likely a problem with that account.

[janet]

NathanLundholm

The PC's IP is 10.1.1.1.  The server's IP is 10.0.0.2.  Subnet mask is 255.0.0.0.  Gateway is the router, 10.0.0.1.

You probably should change the PC IP's to 10.0.0.3, 10.0.0.4, 10.0.0.5 & so on (where these IP's are unused & undefined in SME server or router), with subnet mask of 255.255.255.0
While the above is OK, more typically in home situations the LAN IP range would be like 192.168.0.1 - 192.168.0.5 etc (or similar).

[ReetP]

Interesting development.  As a test I JUST created a new user.  That was able to connect to the shares, share files in its own folder, etc.  Still can't do this with admin account.  This is not a viable option because I need the files stored on admin account but at least this tells us it's likely a problem with that account.

It doesn't say why you can't connect with the admin account as I believe you normally can.

However, as a matter of principle you shouldn't use it.

Create an ibay/shared folder that is owned by a group say 'homeusers' and put all users who should have access in that group.

All this sort of stuff is in the manual.

I would also follow janets advice and nail down your networking. There isn't any real reason to use a 10.x network.

You also know you can't run 2 DHCP servers on the same network? So if it is enabled on the router you have disabled DHCP on SME?

Personally I disable DHCP on the router and use it on SME. Makes life much easier.

[NathanLundholm]

I know why you can only have one DHCP service.  I have it turned on on the router, and off on the SMEserver.  Furthermore, I have the networking the way I have it set for a reason.  I am kind of OCD and after the 10. the next number tells me which room of the apartment, the third one tells me which area of the room.  It has made it much easier troubleshooting networking.

Since other accounts can connect, how do I get my files that are now effectively locked up tight in the admin account?

[ReetP]

I know why you can only have one DHCP service.  I have it turned on on the router, and off on the SMEserver.  Furthermore, I have the networking the way I have it set for a reason.  I am kind of OCD and after the 10. the next number tells me which room of the apartment, the third one tells me which area of the room.  It has made it much easier troubleshooting networking.

Hmm - OK, wanted to check DHCP to eliminate it as a problem. I can't see you have a big enough apartment to warrant the fussing..... and it actually complicates rather than a simplifies. Hey ho.

Since other accounts can connect, how do I get my files that are now effectively locked up tight in the admin account?

I presume from this comment (because you aren't being very methodical and clear here) we have established that you can connect with other user accounts, but not the admin account, correct?

I also presume you put your files in the PERSONAL directory of the admin account, and did not set up a ibay/shared folder as per the documentation?

(There is a big difference between a users personal directory, and a shared directory/ibay)

[NathanLundholm]

Yes.  I did put the files in the admin's personal directory rather than an ibay.
This was before I read the documentation.

[ReetP]

Yes.  I did put the files in the admin's personal directory rather than an ibay.
This was before I read the documentation.

Ah ok.

Well, it's possible to move files, and that will need doing as it isn't that clever using the admin account for file sharing as you are possibly starting to realise (I blame M$ for dumbing down stuff. Hey ho)

So to recap.

You can login to server-manager using the user admin and the admin/root password, correct?

You can browse, login and see shares from Win 7 as user x with their user password setup in SME, correct?

You can't login and see shares from Win 7 as user admin with your admin/root password, correct? This throws a bad username/password error?

[NathanLundholm]

Correct on all three counts.

And because I COULD access shares on it before the format, but only from one PC, I'm wondering if it's got them tied to one distinct PC (which is no longer recognized due to reformat/reinstall of Windows) for security reasons maybe.

[ReetP]

Correct on all three counts.

OK

And because I COULD access shares on it before the format, but only from one PC, I'm wondering if it's got them tied to one distinct PC (which is no longer recognized due to reformat/reinstall of Windows) for security reasons maybe.

Unlikely.

Shares on SME don't work like that. Access is via user/password. It doesn't care which machine you are coming in from.

Assuming you haven't 'Saved Password' when connecting to the server from any of your machines, ANY of them can login with ANY user password with permission on SME (this is NOT the same as doing Domain Logons)

So, can you access the server using the admin user & password from a different machine, or is that account blocked on them all?

You may need to reboot between attempts.

Now, that got me thinking. I wonder if somehow, somewhere, you mis-typed that admin password and it has been remembered by this cantankerous PC of yours?

There are any number of howtos online about removing stored password eg

https://www.faqforge.com/windows/how-delete-saved-passwords-for-network-drives-in-windows/

Try that (just trying to eliminate stuff... do this slowly and methodically so we can try and find out what does work, and what does not)

Also - can you check that you have:

a) added the Win 7 registry fixes - see docs
Available in https://your.server.net/server-resources/regedit/

2) SMBv1 is installed and running

[NathanLundholm]

I HAVE applied the registry fixes.  I know the password isn't mistyped because I use it to get into server manager and ssh and both of those are working.  Access to admin file directory is blocked on all systems.  Windows 7 registry edits HAVE been applied, but will apply them again.  Smb1 I am pretty sure is installed and running.  How do I find out for sure?

EDIT: Problem solved and I'm not sure exactly how or exactly what's going on.

1. I KNOW the password wasn't mistyped when I programmed it in.
2. I KNOW the password wasn't mistyped every time I tried to log in.
3. Due to the combination of facts 1 and 2, I KNOW I was typing the password accurately, yet it wasn't letting me in due to bad password.
4. Changing the password (a little experiment) caused it to work.  I'm now able to get in with the new password.  This points to the original password being mistyped, yet I know I wasn't mistyping it.

Spock from Star Trek would NOT enjoy this illogical matter, but anyway it's solved with a new password and a severe lack of logic as far as I'm concerned, but thanks both of you.

Hmm.  Is it possible the old password became corrupted, not in server manager or in the admin system, but just in samba?

[TerryF]

What John is suggesting is if you may have mistyped the admin password on a windows PC and it has saved the credentials. Clear the password and credentials that may have been saved on the windows PC, John posted a link to a how to, or google how to remove windows 7/10 credentials

Re smb1, you said you were able to access shares using a users details, ergo smb1 must be working, it has been windows 10 that has issues with the protocol etc windows 7 has been trouble free in that regard


Added: post prior to mine must have been posting as I was typing, alls well that ends that way

[NathanLundholm]

As mentioned in my previous post, changing the admin password for the server in its entirety fixed the problem... which is illogical as I KNOW the password was being typed correctly and the Windows system didn't have it saved, I was typing it manually each time and couldn't have been typing it wrong each time.
But now it's working.
Can passwords get corrupted in samba config somewhere?  I'm flummoxed.  But at least it's working... satisfactory conclusion.

[ReetP]

As mentioned in my previous post, changing the admin password for the server in its entirety fixed the problem... which is illogical as I KNOW the password was being typed correctly and the Windows system didn't have it saved, I was typing it manually each time and couldn't have been typing it wrong each time.

I'm afraid the answer is yes you can... I have watched users do it before. And swear blind they were typing it right.

And hence my chain of questioning.....

But now it's working.

That's the most important thing. Followed by moving your files from the admin personal directory to a proper shared directory (and NOT using the admin account for anything BUT Administration)

Can passwords get corrupted in samba config somewhere?  I'm flummoxed.  But at least it's working... satisfactory conclusion.

Passwords can 'potentially' get corrupted.

However.

Unless you went and tried to manually change something on your server via Putty and didn't tell us, it is extremely unlikely.

And SME syncs your standard user and SMB passwords automatically so it is unlikely that things went awry there.

So when you reset your admin password via the server-manager, it also updated your SMB password too.

[NathanLundholm]

Here's the thing.  I once used a personal (non-admin) folder to store files.  I was unable to access it via FTP.  If this occurs again, I will be needing assistance again with that issue.  But at least this issue is solved.  I will move my files at earliest convenience.

In the article does it say WHY not to use admin folder for my files?I am the administrator and it seemed the simplest solution for keeping them out of the hands of other users of my server.

[ReetP]

Here's the thing.  I once used a personal (non-admin) folder to store files.  I was unable to access it via FTP.  If this occurs again, I will be needing assistance again with that issue.  But at least this issue is solved.  I will move my files at earliest convenience.

You might have better chance of understanding if you follow this up by reading the entire manual. And have a good read around the wiki, and about linux servers in general.

It is just a case of the correct permissions. You may also be better off using say SCP which is more secure than FTP which is pretty insecure. There are other methods of accessing file remotely as well. The Wiki is your friend.

As long as you have SME set up correctly you should have no need of the admin account for files. You can have your own user directory available only to you, and shared directories available to anyone with the correct permissions.

If you get stuck then please ask - it is better to find the correct method than trying to bodge around it with the wrong one. That is the path to disaster.

In the article does it say WHY not to use admin folder for my files?I am the administrator and it seemed the simplest solution for keeping them out of the hands of other users of my server.

Because this is not a Windows world where you were blindly encouraged to just use an admin account and hell with the consequences.

In Linux you have a 'root' account which is god and can do anything. But it is clearly dangerous and lots of bad stuff can go wrong. For some long and complicated reasons buried in the mists of time, SME has an admin account as well that is very similar to the root account.

In Linux you are encouraged to keep those accounts special and treat them with the respect that they deserve. Just because you 'Administrate' the server, it doesn't automatically translate to being an administrative, user day to day.

Save your administrative powers for when you need to administrate.

You should do all your 'normal' day to day stuff with a normal user account that you can set restricted permissions so it can't do so much damage if things go wrong.

You can then add users to groups and give both user and group permissions on what they can and cannot see. A much more sensible and refined idea. There is a wealth of information online about permissions.

That is all extremely simple, and much much safer. You just need to learn how.