DSM-G600, DNS-3xx and NSA-220 Hack Forum

Hi Patrick,
I'm sure someone will describe the cause better, but it appears I have had the same problem, and maybe many others as there are a few posts active at the moment about permissions and access denied.

The only way I could change the access is denied error was to manually change it via fun plug (Chmod -r 777), telnet and putty. I tried for HOURS, via vista, XP, ubuntu 7.1 wil absolutely no luck, especially with no user lockdown on the webpage user interface.

Hopefully someone has an easy way, but realistically the "mods" are quite simple to do.

For me to get temporary access to folders (usually folder within folder got the acess denied), I had to remove ALL users from the webpage interface and allow everyone access to everything via root, not exactly very secure !

Consider fun plug and putty.

Others may be more helpful,
Regards

First type this (and post the output) at the telnet prompt

# / ls -la /mnt/HD_a2/E1505 Backups

and

# / ls -al /mnt/HD_a2/E1505 Backups/NSPIRON-E1505

this command 'ls -al" will list the contents of the directories with
the file permission and owner and groups.  Most of the time the
"Access Denied" is can be traced to user/groups permissions not
being set as desired.

O.K. this shows that the directory

/mnt/HD_a2//E1505 Backups is owned by nobody who is a member of group 501
this directory has read/write/execute permission set for the owner/group/others

see http://en.wikipedia.org/wiki/File_system_permissions for an explanation of Unix
file system permissions

But... /mnt/HD_a2/E1505 Backups/INSPRON-E1505 is owned by admin who is a
member of group 500 and this directory has read/write/execute permissions set
only for the owner admin.

My guess is you are not connecting to the DNS-323 as user admin and that is why
you are getting the permission denied response.

The next piece of information we need to determine the correct action to take is...
What is the user you are connecting (via windows explorer) to the DNS-323.

Can you create a test file in the directory \Volume_1\E1505 Backups using explorer?
If you can, make a file test_file.txt, then from the telnet session type

# / ls -la /mnt/HD_a2/E1505 Backups/test_file.txt

and post the output.  That will let us know the user and group we need
to provide permissions to access the INSPRON-E1505 directory.

Last edited by mig (2008-04-29 22:18:23)

Sorry - I was refreshing the page, and it actually reposted my original post, but after you had already posted.

The correct image for test_file.txt is now attached.  Thanks.

---

Attachments:
ScreenShot002.jpg, Size: 40,220 bytes, Downloads: 157

Patrick G,

Thanks for the output,  here is one way you can setup your permission
You could choose to allow the user nobody, group 501 access to the INSPIRON-E1505
directory by changing the directory's group and opening up the permissions

First change the group for the INSPIRON-E1505 directory to 501

# / chgrp 501 "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"

# / ls -la "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"
drwx------  4 admin 501   4096 Mar 29 23:04 .

Then open the permission on the INSPIRON-E1505 directory to allow read/write/execute
for the group (which is now 501)

# / chmod g+rwx "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"

# / ls -la "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"
drwxrwx---  4 admin 501   4096 Mar 29 23:04 .

If you would like users who are not the owner (admin) or in the group 501 to see this
directory you could open read/execute permission to 'others' with

# / chmod o+rx "/mnt/HD_a2/E1505 Backup/INSPIRON-E1505"

# / ls -la "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"
drwxrwxr-x  4 admin 501   4096 Mar 29 23:04 .

-- or --

You could change the owner of the INSPIRON-E1505 to user nobody with

# / chown nobody "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"

# / ls -la "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"
drwx------  4 nobody 500   4096 Mar 29 23:04 .

This would; however, not allow any access by the user admin, group 500.

-- or --
You could just open up all permission without changing any users or groups with

# / chmod ugo+rwx "/mnt/HD_a2/E1505 Backup/INSPIRON-E1505"

# / ls -la "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505"
drwxrwxrwx  4 admin 501   4096 Mar 29 23:04 .

I really depends on what the access control you wish to have with your data.

Okay, that worked for INSPIRON-E1505 - thank you!  But I'm still getting Access Denied on its subfolders.  Any way to grant access to all subfolders in that folder?

Okay, after running chmod -R ugo+rwx "/mnt/HD_a2/E1505 Backups/INSPIRON-E1505" I was able to access all subdirectories.  I then ran Windows Vista Backup and it created a new subfolder dated today (2008-04-30).  I am getting the Access Denied when trying to access that folder now.  It seems I'm unable to access any new folders that Windows Vista Backup creates.  I did not have this issue before upgrading to the 1.04 firmware.  See attached.

Last edited by Patrick G. (2008-05-01 00:54:53)

---

Attachments:
ScreenShot001.jpg, Size: 82,559 bytes, Downloads: 146

# cat /etc/samba/smb.conf
[ global ]
interfaces = egiga0
unix charset = UTF8
workgroup = GAMET
netbios name = DNS323
server string = DNS-323
hosts allow =
hosts deny =
security = SHARE
encrypt passwords = yes
max log size = 0
socket options = TCP_NODELAY SO_RCVBUF=65536 SO_SNDBUF=65536
max xmit = 65535
create mask = 0777
directory mask  = 0777
force create mode = 0777
force directory mode = 0777
load printers = Yes
printcap name = /usr/local/LPRng/etc/printcap
min print space = 2000
max print jobs = 1000
printing = lprng
print command = /usr/local/LPRng/bin/lpr -P%p -r %s
lpq command = /usr/local/LPRng/bin/lpq -P%p
lprm command = /usr/local/LPRng/bin/lprm -P%p %j
lppause command = /usr/local/LPRng/sbin/lpc hold %p %j
lpresume command = /usr/local/LPRng/sbin/lpc release %p %j
queuepause command = /usr/local/LPRng/sbin/lpc -P%p stop
queueresume command = /usr/local/LPRng/sbin/lpc -P%p start
use sendfile =yes


[ web_page ]
comment = Enter Our Web Page Setting
path = /mnt/web_page
valid users =
read only = yes
guest ok = yes

[printers]
path = /mnt/HD_a4/.lpd
guest ok = Yes
printable = Yes
use client driver = Yes
browseable = No

[ Volume_1 ]
comment =
path = /mnt/HD_a2
valid users =
read only = no
guest ok = yes
oplocks = yes
map archive = yes

I use Vista Backup (and also Nero BackItUp), and they are both able to write to my backups folder. I have the same firmware, fun_plug version, and Vista SP as you.

One difference between my setup and yours is that my "backups" share on the DNS323 requires a username and password to access it. By insisting on a password you shouldn't get the situation where the files are written with one set of credentials (presumably your backup service has been given username admin and a password at some time), and then you try to browse them with another set of credentials (the guest user?)

Another difference is that I reformatted my drives after I updated the firmware (I used to use RAID 0, but it wasn't useful).

I have a single group called private, and a single user in that group that has the same username and password that I log in to my Vista machine with. (You don't have to use the same password, but it's a little bit easier if you do)

It looks to me as though your Vista Backup is accessing the DNS323 using the guest ("All Accounts" in the web UI)  account, but you are trying to browse the backups using a username and password that your Windows machine has stored). Did you give Vista Backup a username to access the DNS323 ever? How else would the files get written as "admin"?

Would that setup work for you? I have used groups just in case I want to give access to other users in the future, but in your case maybe user access is more appropriate.

I've attached a screenclip of my Network Access List from the Admin Web Page, Advanced >> Network Access section.

Hope that helps, or at least gives someone more knowlegable a clue :-)
Steven

Last edited by sjmac (2008-05-01 12:06:41)

---

Attachments:
netaccess.png, Size: 26,223 bytes, Downloads: 147

Patrick G. wrote:

Well, when I set up Vista Backup, it prompts me for a username and password, so I just entered the admin username/password

I think that is the cause of your problem because you have allowed guest access to the DNS323 too. When backup runs it logs in as admin, but when you then go to look at the files later you are coming in as a guest user, and so you aren't allowed to look at the files.

Try setting up Vista Backup again, and don't supply a username or password, or add the admin name and password to your list of network passwords (Control Panel > User Accounts > [user name] > Manage my network passwords), or create a user account on your DNS and switch off guest access ...