DSM-G600, DNS-3xx and NSA-220 Hack Forum

Sorry for the long winded explanation (cliffs at bottom).  I am setting up a DNS-323 in a small office to be used as a backup for each workstation and also as a shared drive.  It looks like it will work in the end but man have I had to work around a lot of quirks with this device.

Here is an example of the folder structure that I have set up.

Accounting
-> Acc Common
-> Acc Home
      ->AccountingUser1

Sales
-> Sales Common
-> Sales Home
      ->SalesUser1


Etc.

Then, I created groups for the users, such as AccountingGroup and SalesGroup.  I gave access for the AccountingGroup to Acc Common and the SalesGroup to Sales Common and so on.

I then created users; SalesUser1 and AccountingUser1; and added them to the appropriate group.  I also gave them access to their own private folder under Sales Home and Acc Home respectively.

I created all users with the same password, monkey1.  The reason I did this was the users are at a remote site, and are free to change their windows passwords on their local machines at will.  If I were to make the password on the DNS-323 the same as their windows account, if they were to change their windows password, their access to the DNS-323 would be broken.  I don't want to deal with phone calls when this happens.  In hindsight, all users having the same password wasn't very secure, but it was meant to ease administration.

Then, to allow access to the DNS-323 from their computer, I then went to the users machine, went to Manage Network Passwords, and added the password monkey1 when connecting to the DNS-323 with the appropriate account.

This works, with one problem.  Since the passwords for AccountingUser1 and SalesUser1 are the same, it will allow SalesUser1 access to the Acc Common share and vice versa.  Not exactly secure!  I have found that if each user has unique passwords, it will work as intended.

In fact, it doesn't seem to check the username/password combination at all, just the password itself.  If I remove the credentials from Manage Network Passwords entirely, and try to access a share on the device, it prompts with a greyed out username of dns-323\Guest.  Typing in the correct password for that folder will gain access, even though it is the wrong username.

Just thought I'd throw this out there.

Cliffs:

Users with the same passwords can access each others shares even if they do not have explicit access to said shares in the DNS-323 control panel.  IE. the user name does not seem to matter on sub folders of Volume_1.  I tried this with Volume_1 itself and this doesn't work, however.

Last edited by xoltri (2007-11-22 00:46:45)