Discussions specific to the VMware vSphere hypervisor
Post Reply
J1mbo
Expert
Posts: 261
Liked: 29 times
Joined: May 03, 2011 12:51 pm
Full Name: James Pearce
Contact:

SMB Repo - Login Attempts from ComputerName$

Post by J1mbo » May 18, 2017 8:55 am

9.5 deployed with SMB repo provided by a NAS.

The NAS is showing 13 failed login attempts from [computername]$ each time a backup runs, which looks to occur when processing VIB and VBK files. Initial TMP and and VBM file access uses the configured account directly. The 14th attempt is made using the correct account and therefore succeeds. However, we are unable to implement e.g. fail2ban filtering currently because of the incorrect account being used.

Any help with this would be much appreciated.

foggy
Veeam Software
Posts: 16832
Liked: 1361 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: SMB Repo - Login Attempts from ComputerName$

Post by foggy » May 18, 2017 3:28 pm

Hi James, job debug logs need to be reviewed here, since they contain information about used logins and related failures.

J1mbo
Expert
Posts: 261
Liked: 29 times
Joined: May 03, 2011 12:51 pm
Full Name: James Pearce
Contact:

Re: SMB Repo - Login Attempts from ComputerName$

Post by J1mbo » May 22, 2017 12:24 pm

OK I've looked at this a little more. Looking at task.[vm-name]-[moid].log near the start of the job I see these:

Code: Select all

[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] [FC] Checking whether file or folder \\[smb-server]\[reponame] exists.
[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] [FC] Checking whether file or folder \\[smb-server]\[reponame]\[Job-name] exists.
[22.05.2017 13:06:12] <20> Info     Initializing shared repository client for repository '[reponame]'.
[22.05.2017 13:06:12] <20> Info         Starting target agent ( sharing mode: 'SharedAgent', host: 'on repository'.).
[22.05.2017 13:06:12] <80> Info     Invoker strategy: DefaultStrategy
[22.05.2017 13:06:12] <20> Info     [CProxyRpcInvoker] RpcInvoker HashCode:56200296 was disposed
[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] Identity for impersonation is not specified.
(bunch of logs about strategy follow)

Identity not specified?? Not till later do we see the credentials being determined:

Code: Select all

[22.05.2017 13:06:13] <20> Info     Creds user name: Datastore-Username
[22.05.2017 13:06:13] <20> Info     Setting share creds to [\\[smb-server]\[reponame]]. CredsId: [4bbb1533-d725-4670-ae90-3741ef70e1ff]
[22.05.2017 13:06:13] <20> Info     Setting share creds to [\\[smb-server]\[reponame]]. Domain: [.], User: [Datastore-Username]
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'Invoke: System.SetShareCredentials\n{\n  (EString) Path = \\[smb-server]\[reponame]\n}\n'
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: <VCPCommandResult result="true" exception="" />
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: <VCPCommandArgs />
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'isFileExists\n\\[smb-server]\[reponame]\[Job-Name]\[Job-Name]D2017-05-22T130603.vib\n'
[22.05.2017 13:06:13] <12> Info                   [AP] (53f5) output: 0
[22.05.2017 13:06:13] <12> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:13] <20> Info     Preparing storage '[Job-Name]D2017-05-22T130603.vib' for write. Is optimized for de-duplication media 'False'.
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'prepStorageForWriteEx\n\\[smb-server]\[reponame]\[Job-Name]\[Job-Name]D2017-05-22T130603.vib\n1024\n0\n'
[22.05.2017 13:06:29] <11> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:29] <20> Info     [StorageLock] Locking storage(s) for write increment
The account was locked by the storage server at 13:06:29 in this case, as usual after 13 failed attempts.

foggy
Veeam Software
Posts: 16832
Liked: 1361 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: SMB Repo - Login Attempts from ComputerName$

Post by foggy » May 22, 2017 12:35 pm

Please contact our technical team for logs analysis.

J1mbo
Expert
Posts: 261
Liked: 29 times
Joined: May 03, 2011 12:51 pm
Full Name: James Pearce
Contact:

Re: SMB Repo - Login Attempts from ComputerName$

Post by J1mbo » May 24, 2017 10:57 am 1 person likes this post

For the benefit of the search - apparently a known issue in 9.5, fixed in 9.5u2.

Post Reply

Who is online

Users browsing this forum: DonZoomik and 16 guests