SMB Repo - Login Attempts from ComputerName$

VMware specific discussions

SMB Repo - Login Attempts from ComputerName$

Veeam Logoby J1mbo » Thu May 18, 2017 8:55 am

9.5 deployed with SMB repo provided by a NAS.

The NAS is showing 13 failed login attempts from [computername]$ each time a backup runs, which looks to occur when processing VIB and VBK files. Initial TMP and and VBM file access uses the configured account directly. The 14th attempt is made using the correct account and therefore succeeds. However, we are unable to implement e.g. fail2ban filtering currently because of the incorrect account being used.

Any help with this would be much appreciated.
J1mbo
Expert
 
Posts: 261
Liked: 29 times
Joined: Tue May 03, 2011 12:51 pm
Full Name: James Pearce

Re: SMB Repo - Login Attempts from ComputerName$

Veeam Logoby foggy » Thu May 18, 2017 3:28 pm

Hi James, job debug logs need to be reviewed here, since they contain information about used logins and related failures.
foggy
Veeam Software
 
Posts: 14765
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: SMB Repo - Login Attempts from ComputerName$

Veeam Logoby J1mbo » Mon May 22, 2017 12:24 pm

OK I've looked at this a little more. Looking at task.[vm-name]-[moid].log near the start of the job I see these:

Code: Select all
[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] [FC] Checking whether file or folder \\[smb-server]\[reponame] exists.
[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] [FC] Checking whether file or folder \\[smb-server]\[reponame]\[Job-name] exists.
[22.05.2017 13:06:12] <20> Info     Initializing shared repository client for repository '[reponame]'.
[22.05.2017 13:06:12] <20> Info         Starting target agent ( sharing mode: 'SharedAgent', host: 'on repository'.).
[22.05.2017 13:06:12] <80> Info     Invoker strategy: DefaultStrategy
[22.05.2017 13:06:12] <20> Info     [CProxyRpcInvoker] RpcInvoker HashCode:56200296 was disposed
[22.05.2017 13:06:12] <20> Info     [backup-server-fqdn] Identity for impersonation is not specified.

(bunch of logs about strategy follow)

Identity not specified?? Not till later do we see the credentials being determined:
Code: Select all
[22.05.2017 13:06:13] <20> Info     Creds user name: Datastore-Username
[22.05.2017 13:06:13] <20> Info     Setting share creds to [\\[smb-server]\[reponame]]. CredsId: [4bbb1533-d725-4670-ae90-3741ef70e1ff]
[22.05.2017 13:06:13] <20> Info     Setting share creds to [\\[smb-server]\[reponame]]. Domain: [.], User: [Datastore-Username]
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'Invoke: System.SetShareCredentials\n{\n  (EString) Path = \\[smb-server]\[reponame]\n}\n'
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: <VCPCommandResult result="true" exception="" />
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: <VCPCommandArgs />
[22.05.2017 13:06:13] <11> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'isFileExists\n\\[smb-server]\[reponame]\[Job-Name]\[Job-Name]D2017-05-22T130603.vib\n'
[22.05.2017 13:06:13] <12> Info                   [AP] (53f5) output: 0
[22.05.2017 13:06:13] <12> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:13] <20> Info     Preparing storage '[Job-Name]D2017-05-22T130603.vib' for write. Is optimized for de-duplication media 'False'.
[22.05.2017 13:06:13] <20> Info             [AP] (53f5) command: 'prepStorageForWriteEx\n\\[smb-server]\[reponame]\[Job-Name]\[Job-Name]D2017-05-22T130603.vib\n1024\n0\n'
[22.05.2017 13:06:29] <11> Info                   [AP] (53f5) output: >
[22.05.2017 13:06:29] <20> Info     [StorageLock] Locking storage(s) for write increment


The account was locked by the storage server at 13:06:29 in this case, as usual after 13 failed attempts.
J1mbo
Expert
 
Posts: 261
Liked: 29 times
Joined: Tue May 03, 2011 12:51 pm
Full Name: James Pearce

Re: SMB Repo - Login Attempts from ComputerName$

Veeam Logoby foggy » Mon May 22, 2017 12:35 pm

Please contact our technical team for logs analysis.
foggy
Veeam Software
 
Posts: 14765
Liked: 1083 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: SMB Repo - Login Attempts from ComputerName$

Veeam Logoby J1mbo » Wed May 24, 2017 10:57 am 1 person likes this post

For the benefit of the search - apparently a known issue in 9.5, fixed in 9.5u2.
J1mbo
Expert
 
Posts: 261
Liked: 29 times
Joined: Tue May 03, 2011 12:51 pm
Full Name: James Pearce


Return to VMware vSphere



Who is online

Users browsing this forum: No registered users and 18 guests