Bug/Exploit in Vista file sharing.

[ANON86364]

Lets say that you have an AD server, and your My Documents are redirected to a share on the server. Would you like Windows to prompt you with a username/password every time you accessed your My Documents? And lets not forget how much that directory is actually accessed behind the scenes. This is a very common practice, and it most certainly makes since that your username and password are passed automatically. Even if you don't have an AD in place, this would be the same process, it would still make perfect sense that your current username and password are tried first and if not successful, it prompts for credentials that are. It is not a big deal that Windows handles autherntication differently than other OSes. Every OS will do it differently, that is the point of being a different OS. The Windows implementation makes perfect sense in how it is used.

[presence06]

I'm not a complete genius when it comes to understanding file sharing either but when I try and access my computer from say my home computer on the same network I have to type in the user name and password and then yes I have access to all files and what have you. But without that I don't have access to ****. Why the hell do you have Guest enabled anyways? Plus there should be an admin password even if you don't use it. When you choose the option to share files within vista it even TELLS YOU DO YOU WANT TO ENABLE USERNAME AND PASSWORD .. are you just paranoid?

username and password first line of defense?

[seamer]

From what I read it looks like c:\users\name\folder1 was shared, but c:\users\name was available over the network...which does indeed sound fishy.

[NeHoMaR]

I wonder why Windows file share is so dumb. Why not show me a list of computers in the LAN and/or a list of users in every PC, with a box of yes or not for sharing and permissions for everyone, in a easy and 100% secure way? Someone with 1 month of programming studies could program this?

So, if this is the way Windows file sharing works, I won't share a thing now.

BTW, I still don't know why I cannot access the folder with a computer with same user/pass.

Any third party software for advanced and secure file sharing in a LAN? I am interested.

[Julius Caro]

Lets say that you have an AD server, and your My Documents are redirected to a share on the server. Would you like Windows to prompt you with a username/password every time you accessed your My Documents? And lets not forget how much that directory is actually accessed behind the scenes. This is a very common practice, and it most certainly makes since that your username and password are passed automatically. Even if you don't have an AD in place, this would be the same process, it would still make perfect sense that your current username and password are tried first and if not successful, it prompts for credentials that are. It is not a big deal that Windows handles autherntication differently than other OSes. Every OS will do it differently, that is the point of being a different OS. The Windows implementation makes perfect sense in how it is used.

AD behaves differently. I'm talking about flat SMB protocol on a peer to peer network. If with AD when you log in on a computer the credentials are not checked locally but remotely (the AD server), that session already belongs to the domain/AD, so if those credentials are "passed through" when other resources inside the domain prompt for credentials, then it would make sense. I dont know how AD works anyway, so I could be 200% wrong.

[ANON86364]

I wonder why Windows file share is so dumb. Why not show me a list of computers in the LAN and/or a list of users in every PC, with a box of yes or not for sharing and permissions for everyone, in a easy and 100% secure way? Someone with 1 month of programming studies could program this?

So, if this is the way Windows file sharing works, I won't share a thing now.

BTW, I still don't know why I cannot access the folder with a computer with same user/pass.

Any third party software for advanced and secure file sharing in a LAN? I am interested.

For a list of users with nice little check boxes there's a tab labeled "Security" on whatever folder you want to edit the security for. You can add and remove users using this and allow or deny access.

AD behaves differently. I'm talking about flat SMB protocol on a peer to peer network. If with AD when you log in on a computer the credentials are not checked locally but remotely (the AD server), that session already belongs to the domain/AD, so if those credentials are "passed through" when other resources inside the domain prompt for credentials, then it would make sense. I dont know how AD works anyway, so I could be 200% wrong.

Yes AD works differently, but adding the same username and password to every PC is essentially trying to emulate the same centralized security.

...Even if you don't have an AD in place, this would be the same process...

[+BudMan MVC]

in a easy and 100% secure way?

So, if this is the way Windows file sharing works, I won't share a thing now.

And how is having to have a valid username and password to access a share not secure??

If you do not feel a username and password is secure enough -- then force ipsec with certificates to talk to your machine :rolleyes:

Windows presenting the current credentials of the user to the machine that the user tried to access is not secure HOW?? How is the OS doing for the user less secure than the user typing it in????

[Julius Caro]

It's not the fact that one has to type the credentials that bother me, it's the fact they have to be those credentials. The whole "having the same username/password" on all computers, that's not the norm. On p2p networks the norm is probably for every computer to have whatever users they want, so technically, more often than not windows will deal with having to provide credentials than having the local ones working remotely. I have 7 computers on my home network and only the two that are mine have the same username/password, the others may have my account but with a different password.

This things are 'surfacing' because vista works like it should and the anonymous access is disabled by default. Even if it is described, widely known, and all that, it sounds more like an 'easy hack' to mimic AD behaviour rather than something that should affect regular usage. Sure, instead of having a centralized AD server, let's just clone all the credentials on all computers and voila!

THe only thing I would like to see in the vista network and sharing centre is the ability to change the "sharing and discovery" preferences on an interface basis, rather than changing the preferences on all interfaces that have SMB enabled.

[Linkinfamous]

I wonder why Windows file share is so dumb. Why not show me a list of computers in the LAN and/or a list of users in every PC, with a box of yes or not for sharing and permissions for everyone, in a easy and 100% secure way? Someone with 1 month of programming studies could program this?

So, if this is the way Windows file sharing works, I won't share a thing now.

BTW, I still don't know why I cannot access the folder with a computer with same user/pass.

Any third party software for advanced and secure file sharing in a LAN? I am interested.

Windows provides all of the tools you need to set up file sharing effectively: Group Policy, The "Shares" portion of Computer Mangment, the Network Center, and the security/share settings on an individual resource.

THe only thing I would like to see in the vista network and sharing centre is the ability to change the "sharing and discovery" preferences on an interface basis, rather than changing the preferences on all interfaces that have SMB enabled.

You can change such settings on a network-type basis. (ie: Public networks can have sharing Disabled, while Private has them enabled) and then alter the type of each network you're connected to accordingly.

[+BudMan MVC]

It's not the fact that one has to type the credentials that bother me, it's the fact they have to be those credentials. The whole "having the same username/password" on all computers,

Who ever said they "HAVE" to be the same?????

As long as you auth to the machine with valid account on the machine you can gain access -- there is nothing saying that it has to be the logged in account on machine B..

Its just easier for users to set it up that way.. Nobody ever said it only works that way.

As long as you know an account and password on Machine A, you can auth as that account.. You do not have to have an account with the same username or password on machine B or even logged in.. Ie you could be logged in as billy on machine B and auth as susan to machine A

Nobody ever said that accounts HAD to be the same on each machine.

If if you try to access machine A from machine B and the current account does not match up with an account on machine A or the passwords do no match -- then you will be prompted. Only if you have authed to the machine as some other account, do you run into problems.. Ie if you have a session open as guest to the machine.. you can not also auth as Billy -- you would have to kill your guest session first before you can auth as another user. You can only ever have 1 session open between machines as ONE account.

You can auth to the machine with the gui prompts, or just do it from the command line

net use \\machine\ipc$ /u:machine\username password

or map a drive

net use * \\machinename\share /u:machine\username password

etc.. etc..

Again your seeing issues and bugs and concerns in something you clearly do not understand.

edit: Nor did anyone state that creating the same usernames and passwords on machine would be a replacement for a central userbase? For starters that would be a NIGHTMARE to manage password changes on..

Creating the same username and password on multiple machines is a OK method for "HOME" networks -- or very SMALL mom and pop type shops.. But it would not be a valid method in a real world business network.

Ie I create a budman account on my kids machines with the same password I use on my machine -- just so I do not have to worry about authing to the machines, and that I will have full admin rights, etc. That does not mean you would use the same method on anything other than a home/private network of a few machines.

Edited June 7, 2008 by BudMan

[SuperKid]

Can someone answer my question earlier about the guest thingy, when i shared my folder D:\Music on my hard drive i hit share, then continue right and comes up with users Matthew my name was already in there, i added 1 called Guest it was already readable and hit share and it shared, when people access on other pc it accesses as readable, did i share it correctly? i just not sure how to share properly in vista yet, but it works for xp pc, i aint tried my bros vista pc to connect to it yet but xp just logs in auto with readable.

Also the user Matthew on the share, does that mean if i login with the user matthew on other pcs i will get full permission, because i don't want that should i disable the matthew account so there is no way to get full permission on any other pc and just Guest as readable which seems to work, right?

[+BudMan MVC]

So you shared it with permissions of GUEST having read permissions, and Matthew with Full?

As to users logging in with matthew on other machines -- Do these other matthew accounts have the same exact password as your machines matthew account? Blank is not a password BTW.

Yes if users know/access your machine with an account -- they will have whatever rights that account has.

[SuperKid]

I setup an account Guest as readable and Matthew full, accounts have no password set on my pc where im sharing the folder, if i logon to my dads pc which is named \\DADSPC on the network and logon account Dad and go to the share it loads up with no user/pass and just comes up with readable permission only.

Im not sure if i set this up correct, basically all i want to do is set it so all the pcs on my network can access the share with read only permission, i can access the share from my pc and edit anything i wish as i just go to the folder im sharing on my pc.

Just not sure if i set it up right?

[+BudMan MVC]

if your matthew account your machine has no password -- then they can not auth as that account.

if you do not want to be able to use different accounts for different permissions to shares -- then just use simple file sharing! All remote access is limited to GUEST then.

[NeHoMaR]

Mmm, let me add an update to this post.

Well, about the computer not being able to access the shared files, the problem is this one:

HERE

The problem is even when I change the user name to the one with permissions, that name is a fake, so the original account name is always the same (for example, in Documents and Settings) // and I DON'T want to make a new accounts (even when this actually works).

So, I don't know a way to REALLY change the account name, that's the thing I really want, anyone knows how?

Edited June 19, 2008 by NeHoMaR

[ANON86364]

Mmm, let me add an update to this post.

Well, about the computer not being able to access the shared files, the problem is this one:

HERE

The problem is even when I change the user name to the one with permissions, that name is a fake, so the original account name is always the same (for example, in Documents and Settings) // and I DON'T want to make a new accounts (even when this actually works).

So, I don't know a way to REALLY change the account name, that's the thing I really want, anyone knows how?

Read the article.

STATUS

This behavior is by design. The Welcome screen displays the Full name field of the user account, not the actual account name.

You cannot change the logon name, only the display name. You need to do it right the first time, and if you screwed up, you need to do it over. You live and learn.

[+BudMan MVC]

Who said you can not change the logon/username?

Sure if your using that lame ass user manager in control panel.. then yeah using the change name "red arrow" only changes the full name listed on on the account. And the not the actual username/logon name.

but if you right click on computer and say manage, users then you can change the actual username. Or if you use run control userpasswords2 -- blue arrows.

[NeHoMaR]

Who said you can not change the logon/username?

but if you right click on computer and say manage, users then you can change the actual username. Or if you use run control userpasswords2

Just tested that in a virtual machine (vmware) and you can change the user, but then show a horrible error message at logon screen and Documents and Settings, etc., keep old name.

Creating a new account completely destroyed Windows logon to the point of being impossible to login at all, thanks of God this is just a virtual machine.

[+BudMan MVC]

I have no idea what you did -- but changing the user name is not an issue.. And creating a New Account sure and and the F should not be a problem.

Sounds like you have something really jacked up even in your virtual machine ;) Is this some kind of nlighted install or something?

I assure you there is not a problem with changing the username. If using cntrl+alt+delete to login there clearly is not an issue, but since I am pretty sure you using the welcome screen. So here I did a quick verification.. I change the name, and then logged in and added a new users, etc. No issues. Do not even have to reboot.

Here is before change

Here I changed it username and fullname

here I added another account

We change usernames ALL the time.. Matter of fact I have to change 433 names here pretty soon in one location, because the username does not match up with email address. And this will be the new standard before we merge a bunch of our domains into one, etc.

Changing user names is no big deal -- what you did I have no freaking idea.. But I assure you changing username is something I do on an almost daily basis, and is a built in functionality of windows - not some hack or anything. Click Click username changed!

edit: here I did it vista as well.. There is NO ISSUES with changing username or adding users -- I have no idea wtf you might have done wrong.. this is a click click done sort of thing..

orig vista

renamed vista account with lots more users

What did you do exactly????

Edited June 19, 2008 by BudMan

[NeHoMaR]

Ok, thanks, I was finally able to access the shared folder with an account originally created with a different name. But, the name in Documents and Settings doesn't change, it's normal? Look like it continue working even with different name.

The problem posted above was because I was testing with a "light" version of Windows (Windows modified for use less RAM), and I imagine something needed for this was missed. This time I tested with a full untouched SP3 Windows XP.

I am really starting to understand the way Windows share. I don't like it, but is good to know.

[+BudMan MVC]

And what exactly do you not like about how windows shares??? How would you suggest it be done better??

[NeHoMaR]

And what exactly do you not like about how windows shares??? How would you suggest it be done better??

Too many things. IMO, Windows look like a very old software patched too many times. They just add and add things and keep the old ones, so they end with a Windows with 3 or 4 utilities for change your user name, 2 or 3 different places where you can change sharing rules, etc. Maybe they are adding another additional window for manage sharing in Windows 7? for the love of God!

If they make a real new Windows, they could make the sharing/permissions/security thing in just one unique window doing the job from newbie to advanced user in a very easy and useful way. This will also make Windows lightweight.

[+BudMan MVC]

What does the method used to change a username have to do with how window does file shares?

There are multiple ways to change a username in linux and os x as well.

Seems like doing it in OS X is a way more complicated than in windows ;)

---

http://www.macworld.com/article/132693/200...rtusername.html

One of the most-frequently-asked questions about Mac OS X is “How do I change my short username?” While it's easy to change your full username—an easily-accessible setting in Accounts preferences—the short username, which is also the name of your home folder in the Finder, seems set in stone (or in silicon, if you will).

And in previous versions of Mac OS X, that was nearly the case: changing your short username was a complicated—and risky—procedure. In fact, it was so complex that even Apple’s own instructions weren’t exhaustive. (Because of this, a colleague and I wrote a special utility for pre-Leopard versions of OS X, ChangeShortName, that did the job right.) But in Leopard, Apple has finally given users a reasonably-simple way to change the short username, and it's located right in System Preferences—assuming you know where to look. Even better, you have three options, of varying levels of complexity and risk, for making the change; all three are considerably safer than the unauthorized procedures you had to use in the past.

---

Options are GOOD!! Forcing or limiting 1 way to do something is BAD. And removing the old ways BREAK things for starters.. Ie if you rewrote the sharing protocols.. Now older versions of the OS would not be able to share files with the new version, etc.. etc..

If you do not like windows -- here's a hint, don't use it.. There are other options to be sure -- but more than likely you will find stuff you do not like, or feel could be done better with all of them, there is a learning curve on how something is done with each system. And with change often comes frustration, if you are use to doing it a different way, etc.

have a go at NFS if you do not like SMB ;)

---

https://help.ubuntu.com/community/SettingUpNFSHowTo

BTW

NFS user permissions are based on user ID (UID). UIDs of any users on the client must match those on the server in order for the users to have access. The typical ways of doing this are:

* Manual password file synchronization

* Use of LDAP

* Use of NIS

---

Your going to find people complaining no matter what your using to share files.

---

http://discussions.apple.com/thread.jspa?threadID=1197971

Topic : File permissions/users/sharing permissions appear broken

There is obviously (to me anyway) a problem with this whole area which has been introduced with Leopard which Apple needs to fix ASAP.

---

[FiB3R]

The total ownage kills me, lol. Some interesting info in there.

[ScottKin]

Too many things. IMO, Windows look like a very old software patched too many times. They just add and add things and keep the old ones, so they end with a Windows with 3 or 4 utilities for change your user name, 2 or 3 different places where you can change sharing rules, etc. Maybe they are adding another additional window for manage sharing in Windows 7? for the love of God!

If they make a real new Windows, they could make the sharing/permissions/security thing in just one unique window doing the job from newbie to advanced user in a very easy and useful way. This will also make Windows lightweight.

I really hate to say this, but with the last comment it's looking to me to be more of a bassackwards way of entering into one of those "Windoz Sux" threads...and I sincerely hope I'm wrong; those threads generate way too much heat with very little light given off.

As far as networking with Windows goes: it's been that way since Windows For Workgroups 3.11, the *NIX world has adopted it through SMB / Samba, and nearly every other network-aware OS or Server OS works the same way - heck, before WfW, NetWare 2.11 worked the same way; once you provided authentication / credentials to the network, you were allowed access to any other directory / folder / mount point where your credentials match the ACL for that object. ACLs just work that way, folks - get used to it, because it's not going to change much in the foreseable future.

--ScottKin