Security Risk notification

[HokieHi 2]

Hello all.

Longtime user here, running EmbyServer on Win10 machine. Libraries are located on Synology server (DS413J) running DSM 6.2.4-25556.

Recently I have been receiving a Security Risk notification from the Synology server that I need to disable the Admin user on the server. When I do that the Emby server can no longer receive a stream. The Emby server starts and I can see all the libraries, however, if you try to play or view something it fails with a "Playback Error: No compatible streams available ..."

 

Any help finding a solution would be much appreciated.

 

[rbjtech 5284]

Emby will need read (if saving metadata locally) or read/write (if saving metadata to the shares) access to the shares - and it sound likes it was using the synology 'Admin' account to get this access.

I would create a new 'emby' account on the synology, give it a decent password, add this as read only or read/write to the synology emby shares themselves.    On the Windows machine - attempt to get to the shares using unc - ie \\my_synology_nas\sharename.   Windows SHOULD prompt for an authentication at this point - now put in your synology emby username and password.    If the shares now pop up in windows, then emby will use the same credentials to get access and should play.

 

 

[HokieHi 2]

I created the new embyuser on the synology. Went to Windows file explorer and attempted to pull up \\my_synology_nas\sharename . It gave me an error.

I was able to connect using the synology's IP address. But this didn't resolve the lack of streams for Emby. I know I have used the Server Name in the past.

[Guest]

I would check and see if you have certain protocols enabled for that user.. ( I don't own a Synology ) but on mine, You have the protocols and options to enable globally.. then per share you have usage and access rights to configure per user, per enabled protocol.. This I have to do from an admin account however.. Disbaling the Admin account seems odd unless it just means for normal access of files and apps/servers...

If you do not have SMB turned on for the share/account you won't see it.. AND if in my case you are not using a login.. you won't get in...

It probably wants you to configure an account with privileges and use it instead of the basic Admin account which has access to the Control UI and all of the settings. It keeps the access more restricted and isn't open on the endpoint side.. nor would an attacker be able to walk into it.. should you be circumvented on your network.

[HokieHi 2]

I gave the embyuser RW permissions to the relevant folders on the Synology. 

I am not sure what changed as this PC/server combo have performed without an issue for several years. The security warning I am getting from the Synology has to do with potential for Brute Force attacks, which I assume is primarily because of the Default name Admin.

There was a recent Windows update and it may have coincided with the appearance of the security notifications.

[rbjtech 5284]

ok - so lets check you can actually see the synology at all.

From windows 'Type here to search' box ..

if you enter \\<synology_name> - do you get a prompt for Auth or a list of shares ?

if nothing - if you enter \\<synology_ip> - do you get anything ?

If IP works, but name does not, then this is a master browser issue.  let us know, and we can advise next steps.

 

[rbjtech 5284]

11 minutes ago, HokieHi said:

I am not sure what changed as this PC/server combo have performed without an issue for several years. The security warning I am getting from the Synology has to do with potential for Brute Force attacks, which I assume is primarily because of the Default name Admin.

Absolutely - always disable Admins on all systems if you can and use 'service' accounts instead - which is what we are asking you to do on the synology for emby.  ie, do not use this account for anything other than emby  

Edited April 26, 2021 by rbjtech

[HokieHi 2]

If the Syno Admin account is enabled then \\<synology.name> will display the folders.

If Syno Admin is disabled, connection fails with the message that current user account is disabled.

If I attempt \\<synology.name>\embyuser I get a prompt for user and PW. I enter the credentials it comes back a second time with the prompt then goes to error message unable to connect.

IP address displays folders regardless of Admin user status.

 

[rbjtech 5284]

if you type in 'cred' in the windows search box - you should see 'Credentials Manager' - load this.

You need to find in the 'Windows Credentials' the access it is using for your nas (Admin) - you need to delete this entry.

Come out - then try again with the \\<synology name> - this time it should prompt you for a user and pw.

\\<synology name\<share name> - is what you need to connect to (and emby) - the account used is not listed in the name.

so if your nas was called nas and the share was called films - then you could be able to access it using - \\nas\films 

the fact Ip address shows the folders (can you access what's inside the folders?) means you are almost there ..

Worst case - you can actually use IP's in the UNC names if you wish - ie \\192.168.1.2\films 

Edited April 26, 2021 by rbjtech

[HokieHi 2]

OK. After deleting the synology entries in credentials manager, I was able to get to the server using \\<server name>.  I was not able to append the user name and get in. But once I could see the server using just the server name I could then see the server from within the Emby library.

So the synology Admin account is disabled and I do have full access to the media files from Emby. So mission accomplished.

 

Thank you very much.

 

[rbjtech 5284]

Great - glad you got it fixed