Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Questions pertaining to Power settings, Auto Block, Permissions, User Quotas and Email alerts may be posted here.
Forum rules
1) This is a user forum for Synology users to share experience/help out each other: if you need direct assistance from the Synology technical support team, please use the following form:

https://account.synology.com/support/su ... p?lang=enu



2) To avoid putting users' DiskStation at risk, please don't paste links to any patches provided by our Support team as we will systematically remove them. Our Support team will provide the correct patch for your DiskStation model.
childejc
Trainee
Trainee
Posts: 14
Joined: Fri Oct 12, 2012 11:26 pm

Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Unread post by childejc » Mon Mar 12, 2018 8:55 pm

I have changed my admin password and have noticed that both my primary and secondary PCs become locked out of the browser login shortly thereafter.

On investigation I found in the logs that both PCs were continually trying to login to the NAS, presumably using the old password, and because they failed several times they then became permanently blocked. I have no idea why they are doing this, or how to update the PW they are using.

I have over come this by putting them both into the "Allowed" list (to prevent their IP addresses being permanently blocked) but although I can now still access the NAS via the browser I can see that both PCs are continuing to try to login to the NAS.

Why are they doing this, is this likely to cause me any issues (other than adding thousands of entries in the log file) and how can I stop this happening?

Thanks for any advice.

User avatar
Shadow771
Knowledgeable
Knowledgeable
Posts: 325
Joined: Sun Jan 28, 2018 11:48 pm
Location: the Netherlands

Re: Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Unread post by Shadow771 » Tue Mar 13, 2018 12:56 pm

From security perspective I should advise first to not to use your NAS's admin account at all if possible. Create a separate account (and add it to the admins group) for administrative tasks. Generate a 14 character password for the 'admin' account, safe it in a safe place (with KeePas or something) and disable that account.

Did you check the WIndows Credential manager on your PC's? The old credential may still be hidden there.

Start menu -> Control Panel (View by large/small icons) -> Credential manager
Synology DS216+II <--> Synology RT1900AC <--> <site-to-site VPN tunnel> <--> Synology RT1900AC <--> Synology DS118

User avatar
Twisted World
Seasoned
Seasoned
Posts: 542
Joined: Sun Jun 12, 2016 8:29 am
Location: Netherlands
Contact:

Re: Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Unread post by Twisted World » Tue Mar 13, 2018 3:39 pm

Are you using any plugins that need authentication, maybe? Like the Download Station plugin or Note Station Webclipper plugin that exist for Chrome?
[ DS918+ | DS916+ | DS216+II | DS1815+ | DS115j | EDS14 | DS212+ | DS211+ | DS411slim ]

childejc
Trainee
Trainee
Posts: 14
Joined: Fri Oct 12, 2012 11:26 pm

Re: Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Unread post by childejc » Tue Mar 13, 2018 11:39 pm

Twisted World - that was the answer! Synology Download Station extension for Chrome was the culprit. Thanks very much.

Shadow771 - thanks for the advice, I will give it serious thought.

childejc
Trainee
Trainee
Posts: 14
Joined: Fri Oct 12, 2012 11:26 pm

Re: Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Unread post by childejc » Wed Mar 14, 2018 8:36 am

I spoke too soon...

After changing the password being used by the chrome extension my PC appeared to be logging in correctly and no new failed login entries were being logged. However, several hours later I now see that it has again resumed attempting to log in and then failing again.

This happens roughly every 20 seconds. In Log Centre under "User" heading it says "system" (lower case) and then under the "Event" heading it says "User [admin] failed to login from {LAN} via DSM".

Then, after a few failed attempts a new line appears in Log Centre where this time the User is SYSTEM (upper case) and the entry in Event is "Last message 'system: user [admin]' repeated 1 times, suppressed by syslog-ng on" my diskstation. The number of failed attempts before this new line appears varies from 1 to 3 each cycle.

I reconfirmed that the chrome extension does have the correct password and can connect successfully.

Any more suggestions?

telos
Ace
Ace
Posts: 738
Joined: Mon Sep 23, 2013 6:12 pm

Re: Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Unread post by telos » Wed Mar 14, 2018 2:38 pm

But this stops when you again disable the plugin? If so, I would do a clean wipe of the plugin. Search out its folders and annihilate any that remain after uninstall. Wipe related browser cache/cookies. Clear any incomplete jobs in Download Station. Reboot PC and DS.

childejc
Trainee
Trainee
Posts: 14
Joined: Fri Oct 12, 2012 11:26 pm

Re: Recurring "User [admin] failed to login from {LAN} via DSM". Why?

Unread post by childejc » Wed Mar 14, 2018 9:21 pm

Telos, I had not actually disabled the extension, just changed the PW it was using. I have now disabled it and hey presto the attempted logins have ceased!!

I have now re-enabled and I can see that it has now logged in successfully and so far there have been no more failed attempts

So hopefully it has worked this time. If it reoccurs I will do as you suggest and remove and reinstall the extension.

Thanks for the tip

Post Reply

Return to “System Management”