[howto] add WSDD to embeded install to be discover in SMB

[mj666]

Windows 10 machines will not discover Samba shares of XigmaNAS in windows file explorer (Network). Access share with direct path like \\xigmanas\share is working without problems. Enabling all CIFS 1.0 features in Windows may also solve this problem but open some security issues. There is a package already available for FreeBSD (https://github.com/christgau/wsdd, https://www.freshports.org/net/py-wsdd/). I have tested the following in a live system and it works as expected.

Code: Select all

pkg install py37-wsdd
sh /usr/local/bin/wsdd start

The following line need to be added into /etc/rc.conf

Code: Select all

wsdd_enable="YES"

The changes will not persist after reboot since the image for the embedded disk will not be updated. Updating this image on USB will be a bit tricky.

DDWRT is using WSDD2 (https://github.com/Andy2244/wsdd2) but this require some additional porting to FreeBSD first.

[netware5]

You may easily arrange it by yourself. No need to be included in the FW. You may wish to read this thread in the old forum https://www.xigmanas.com/oldforums/view ... 56&t=14467. I am using WSDD since long time ago on my embedded installation of XigmaNAS.

[mj666]

Many thanks for the info. I have not found this during investigations last days and the info will be lost in a few day when the old forum will go offline. Here is what i did now and it works perfectly:

Entry in "System > Advanced > rc.conf" (likely not needed at the moment since the service is started by the postinit script)

Code: Select all

wsdd_enable = YES

Entry in "System > Advanced > Commands" as type "PostInit"

Code: Select all

pkg install -q -y py37-wsdd; service wsdd start; exit

Anyhow this is an workaround and will only work with an active internet connection during boot. Would be good the devs will add this to XigmaNas in a native way. Its a low hanging fruit but it looks to be a pending request since a while.

[jamaroney]

Is python 3 already part of the latest XNAS releases?

If so, then all you need to do for an embedded install is to download the file wsdd.py to some place other than the system drive (in my case /mnt/HDD), and then run the following as a PostInit in "Command Scripts":

daemon -u nobody -S /mnt/HDD/wsdd.py -w MSHOME -i em0 -s

Change variables -u, -w, and -i as needed/desired for your system.

Works like a charm!

[mj666]

Installing the "PY37-wsdd" package is updating/installing the required dependency's including Phyton3. Here is what sows up in the log during boot:

Code: Select all

pkg: indexinfo-0.3.1 installed
pkg: readline-8.0.4 installed
pkg: libffi-3.3_1 installed
pkg: gettext-runtime-0.21 installed
pkg: python37-3.7.9_1 installed
pkg: py37-wsdd-0.6.2_1 installed
daemon: 2021-03-15 17:33:53,104:wsdd WARNING(pid 4130): no interface given, using all interfaces

Nothing else needs to be done then configure the line from my last post to make it work. The packet contains the daemon startup script and finds the required parameters automatically. The second part of the line is using this script to start the daemon.

this is how it shows up in the process list:

Code: Select all

 PID USERNAME    THR PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
4130 _wsdd         1  20    0    32M    21M kqread   2   0:00   0.00% python3.7

[zoon01]

Nice topic

Before i get the question again to add it into XigmaNAS

i wrote:
Re: New WSD Discovery for Samba Shares
Post by zoon01 » 24 Sep 2019 02:33

After some thoughts, we will not integrate wsdd.py by default in XigmaNAS releases.
I am aware that other projects has integrated this script so that users with lesser knowledge can find their shares after smb v1 is removed on the client.
I think for those who really want to use this, the webgui has the options (script postinit) to run so.
Python36 is used on XigmaNAS 12.0 and upcoming 11.3 release this will give you all lesser work to make this running.
Personal do I think that Windows/Samba needs to redesign in source to change this behave as it is now.

Something to read too:
https://www.zdnet.com/article/protocol- ... s-attacks/

[mj666]

@zoon01 many thanks for your information and feedback. Even after quite some investigations before my post it looks to be, I missed some related information. I can live with the workaround as this is working quite well for me and is simple.

BTW: Many thanks for your continuous work and dedication to the XigmaNAS project.

[Brahiewahiewa]

...
Something to read too:
https://www.zdnet.com/article/protocol- ... s-attacks/

Note that all windows 7, 8 and 10 machines run WS-discovery.
However on windows, the WSD service is restricted to only act on requests originating from the local subnet and to only respond to hosts on the local subnet. This invalidates DDOS attacks on a world wide scale, though the local subnet might still be affected.
The WSD python script lacks these restrictions. So I agree that in it's current form, the script is not suitable for Xigmanas. Once the lack of security is addressed, you might reconsider

[mj666]

There is still the option to configure the XigmaNAS firewall to restrict access also to the local subnet. I my case external access to the WSD service is not possible anyhow and only works from the local subnet.

[netware5]

...
Something to read too:
https://www.zdnet.com/article/protocol- ... s-attacks/

Note that all windows 7, 8 and 10 machines run WS-discovery.
However on windows, the WSD service is restricted to only act on requests originating from the local subnet and to only respond to hosts on the local subnet. This invalidates DDOS attacks on a world wide scale, though the local subnet might still be affected.
The WSD python script lacks these restrictions. So I agree that in it's current form, the script is not suitable for Xigmanas. Once the lack of security is addressed, you might reconsider

Normally the access to ANY NAS port from outside shall not be allowed. This is the main task of the home router firewall. The golden rule for home router firewall is "no ports open to the external world except the port a VPN server listens on!". No any service on any device belonging to the local LAN should be accessible from outside! The people that does not follow the golden rule are just stupid and inviting hackers! So I don't see a problem to use WSDD if the router door is closed. And also NO UPNP allowed!

[Brahiewahiewa]

...
Something to read too:
https://www.zdnet.com/article/protocol- ... s-attacks/

Note that all windows 7, 8 and 10 machines run WS-discovery.
However on windows, the WSD service is restricted to only act on requests originating from the local subnet and to only respond to hosts on the local subnet. This invalidates DDOS attacks on a world wide scale, though the local subnet might still be affected.
The WSD python script lacks these restrictions. So I agree that in it's current form, the script is not suitable for Xigmanas. Once the lack of security is addressed, you might reconsider

Normally the access to ANY NAS port from outside shall not be allowed. This is the main task of the home router firewall. The golden rule for home router firewall is "no ports open to the external world except the port a VPN server listens on!". No any service on any device belonging to the local LAN should be accessible from outside! The people that does not follow the golden rule are just stupid and inviting hackers! So I don't see a problem to use WSDD if the router door is closed. And also NO UPNP allowed!

There's hardly anyone who'll deliberately open the port for WSD in his router.
It's a two stage process: a vulnerable machine in your network loads a malicious web site, instructing the vulnerable machine to access WSD on another machine in your network, spoofing the DDOS-victims ip-address.
No port forwards required, no admin privileges required

[zoon01]

Port is added into our svn, its getting a user service so the end choice is for the users.
They can keep it disabled or enable it for discovery when they want or need.

Everybody Happy

[raulfg3]

Port is added into our svn, its getting a user service so the end choice is for the users.
They can keep it disabled or enable it for discovery when they want or need.

Everybody Happy

thanks a lot

some screen capture of how enable or disable it for reference?

[ms49434]

Port is added into our svn, its getting a user service so the end choice is for the users.
They can keep it disabled or enable it for discovery when they want or need.

Everybody Happy

thanks a lot

some screen capture of how enable or disable it for reference?

The WSD WebGUI page is currently developed, see below screenshot from the testbox:

[raulfg3]

good to know, thanks a lot

[ms49434]

We need testers for WSD, please check viewtopic.php?f=16&t=764

[mj666]

Cool, did some testing on my virtual test NAS with the beta version. WSDD is working well. Many thanks. Looking forward for the next release.