What causes "service_auth_failed" in shadow1ng/fscan?

Verify the username/password pair is correct (test manually with smbclient or net use).

service_auth_failed

Error message

service_auth_failed

What it means

SMB authentication failed: the plugin connected to the target and completed the SMB handshake, but the credential attempt was rejected. This error is produced in the goroutine that runs the session auth when the result is not a success, wrapping an i18n-localized 'service_auth_failed' message. It signals a wrong username/password rather than a network problem.

Source

Thrown at plugins/services/smb_protocol.go:440

				ErrorType: classifySMBError(err),
				Error:     err,
			}
			return
		}

		if session.IsAuthenticated {
			resultChan <- &AuthResult{
				Success:   true,
				Conn:      &smb1SessionWrapper{session},
				ErrorType: ErrorTypeUnknown,
				Error:     nil,
			}
		} else {
			session.Close()
			resultChan <- &AuthResult{
				Success:   false,
				ErrorType: ErrorTypeAuth,
				Error:     fmt.Errorf("%s", i18n.GetText("service_auth_failed")),
			}
		}
	}()

	select {
	case result := <-resultChan:
		return result, nil
	case <-timeoutCtx.Done():
		go func() {
			result := <-resultChan
			if result != nil && result.Conn != nil {
				_ = result.Conn.Close()
			}
		}()
		return &AuthResult{
			Success:   false,
			ErrorType: ErrorTypeNetwork,
			Error:     fmt.Errorf("%s", i18n.GetText("connection_timeout")),

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the username/password pair is correct (test manually with smbclient or net use).
Check whether the target account is locked out or disabled and unlock it or wait out the lockout policy.
Ensure the credential list generator (GenerateCredentials) is supplied real credentials, not placeholder defaults.
Retry with a different auth dialect/protocol version if the target negotiates a legacy SMB version.

Example fix

// before
result := plugin.Authenticate(ctx, conn, Credential{Username: "admin", Password: "password"})
// after
creds := plugins.GenerateCredentials("smb", cfg) // real, verified credentials
for _, c := range creds {
    result := plugin.Authenticate(ctx, conn, c)
    if result.Success { break }
}

Defensive patterns

Strategy: try-catch

Validate before calling

if cred.Username == "" || cred.Password == "" { return errors.New("smb credential incomplete") }

Type guard

func credComplete(c Credential) bool { return c.Username != "" && c.Password != "" }

Try / catch

res := plugin.Authenticate(ctx, conn, cred)
if res.ErrorType == ErrorTypeAuth {
    // wrong credentials: try next credential, do not retry same pair
}

Prevention

Test credentials manually against the target before automated attempts
Respect account lockout policies to avoid lockouts during scanning
Use verified credential lists rather than defaults
Log ErrorType to distinguish auth failures from network failures

When it happens

Trigger: Calling Authenticate on the SMB plugin with credentials that the remote host rejects; the auth goroutine's else branch fires after session negotiation succeeds but login fails.

Common situations: Brute-force/weak-password scanning against hosts where the credential list does not contain valid accounts; accounts locked out by policy; NTLM disabled on the target; guest access restricted.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/8420850530d965c7. Report an issue: GitHub.