NAS file share "wrong password" that wasn't

Symptom

The file browser in my self-hosted dashboard refused to connect to a NAS share and reported an authentication failure. Same username, same password, same share as always.

Triage

• Checked the boring things first: the NAS was reachable and port 445 was open.
• Tested the exact same credentials from a Linux box with smbclient, and it connected fine. So the password was not the problem.
• Production logs showed the real error: error:0308010C:digital envelope routines::unsupported, thrown from the app’s pure-JavaScript SMB library during NTLM authentication.

Root cause

NTLM uses old hash algorithms (MD4/DES). OpenSSL 3, which ships with current Node, disables them by default. The library caught that crypto failure and passed it up as “bad credentials”, which sent me looking in the wrong place.

Fix

1. Added error classification, so crypto, network and auth failures show up as three different messages instead of one misleading one.
2. Replaced the JavaScript SMB library with the system smbclient, which handles modern and legacy auth properly. Credentials go into a temporary file with 0600 permissions and never into command-line arguments or browser state.
3. I added 15-second timeouts and socket cleanup so a dead share can’t hang the app.

Verification

Health check OK after deploy, smoke tests passing, and the share reports connected: true from production.

Lesson

An error message is a claim, not a fact. Reproduce with a second, independent tool before believing it.