Time Machine backup fails with Authentication Error 80 on TBS-h574TX

Environment:

  • NAS: QNAP TBS-h574TX, firmware QTS 5.2.4 build 20250321

  • SMB Service: Samba 4.20.0 (userspace, ksmbd disabled)

  • macOS: tested on multiple Macs including stable releases

  • Network: direct SMB connectivity confirmed working

Symptoms:

  • Time Machine backup fails immediately with “network username or password” error

  • Manual SMB mount works correctly with same credentials

  • smbutil view -A authenticates successfully

  • backupd fails with NAConnectToServerSync error 80 (EAUTH)

What was investigated:

  • Bonjour/mDNS: _adisk._tcp service was missing → added manually, now working

  • ksmbd kernel driver: was active → disabled, switched to Samba userspace

  • .streams directory: was missing and vetoed → created and removed from veto list

  • Keychain: cleaned and rebuilt multiple times

  • smbpasswd: TimeUser confirmed present with valid NT hash

  • NTLMv2: forced on macOS side, no change

  • tcpdump: backupd opens TCP connection then sends FIN immediately without SMB negotiation when auth fails

Key log from macOS backupd:

NAConnectToServerSync failed with error: 80 (Authentication error)
the correct user or password info may not exist in the System.keychain 
or the server may no longer allow access for this user

Key observation: Manual mount via Finder and AuthType=TimeMachine URL both succeed, but backupd’s internal authentication mechanism (AuthType=TimeMachine via NetAuth framework) consistently fails. This suggests an incompatibility between backupd’s authentication protocol and QNAP’s Samba implementation.

Request: Has anyone successfully configured Time Machine on TBS-h574TX with recent macOS? Is there a known firmware fix or Samba configuration workaround?

I don’t know if it has been fixed yet but there was a bug in Sequoia that prevented Time Machine from working properly if there were non-ASCII characters (ie: non-English) in the file path.

Do you have non-English characters?

I saw that issue and made the path simple with no accent or special character, still fails

OK. What happens if you create a new path for TimeMachine (ie: back up to a different directory - not optimal but it can help resolve protocol issues)?