Security errors in the eventlog
Andrew Bartlett
abartlet at pcug.org.au
Fri Sep 28 16:42:03 GMT 2001
Just remember that Samba also sends a compleatly bogus username/password
first, to ensure that the server doesn't silently accept wrong
passwords.
This can fill up the logs. I added a 'parinoid server security' option
to HEAD to turn this off, but I don't think this has migrated into 2.2
Andrew Bartlett
"MCCALL,DON (HP-USA,ex1)" wrote:
>
> It appears to me that you are using Samba with security = server. This
> means that when a client attempts to access a share on samba, samba is going
> to try to get authentication from one of the domain controllers in the NT
> domain that you have specified in the 'workgroup='
> parameter in the smb.conf file. If the user gives a bad password, or
> misspells his username, then you will see these events in the event log.
> Nothing wrong with samba.
> Hope this helps,
> Don
>
> -----Original Message-----
> From: paul.frans.musolf at philips.com
> [mailto:paul.frans.musolf at philips.com]
> Sent: Friday, September 28, 2001 4:42 AM
> To: samba at samba.org
> Subject: Security errors in the eventlog
>
> Dear Sirs,
>
> We are using for the integration between UNIX and Windows your Product
> samba.
> Versions we use are : 2.07 and 1.9.18p10
> UNIX version : HP-UX 10.20 and 11.00
>
> We can connect to the samba shares with no problems or error messages.
>
> BUT if we look in the domain controlers event log chapter security we
> receive the following message:
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 529
> Date: 2001-09-28
> Time: 9:49:09 AM
> User: NT AUTHORITY\SYSTEM
> Computer: IDCSRV01
> Description:
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: I103455
> Domain: PHLRSDIDC
> Logon Type: 3
> Logon Process: KSecDD
> Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
> Workstation Name: \\IDCSRV16
>
> I think I have checked every thing.
>
> Do you have any experience what can cause this message ? What is the best
> way to debug this kind of problem ??
>
> Thank you for your help in advance.
>
> Regards,
>
> Paulfrans Musolf
> Email: paul.frans.musolf at philips.com
> Tel: +31 165 577603
> Fax: +31 165 577433
>
> International Distribution Centre Philips
> Lighting BV
> Bredaseweg 203 4705 RN Roosendaal The Netherlands
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: http://lists.samba.org/mailman/listinfo/samba
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: http://lists.samba.org/mailman/listinfo/samba
--
Andrew Bartlett abartlet at pcug.org.au
Samba Team member, Build Farm maintainer abartlet at samba.org
Student Network Administrator, Hawker College abartlet at hawkerc.net
http://samba.org http://build.samba.org http://hawkerc.net
More information about the samba
mailing list