[Samba] strange 'notnobody' auth attempt

David Bear David.Bear at asu.edu
Thu Jul 15 19:49:34 GMT 2004


I'm running a samba 2.x server on a freebsd box. I looked in the samba
logs today and noticed that there are a lot of logon failures. The
identity that attempts is called 'notnobody'.

I check and this identity does not exist on any of the machines
attempting to log onto the server.  Now I'm confused. I no about the
nobody account... but 'notnobody'.  Below are some snippets.

[2004/07/15 11:08:57, 1] smbd/reply.c:reply_sesssetup_and_X(1104)
  Username notnobody is invalid on this system
[2004/07/15 11:08:59, 1] smbd/reply.c:reply_sesssetup_and_X(1104)
  Username notnobody is invalid on this system
[2004/07/15 11:08:59, 1] smbd/reply.c:reply_sesssetup_and_X(1104)
  Username notnobody is invalid on this system

This kind of activity occurs for lots of different machines, not just
one machine. I'm begining to wonder if there is some trojan horse on
these clients...
-- 
David Bear
phone: 	480-965-8257
fax: 	480-965-9189
College of Public Programs/ASU
Wilson Hall 232
Tempe, AZ 85287-0803
 "Beware the IP portfolio, everyone will be suspect of trespassing"


More information about the samba mailing list